[InstSimplify] Return poison if insertelement touches out of bounds

[aqjune]

Summary

This is a simple patch that updates InstSimplify to return poison if the index is/can be out-of-bounds

[nikic]

LGTM

llvm/test/Transforms/InstCombine/vector_insertelt_shuffle-inseltpoison.ll

57

Update comment

llvm/test/Transforms/InstCombine/vector_insertelt_shuffle.ll

57

Update comment

[nikic]

llvm/lib/Analysis/InstructionSimplify.cpp

4403

Unrelated, but we should probably have an explicit fold for poison Val here, in which case we don't need non-poison vec.

[aqjune]

llvm/lib/Analysis/InstructionSimplify.cpp

4403

I'll make a patch for this

[fhahn]

Hi! It looks like this may be causing https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29445 .

[aqjune]

In D93990#2666922, @fhahn wrote:

Hi! It looks like this may be causing https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29445 .

Hi, I suspect the error happens because InstSimplify couldn't fold e.g., icmp <2 x i8> %x, <undef, poison>, causing such form to survive until the assertion is checked.
I speculatively made a fix at https://reviews.llvm.org/D99853 , but I couldn't check whether this indeed fixes the failure however. :( I'll leave a comment at the oss-fuzz thread.

llvm/lib/Analysis/InstructionSimplify.cpp

 //===- InstructionSimplify.cpp - Fold instruction operands ----------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
Value *llvm::SimplifyInsertElementInst(Value *Vec, Value *Val, Value *Idx,
                                        const SimplifyQuery &Q) {
   // Try to constant fold.
   auto *VecC = dyn_cast<Constant>(Vec);
   auto *ValC = dyn_cast<Constant>(Val);
   auto *IdxC = dyn_cast<Constant>(Idx);
   if (VecC && ValC && IdxC)
     return ConstantExpr::getInsertElement(VecC, ValC, IdxC);
 
-  // For fixed-length vector, fold into undef if index is out of bounds.
+  // For fixed-length vector, fold into poison if index is out of bounds.
   if (auto *CI = dyn_cast<ConstantInt>(Idx)) {
     if (isa<FixedVectorType>(Vec->getType()) &&
         CI->uge(cast<FixedVectorType>(Vec->getType())->getNumElements()))
-      return UndefValue::get(Vec->getType());
+      return PoisonValue::get(Vec->getType());
   }
 
   // If index is undef, it might be out of bounds (see above case)
   if (Q.isUndefValue(Idx))
-    return UndefValue::get(Vec->getType());
+    return PoisonValue::get(Vec->getType());
 
   // If the scalar is undef, and there is no risk of propagating poison from the
   // vector value, simplify to the vector value.
   if (Q.isUndefValue(Val) &&
       isGuaranteedNotToBeUndefOrPoison(Vec))
     return Vec;
 
   // If we are extracting a value from a vector, then inserting it into the same
   // place, that's the input vector:
   // insertelt Vec, (extractelt Vec, Idx), Idx --> Vec
   if (match(Val, m_ExtractElt(m_Specific(Vec), m_Specific(Idx))))
     return Vec;
 
   return nullptr;

llvm/test/Transforms/InstCombine/out-of-bounds-indexes.ll

;
   tail call void @llvm.assume(i1 %cmp)
   ret i128 %and1
 }
 
 declare void @llvm.assume(i1)
 
 define <4 x double> @inselt_bad_index(<4 x double> %a) {
 ; CHECK-LABEL: @inselt_bad_index(
-; CHECK-NEXT:    ret <4 x double> undef
+; CHECK-NEXT:    ret <4 x double> poison
 ;
   %I = insertelement <4 x double> %a, double 0.0, i64 4294967296
   ret <4 x double> %I
 }

llvm/test/Transforms/InstCombine/vector_insertelt_shuffle-inseltpoison.ll

;
   %ins2 = insertelement<4 x float> %ins1, float 5.0, i32 %a
   %ins3 = insertelement<4 x float> %ins2, float 3.0, i32 2
   %ins4 = insertelement<4 x float> %ins3, float 1.0, i32 1
   %ins5 = insertelement<4 x float> %ins4, float 2.0, i32 2
   %ins6 = insertelement<4 x float> %ins5, float 7.0, i32 %a
   ret <4 x float> %ins6
 }
 
