From a5041987eddc21d37345d055cb7a51b3eb5ee698 Mon Sep 17 00:00:00 2001
From: Craig Topper <craig.topper@intel.com>
Date: Wed, 24 Jun 2020 19:46:31 -0700
Subject: [PATCH] [X86] Emit a reg-reg copy for fast isel of vector bitcasts.

Previously we just updated a map and moved on. But it possible
we cached known bits information with the vreg that can be used by
another basic block. If the other basic block has a different view
of the VT these known bits won't make sense.

By emitting a copy we ensure we have different vregs before and
after the bitcast. This prevents the known bits from being used
with the wrong type.

Differential Revision: https://reviews.llvm.org/D82517
---
 llvm/lib/Target/X86/X86FastISel.cpp              | 13 ++++---
 llvm/test/CodeGen/X86/fast-isel-bitcast-crash.ll | 44 ++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 4 deletions(-)
 create mode 100644 llvm/test/CodeGen/X86/fast-isel-bitcast-crash.ll

diff --git a/llvm/lib/Target/X86/X86FastISel.cpp b/llvm/lib/Target/X86/X86FastISel.cpp
index 147cd1b..23512f3 100644
--- a/llvm/lib/Target/X86/X86FastISel.cpp
+++ b/llvm/lib/Target/X86/X86FastISel.cpp
@@ -3671,12 +3671,17 @@ X86FastISel::fastSelectInstruction(const Instruction *I)  {
       return false;
 
     Register Reg = getRegForValue(I->getOperand(0));
-    if (Reg == 0)
+    if (!Reg)
       return false;
 
-    // No instruction is needed for conversion. Reuse the register used by
-    // the fist operand.
-    updateValueMap(I, Reg);
+    // Emit a reg-reg copy so we don't propagate cached known bits information
+    // with the wrong VT if we fall out of fast isel after selecting this.
+    const TargetRegisterClass *DstClass = TLI.getRegClassFor(DstVT);
+    Register ResultReg = createResultReg(DstClass);
+    BuildMI(*FuncInfo.MBB, FuncInfo.InsertPt, DbgLoc,
+              TII.get(TargetOpcode::COPY), ResultReg).addReg(Reg);
+
+    updateValueMap(I, ResultReg);
     return true;
   }
   }
diff --git a/llvm/test/CodeGen/X86/fast-isel-bitcast-crash.ll b/llvm/test/CodeGen/X86/fast-isel-bitcast-crash.ll
new file mode 100644
index 0000000..c46b5cc
--- /dev/null
+++ b/llvm/test/CodeGen/X86/fast-isel-bitcast-crash.ll
@@ -0,0 +1,44 @@
+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
+; RUN: llc < %s -mtriple=x86_64-unknown-unknown -fast-isel -O1 | FileCheck %s
+
+; This used to crash due to the bitcast in the entry block reusing the vreg
+; from its input. This resulted in known bits being calculated on the v2i64
+; type. But the second basic block tried to use them with a v8i16 type. This
+; was fixed by emitting a reg-reg copy for the bitcast so the vreg type will
+; be seen the same in both basic blocks.
+
+; We need the entry block to fall out of fast isel after selecting the bitcast.
+; The shuffle vector guarantees that. The zext gives us a useful known bits
+; value. We also need the second basic block to fall out of fast isel which the
+; intrinsic guarantees.
+
+define <8 x i16> @bitcast_crash(i32 %arg, <8 x i16> %x, i1 %c) {
+; CHECK-LABEL: bitcast_crash:
+; CHECK:       # %bb.0: # %bb
+; CHECK-NEXT:    movl %edi, %eax
+; CHECK-NEXT:    movq %rax, %xmm1
+; CHECK-NEXT:    pshufd {{.*#+}} xmm1 = xmm1[0,1,0,1]
+; CHECK-NEXT:    testb $1, %sil
+; CHECK-NEXT:    je .LBB0_2
+; CHECK-NEXT:  # %bb.1: # %bb1
+; CHECK-NEXT:    psraw %xmm1, %xmm0
+; CHECK-NEXT:    retq
+; CHECK-NEXT:  .LBB0_2: # %bb2
+; CHECK-NEXT:    movdqa %xmm1, %xmm0
+; CHECK-NEXT:    retq
+bb:
+  %tmp = zext i32 %arg to i64
+  %tmp1 = insertelement <2 x i64> undef, i64 %tmp, i32 0
+  %tmp2 = shufflevector <2 x i64> %tmp1, <2 x i64> undef, <2 x i32> zeroinitializer
+  %tmp5 = bitcast <2 x i64> %tmp2 to <8 x i16>
+  br i1 %c, label %bb1, label %bb2
+
+bb1:                                              ; preds = %bb8, %bb6
+  %tmp9 = call <8 x i16> @llvm.x86.sse2.psra.w(<8 x i16> %x, <8 x i16> %tmp5)
+  ret <8 x i16> %tmp9
+
+bb2:
+  ret <8 x i16> %tmp5
+}
+
+declare <8 x i16> @llvm.x86.sse2.psra.w(<8 x i16>, <8 x i16>)
-- 
2.7.4