| Issue |
55516
|
| Summary |
[InstCombine] crash in InstructionCombine when optimizing sitofp/bitcast/icmp with vectorized values
|
| Labels |
new issue
|
| Assignees |
|
| Reporter |
Benjins
|
The following IR is a minimal repro of the crash (Godbolt link: https://godbolt.org/z/aG8K9vofY ):
```
; opt -passes="instcombine"
define <1 x i1> @do_stuff(i64 %conv) {
entry:
%0 = sitofp i64 %conv to double
%shuffle.i = bitcast double %0 to <1 x i64>
%1 = icmp eq <1 x i64> %shuffle.i, zeroinitializer
ret <1 x i1> %1
}
```
```
opt: /root/llvm-project/llvm/lib/IR/Value.cpp:503: void llvm::Value::doRAUW(llvm::Value*, llvm::Value::ReplaceMetadataUses): Assertion `New->getType() == getType() && "replaceAllUses of value with new value of different type!"' failed.
```
[opt full crash log](https://github.com/llvm/llvm-project/files/8704215/2022_05_16_opt_crash_log.txt)
This seems to be coming from an optimization in InstCombineCompares.cpp that performs the following transformation:
```
icmp eq (bitcast (sitofp X)), 0 --> icmp eq X, 0
```
Where it ends up trying to replace the icmp with a value of type `i1` instead of the type `<1 x i1>`.
The original C++ code that crashed with -O1 (Godbolt link: https://godbolt.org/z/KTfj8h8rE )
```
#include <arm_neon.h>
extern "C" uint64x1_t do_stuff(int64_t IIn, float64x2_t FIn);
uint64x1_t do_stuff(int64_t IIn, float64x2_t FIn) {
float64_t V0 = vcvtd_f64_s64(IIn);
float64x2_t V1 = vsetq_lane_f64(V0, FIn, 0);
poly64x2_t V2 = vreinterpretq_p64_f64(V1);
poly64x1_t V3 = vget_low_p64(V2);
uint64x1_t V4 = vceqz_p64(V3);
return V4;
}
```
which when compiled without assertions crashes with the following:
```
fatal error: error in backend: Cannot select: 0x5613e42008d8: v1i64 = any_extend 0x5613e4200ae0, example.cpp:8:18
```
[Full Clang crash log](https://github.com/llvm/llvm-project/files/8704217/2022_05_16_clang_crash_log.txt)
I have verified that this still repros on the latest trunk (4a94e3801dd721c0083c1259d019a1540388d9d3)
For context: this code was generated by a fuzzer, it was not manually written
![]()
_______________________________________________
llvm-bugs mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