 ; Out of bounds index folds to undef
 define <4 x float> @bazzz(<4 x float> %x) {
 ; CHECK-LABEL: @bazzz(
-; CHECK-NEXT:    ret <4 x float> <float undef, float undef, float 2.000000e+00, float undef>
+; CHECK-NEXT:    ret <4 x float> <float poison, float poison, float 2.000000e+00, float poison>
 ;
   %ins1 = insertelement<4 x float> %x, float 1.0, i32 5
   %ins2 = insertelement<4 x float> %ins1, float 2.0, i32 2
   ret <4 x float> %ins2
 }
 
 define <4 x float> @bazzzz(<4 x float> %x) {
 ; CHECK-LABEL: @bazzzz(
-; CHECK-NEXT:    ret <4 x float> <float undef, float undef, float 2.000000e+00, float undef>
+; CHECK-NEXT:    ret <4 x float> <float poison, float poison, float 2.000000e+00, float poison>
 ;
   %ins1 = insertelement<4 x float> %x, float 1.0, i32 undef
   %ins2 = insertelement<4 x float> %ins1, float 2.0, i32 2
   ret <4 x float> %ins2
 }
 
 define <4 x float> @bazzzzz() {
 ; CHECK-LABEL: @bazzzzz(

llvm/test/Transforms/InstCombine/vector_insertelt_shuffle.ll

;
   %ins2 = insertelement<4 x float> %ins1, float 5.0, i32 %a
   %ins3 = insertelement<4 x float> %ins2, float 3.0, i32 2
   %ins4 = insertelement<4 x float> %ins3, float 1.0, i32 1
   %ins5 = insertelement<4 x float> %ins4, float 2.0, i32 2
   %ins6 = insertelement<4 x float> %ins5, float 7.0, i32 %a
   ret <4 x float> %ins6
 }
 
 ; Out of bounds index folds to undef
 define <4 x float> @bazzz(<4 x float> %x) {
 ; CHECK-LABEL: @bazzz(
-; CHECK-NEXT:    ret <4 x float> <float undef, float undef, float 2.000000e+00, float undef>
+; CHECK-NEXT:    ret <4 x float> <float poison, float poison, float 2.000000e+00, float poison>
 ;
   %ins1 = insertelement<4 x float> %x, float 1.0, i32 5
   %ins2 = insertelement<4 x float> %ins1, float 2.0, i32 2
   ret <4 x float> %ins2
 }
 
 define <4 x float> @bazzzz(<4 x float> %x) {
 ; CHECK-LABEL: @bazzzz(
-; CHECK-NEXT:    ret <4 x float> <float undef, float undef, float 2.000000e+00, float undef>
+; CHECK-NEXT:    ret <4 x float> <float poison, float poison, float 2.000000e+00, float poison>
 ;
   %ins1 = insertelement<4 x float> %x, float 1.0, i32 undef
   %ins2 = insertelement<4 x float> %ins1, float 2.0, i32 2
   ret <4 x float> %ins2
 }
 
 define <4 x float> @bazzzzz() {
 ; CHECK-LABEL: @bazzzzz(

llvm/test/Transforms/InstSimplify/insertelement.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
 ; RUN: opt -S -instsimplify < %s | FileCheck %s
 
 define <4 x i32> @test1(<4 x i32> %A) {
 ; CHECK-LABEL: @test1(
-; CHECK-NEXT:    ret <4 x i32> undef
+; CHECK-NEXT:    ret <4 x i32> poison
 ;
   %I = insertelement <4 x i32> %A, i32 5, i64 4294967296
   ret <4 x i32> %I
 }
 
 define <4 x i32> @test2(<4 x i32> %A) {
 ; CHECK-LABEL: @test2(
-; CHECK-NEXT:    ret <4 x i32> undef
+; CHECK-NEXT:    ret <4 x i32> poison
 ;
   %I = insertelement <4 x i32> %A, i32 5, i64 4
   ret <4 x i32> %I
 }
 
 define <4 x i32> @test3(<4 x i32> %A) {
 ; CHECK-LABEL: @test3(
 ; CHECK-NEXT:    [[I:%.*]] = insertelement <4 x i32> [[A:%.*]], i32 5, i64 1
 ; CHECK-NEXT:    ret <4 x i32> [[I]]
 ;
   %I = insertelement <4 x i32> %A, i32 5, i64 1
   ret <4 x i32> %I
 }
 
 define <4 x i32> @test4(<4 x i32> %A) {
 ; CHECK-LABEL: @test4(
-; CHECK-NEXT:    ret <4 x i32> undef
+; CHECK-NEXT:    ret <4 x i32> poison
 ;
   %I = insertelement <4 x i32> %A, i32 5, i128 100
   ret <4 x i32> %I
 }
 
