[X86][AVX] Incorrect decoding of constant vector data from X86ISD::SUBV_BROADCAST_LOAD nodes

[RKSimon]

Bugzilla Link	51281
Resolution	FIXED
Resolved on	Oct 11, 2021 20:29
Version	trunk
OS	Windows NT
Blocks	#51489
CC	@adibiagio,@topperc,@RKSimon,@phoebewang,@rotateright,@tstellar
Fixed by commit(s)	18e6a03 fcd5126

Extended Description

Internal fuzz tests have found an issue that appeared after rGc8472db0a88701.

The more aggressive creation of X86ISD::SUBV_BROADCAST_LOAD nodes has exposed an existing bug with incorrect constant decoding in getTargetConstantBitsFromNode if its referencing a constant pool entry larger than the subvector size.

define <16 x float> @​shuffc(<8 x float> %a0) {
%shuffle = shufflevector <8 x float> %a0, <8 x float> <float poison, float 0x3FD6BB78C0000000, float poison, float poison, float poison, float poison, float 0.000000e+00, float poison>, <16 x i32> <i32 7, i32 7, i32 1, i32 1, i32 6, i32 3, i32 6, i32 0, i32 14, i32 0, i32 9, i32 9, i32 7, i32 1, i32 5, i32 9>
ret <16 x float> %shuffle
}

https://c.godbolt.org/z/b9W3xKe1e

codegen (same for trunk and 12.x):

shuffc: # @​shuffc
vextractf128 xmm1, ymm0, 1
vperm2f128 ymm3, ymm0, ymm0, 1 # ymm3 = ymm0[2,3,0,1]
vshufps xmm2, xmm0, xmm1, 49 # xmm2 = xmm0[1,0],xmm1[3,0]
vshufps xmm1, xmm2, xmm1, 210 # xmm1 = xmm2[2,0],xmm1[1,3]
vmovsldup xmm2, xmm0 # xmm2 = xmm0[0,0,2,2]
vblendps ymm0, ymm3, ymm0, 66 # ymm0 = ymm3[0],ymm0[1],ymm3[2,3,4,5],ymm0[6],ymm3[7]
vpermilps ymm0, ymm0, ymmword ptr [rip + .LCPI0_1] # ymm0 = ymm0[3,3,1,1,6,7,6,4]
vinsertf128 ymm1, ymm2, xmm1, 1
vblendps ymm1, ymm1, ymmword ptr [rip + .LCPI0_0], 141 # ymm1 = mem[0],ymm1[1],mem[2,3],ymm1[4,5,6],mem[7]
ret

trunk constant table:

.LCPI0_0:
.long 0x00000000 # float 0
.zero 4
.long 0x3eb5dbc6 # float 0.355192363
.long 0x3eb5dbc6 # float 0.355192363
.zero 4
.long 0x3eb5dbc6 # float 0.355192363
.zero 4
.zero 4

12.x constant table:

.LCPI0_0:
.long 0x00000000 # float 0
.zero 4
.long 0x3eb5dbc6 # float 0.355192363
.long 0x3eb5dbc6 # float 0.355192363
.zero 4
.long 0x3eb5dbc6 # float 0.355192363
.long 0x3eb5dbc6 # float 0.355192363
.long 0x3eb5dbc6 # float 0.355192363

I'm currently working on a patch.

[RKSimon]

assigned to @RKSimon

[RKSimon]

Test case added at 6569b7f

[RKSimon]

Candidate Patch: https://reviews.llvm.org/D107158

[tstellar]

Merged: ec7ef42

[RKSimon]

Reopening - only the test case has been committed so far, the fix (D107158) is still waiting review

[RKSimon]

Candidate Patch: https://reviews.llvm.org/D107158

Its now been confirmed that this patch fixes all the regressions the internal fuzz tests were seeing - I'll commit shortly

[RKSimon]

Candidate Patch: https://reviews.llvm.org/D107158

Its now been confirmed that this patch fixes all the regressions the
internal fuzz tests were seeing - I'll commit shortly

Committed at 18e6a03 - let's leave it for a couple of days then I think we can merge to 13.x

[RKSimon]

Candidate Patch: https://reviews.llvm.org/D107158

Its now been confirmed that this patch fixes all the regressions the
internal fuzz tests were seeing - I'll commit shortly

Committed at 18e6a03 - let's leave it for a
couple of days then I think we can merge to 13.x

@​tstellar I think this is good to be merged now - thanks!

[tstellar]

Merged: fcd5126

[tstellar]

mentioned in issue #51489