Skip to content

[SystemZ] Fix off-by-one error in backend#200141

Merged
uweigand merged 2 commits into
llvm:mainfrom
dominik-steenken:fix-tm-ccmask-offbyone
May 29, 2026
Merged

[SystemZ] Fix off-by-one error in backend#200141
uweigand merged 2 commits into
llvm:mainfrom
dominik-steenken:fix-tm-ccmask-offbyone

Conversation

@dominik-steenken

Copy link
Copy Markdown
Contributor

When combineCCMask is called on a TM node with two constant operands, and all of the bits in the mask are active, the existing APInt bit access goes off the overall length of the integer by one. This commit fixes that by using the index value of the leftmost active bit, rather than the number of active bits.

@llvmorg-github-actions

Copy link
Copy Markdown

@llvm/pr-subscribers-backend-systemz

Author: Dominik Steenken (dominik-steenken)

Changes

When combineCCMask is called on a TM node with two constant operands, and all of the bits in the mask are active, the existing APInt bit access goes off the overall length of the integer by one. This commit fixes that by using the index value of the leftmost active bit, rather than the number of active bits.


Full diff: https://github.com/llvm/llvm-project/pull/200141.diff

1 Files Affected:

  • (modified) llvm/lib/Target/SystemZ/SystemZISelLowering.cpp (+1-1)
diff --git a/llvm/lib/Target/SystemZ/SystemZISelLowering.cpp b/llvm/lib/Target/SystemZ/SystemZISelLowering.cpp
index 26cc921b6b169..c0e671b31fb1a 100644
--- a/llvm/lib/Target/SystemZ/SystemZISelLowering.cpp
+++ b/llvm/lib/Target/SystemZ/SystemZISelLowering.cpp
@@ -8838,7 +8838,7 @@ static bool combineCCMask(SDValue &CCReg, int &CCValid, int &CCMask,
       auto Result = Op0APVal & Op1APVal;
       bool AllOnes = Result == Op1APVal;
       bool AllZeros = Result == 0;
-      bool IsLeftMostBitSet = Result[Op1APVal.getActiveBits()] != 0;
+      bool IsLeftMostBitSet = Result[Op1APVal.getActiveBits() - 1] != 0;
       return AllZeros ? 0 : AllOnes ? 3 : IsLeftMostBitSet ? 2 : 1;
     };
     SDValue Op0 = CCNode->getOperand(0);

@uweigand

Copy link
Copy Markdown
Member

Good catch, thanks! Can we add a test case?

@dominik-steenken

Copy link
Copy Markdown
Contributor Author

I've added a test case derived from the reduction of the csmith-generated program that triggered the error. Since this is just meant to test whether the assert is triggered, it does not include any CHECK: lines.

@uweigand

Copy link
Copy Markdown
Member

I've added a test case derived from the reduction of the csmith-generated program that triggered the error. Since this is just meant to test whether the assert is triggered, it does not include any CHECK: lines.

Thanks! Can we still add (auto-generated) CHECK lines - it would be good to also verify we're in fact getting correct output from this logic ...

When combineCCMask is called on a TM node with two constant operands, and
all of the bits in the mask are active, the existing APInt bit access
goes off the overall length of the integer by one.
This commit fixes that by using the index value of the leftmost active bit,
rather than the number of active bits.
@dominik-steenken
dominik-steenken force-pushed the fix-tm-ccmask-offbyone branch from b99ffca to edee83a Compare May 29, 2026 11:24

@uweigand uweigand left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@uweigand
uweigand merged commit 78eca55 into llvm:main May 29, 2026
10 checks passed
@uweigand uweigand added this to the LLVM 22.x Release milestone May 29, 2026
@github-project-automation github-project-automation Bot moved this from Needs Triage to Done in LLVM Release Status May 29, 2026
@github-project-automation github-project-automation Bot moved this to Needs Triage in LLVM Release Status May 29, 2026
@uweigand

Copy link
Copy Markdown
Member

/cherry-pick 78eca55

@llvmbot

llvmbot commented May 29, 2026

Copy link
Copy Markdown
Member

/pull-request #200384

c-rhodes pushed a commit to llvmbot/llvm-project that referenced this pull request Jun 1, 2026
When combineCCMask is called on a TM node with two constant operands,
and all of the bits in the mask are active, the existing APInt bit
access goes off the overall length of the integer by one. This commit
fixes that by using the index value of the leftmost active bit, rather
than the number of active bits.

(cherry picked from commit 78eca55)
daunabomba pushed a commit to daunabomba/llvm-project that referenced this pull request Jun 2, 2026
When combineCCMask is called on a TM node with two constant operands,
and all of the bits in the mask are active, the existing APInt bit
access goes off the overall length of the integer by one. This commit
fixes that by using the index value of the leftmost active bit, rather
than the number of active bits.

(cherry picked from commit 78eca55)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Development

Successfully merging this pull request may close these issues.

3 participants