 define <4 x i32> @test5(<4 x i32> %A) {
 ; CHECK-LABEL: @test5(
-; CHECK-NEXT:    ret <4 x i32> undef
+; CHECK-NEXT:    ret <4 x i32> poison
 ;
   %I = insertelement <4 x i32> %A, i32 5, i64 undef
   ret <4 x i32> %I
 }
 
 define <4 x i32> @test5_poison(<4 x i32> %A) {
 ; CHECK-LABEL: @test5_poison(
-; CHECK-NEXT:    ret <4 x i32> undef
+; CHECK-NEXT:    ret <4 x i32> poison
 ;
   %I = insertelement <4 x i32> %A, i32 5, i64 poison
   ret <4 x i32> %I
 }
 
 define <4 x i32> @elem_poison(<4 x i32> %A) {
 ; CHECK-LABEL: @elem_poison(
 ; CHECK-NEXT:    [[B:%.*]] = insertelement <4 x i32> [[A:%.*]], i32 poison, i32 1

llvm/test/Transforms/InstSimplify/vscale-inseltpoison.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
 ; RUN: opt < %s -instsimplify -S -verify | FileCheck %s
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Vector Operations
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
 ; insertelement
 
 define <vscale x 4 x i32> @insertelement_idx_undef(<vscale x 4 x i32> %a) {
 ; CHECK-LABEL: @insertelement_idx_undef(
-; CHECK-NEXT:    ret <vscale x 4 x i32> undef
+; CHECK-NEXT:    ret <vscale x 4 x i32> poison
 ;
   %r = insertelement <vscale x 4 x i32> %a, i32 5, i64 undef
   ret <vscale x 4 x i32> %r
 }
 
 define <vscale x 4 x i32> @insertelement_value_undef(<vscale x 4 x i32> %a) {
 ; CHECK-LABEL: @insertelement_value_undef(
 ; CHECK-NEXT:    [[R:%.*]] = insertelement <vscale x 4 x i32> [[A:%.*]], i32 undef, i64 0

llvm/test/Transforms/InstSimplify/vscale.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
 ; RUN: opt < %s -instsimplify -S -verify | FileCheck %s
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Vector Operations
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
 ; insertelement
 
 define <vscale x 4 x i32> @insertelement_idx_undef(<vscale x 4 x i32> %a) {
 ; CHECK-LABEL: @insertelement_idx_undef(
-; CHECK-NEXT:    ret <vscale x 4 x i32> undef
+; CHECK-NEXT:    ret <vscale x 4 x i32> poison
 ;
   %r = insertelement <vscale x 4 x i32> %a, i32 5, i64 undef
   ret <vscale x 4 x i32> %r
 }
 
 define <vscale x 4 x i32> @insertelement_value_undef(<vscale x 4 x i32> %a) {
 ; CHECK-LABEL: @insertelement_value_undef(
 ; CHECK-NEXT:    [[R:%.*]] = insertelement <vscale x 4 x i32> [[A:%.*]], i32 undef, i64 0
;
   ret i32 %r
 }
 
 ; more complicated expressions
 
 define <vscale x 2 x i1> @cmp_le_smax_always_true(<vscale x 2 x i64> %x) {
 ; CHECK-LABEL: @cmp_le_smax_always_true(
 ; CHECK-NEXT:    ret <vscale x 2 x i1> shufflevector (<vscale x 2 x i1> insertelement (<vscale x 2 x i1> undef, i1 true, i32 0), <vscale x 2 x i1> undef, <vscale x 2 x i32> zeroinitializer)
-   %cmp = icmp sle <vscale x 2 x i64> %x, shufflevector (<vscale x 2 x i64> insertelement (<vscale x 2 x i64> undef, i64 9223372036854775807, i32 0), <vscale x 2 x i64> undef, <vscale x 2 x i32> zeroinitializer)
-   ret <vscale x 2 x i1> %cmp
+;
 }
 
 define <vscale x 4 x float> @bitcast() {
 ; CHECK-LABEL: @bitcast(
 ; CHECK-NEXT:    ret <vscale x 4 x float> bitcast (<vscale x 4 x i32> shufflevector (<vscale x 4 x i32> insertelement (<vscale x 4 x i32> undef, i32 1, i32 0), <vscale x 4 x i32> undef, <vscale x 4 x i32> zeroinitializer) to <vscale x 4 x float>)
 ;
   %i1 = insertelement <vscale x 4 x i32> undef, i32 1, i32 0
   %i2 = shufflevector <vscale x 4 x i32> %i1, <vscale x 4 x i32> undef, <vscale x 4 x i32> zeroinitializer