[TTI] getUserCost - Ensure a vector insert/extract index is in unsigned 32-bit range

Otherwise fallback to the generic 'unknown index' path

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29050
This commit is contained in:
Simon Pilgrim 2021-09-25 10:50:54 +01:00
parent ed687c0211
commit 993f3c61b3
2 changed files with 22 additions and 10 deletions

View File

@ -1068,8 +1068,10 @@ public:
auto *IE = dyn_cast<InsertElementInst>(U); auto *IE = dyn_cast<InsertElementInst>(U);
if (!IE) if (!IE)
return TTI::TCC_Basic; // FIXME return TTI::TCC_Basic; // FIXME
auto *CI = dyn_cast<ConstantInt>(IE->getOperand(2)); unsigned Idx = -1;
unsigned Idx = CI ? CI->getZExtValue() : -1; if (auto *CI = dyn_cast<ConstantInt>(IE->getOperand(2)))
if (CI->getValue().getActiveBits() <= 32)
Idx = CI->getZExtValue();
return TargetTTI->getVectorInstrCost(Opcode, Ty, Idx); return TargetTTI->getVectorInstrCost(Opcode, Ty, Idx);
} }
case Instruction::ShuffleVector: { case Instruction::ShuffleVector: {
@ -1132,17 +1134,15 @@ public:
Shuffle->getShuffleMask(), 0, nullptr); Shuffle->getShuffleMask(), 0, nullptr);
} }
case Instruction::ExtractElement: { case Instruction::ExtractElement: {
unsigned Idx = -1;
auto *EEI = dyn_cast<ExtractElementInst>(U); auto *EEI = dyn_cast<ExtractElementInst>(U);
if (!EEI) if (!EEI)
return TTI::TCC_Basic; // FIXME return TTI::TCC_Basic; // FIXME
unsigned Idx = -1;
auto *CI = dyn_cast<ConstantInt>(EEI->getOperand(1)); if (auto *CI = dyn_cast<ConstantInt>(EEI->getOperand(1)))
if (CI) if (CI->getValue().getActiveBits() <= 32)
Idx = CI->getZExtValue(); Idx = CI->getZExtValue();
Type *DstTy = U->getOperand(0)->getType();
return TargetTTI->getVectorInstrCost(Opcode, U->getOperand(0)->getType(), return TargetTTI->getVectorInstrCost(Opcode, DstTy, Idx);
Idx);
} }
} }
// By default, just classify everything as 'basic'. // By default, just classify everything as 'basic'.

View File

@ -73,3 +73,15 @@ define void @test4() noreturn nounwind {
store i32 undef, i32* @g_47, align 4 store i32 undef, i32* @g_47, align 4
br label %1 br label %1
} }
; OSS-Fuzz #29050
; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29050
define <2 x i177> @ossfuzz_29050(<2 x i177> %X) {
bb:
br label %BB
BB:
%I3 = insertelement <2 x i177> undef, i177 95780971304118053647396689196894323976171195136475135, i177 95780971304118053647396689196894323976171195136475135
br i1 true, label %BB, label %BB1
BB1:
ret <2 x i177> %I3
}