[rpms/llvm] rawhide: Fix an illegal zext from combined loads (rhbz#2512927)

[rpms/llvm] rawhide: Fix an illegal zext from combined loads (rhbz#2512927)

[Josh Stone]

            A new commit has been pushed.

            Repo   : rpms/llvm
            Branch : rawhide
            Commit : d0252e25cbc7e7f7d298ec696abc1f8ca31360b5
            Author : Josh Stone <jistone@redhat.com>
            Date   : 2026-08-17T13:33:51-03:00
            Stats  : +106/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/llvm/c/d0252e25cbc7e7f7d298ec696abc1f8ca31360b5?branch=rawhide

            Log:
            Fix an illegal zext from combined loads (rhbz#2512927)

This backports llvm-project#207229 from LLVM 23.

---
diff --git a/0001-AggressiveInstCombine-Fix-crash-when-folding-consecu.patch b/0001-AggressiveInstCombine-Fix-crash-when-folding-consecu.patch
new file mode 100644
index 0000000..7e9b2d0
--- /dev/null
+++ b/0001-AggressiveInstCombine-Fix-crash-when-folding-consecu.patch
@@ -0,0 +1,102 @@
+From 9d5d8834793da9efe297620db3ef39633688f830 Mon Sep 17 00:00:00 2001
+From: Kyungtak Woo <kevinwkt@google.com>
+Date: Sat, 11 Jul 2026 07:42:21 -0600
+Subject: [PATCH] [AggressiveInstCombine] Fix crash when folding consecutive
+ loads into a type smaller than the combined load (#207229)
+
+---
+ .../AggressiveInstCombine.cpp                 | 11 ++--
+ .../AggressiveInstCombine/X86/or-load.ll      | 51 +++++++++++++++++++
+ 2 files changed, 59 insertions(+), 3 deletions(-)
+
+diff --git a/llvm/lib/Transforms/AggressiveInstCombine/AggressiveInstCombine.cpp b/llvm/lib/Transforms/AggressiveInstCombine/AggressiveInstCombine.cpp
+index 844ffe42cf99..cef41c971aa1 100644
+--- a/llvm/lib/Transforms/AggressiveInstCombine/AggressiveInstCombine.cpp
++++ b/llvm/lib/Transforms/AggressiveInstCombine/AggressiveInstCombine.cpp
+@@ -1411,6 +1411,12 @@ static bool foldLoadsRecursive(Value *V, LoadOps &LOps, const DataLayout &DL,
+   if ((ShAmt2 - ShAmt1) != ShiftDiff || (Offset2 - Offset1) != PrevSize)
+     return false;
+ 
++  // Reject if the combined size of the loads exceeds the target type size.
++  // This avoids attempting to emit an invalid ZExt (from wider to narrower
++  // type) when out-of-bounds shifts lead to matching too many loads.
++  if (LoadSize1 + LoadSize2 > X->getType()->getScalarSizeInBits())
++    return false;
++
+   // Update LOps
+   AAMDNodes AATags1 = LOps.AATags;
+   AAMDNodes AATags2 = LI2->getAAMetadata();
+@@ -1478,9 +1484,8 @@ static bool foldConsecutiveLoads(Instruction &I, const DataLayout &DL,
+     NewLoad->setAAMetadata(LOps.AATags);
+ 
+   Value *NewOp = NewLoad;
+-  // Check if zero extend needed.
+-  if (LOps.ZextType)
+-    NewOp = Builder.CreateZExt(NewOp, LOps.ZextType);
++  // Zero extend if needed.
++  NewOp = Builder.CreateZExt(NewOp, LOps.ZextType);
+ 
+   // Check if shift needed. We need to shift with the amount of load1
+   // shift if not zero.
+diff --git a/llvm/test/Transforms/AggressiveInstCombine/X86/or-load.ll b/llvm/test/Transforms/AggressiveInstCombine/X86/or-load.ll
+index 73ff72990005..d8ab24c7b7eb 100644
+--- a/llvm/test/Transforms/AggressiveInstCombine/X86/or-load.ll
++++ b/llvm/test/Transforms/AggressiveInstCombine/X86/or-load.ll
+@@ -2629,3 +2629,54 @@ entry:
+   %res = lshr i64 %or2, 32
+   ret i64 %res
+ }
++
++define i16 @combine_four_i8_loads_i16_poison(ptr %p) {
++; LE-LABEL: @combine_four_i8_loads_i16_poison(
++; LE-NEXT:    [[P2:%.*]] = getelementptr i8, ptr [[P:%.*]], i64 2
++; LE-NEXT:    [[P3:%.*]] = getelementptr i8, ptr [[P]], i64 3
++; LE-NEXT:    [[L3:%.*]] = load i8, ptr [[P2]], align 1
++; LE-NEXT:    [[L4:%.*]] = load i8, ptr [[P3]], align 1
++; LE-NEXT:    [[Z3:%.*]] = zext i8 [[L3]] to i16
++; LE-NEXT:    [[Z4:%.*]] = zext i8 [[L4]] to i16
++; LE-NEXT:    ret i16 poison
++;
++; BE-LABEL: @combine_four_i8_loads_i16_poison(
++; BE-NEXT:    [[P1:%.*]] = getelementptr i8, ptr [[P:%.*]], i64 1
++; BE-NEXT:    [[P2:%.*]] = getelementptr i8, ptr [[P]], i64 2
++; BE-NEXT:    [[P3:%.*]] = getelementptr i8, ptr [[P]], i64 3
++; BE-NEXT:    [[L1:%.*]] = load i8, ptr [[P]], align 1
++; BE-NEXT:    [[L2:%.*]] = load i8, ptr [[P1]], align 1
++; BE-NEXT:    [[L3:%.*]] = load i8, ptr [[P2]], align 1
++; BE-NEXT:    [[L4:%.*]] = load i8, ptr [[P3]], align 1
++; BE-NEXT:    [[Z1:%.*]] = zext i8 [[L1]] to i16
++; BE-NEXT:    [[Z2:%.*]] = zext i8 [[L2]] to i16
++; BE-NEXT:    [[Z3:%.*]] = zext i8 [[L3]] to i16
++; BE-NEXT:    [[Z4:%.*]] = zext i8 [[L4]] to i16
++; BE-NEXT:    [[SH2:%.*]] = shl i16 [[Z2]], 8
++; BE-NEXT:    [[OR1:%.*]] = or i16 [[Z1]], [[SH2]]
++; BE-NEXT:    [[SH3:%.*]] = shl i16 [[Z3]], 16
++; BE-NEXT:    [[OR2:%.*]] = or i16 [[OR1]], [[SH3]]
++; BE-NEXT:    [[SH4:%.*]] = shl i16 [[Z4]], 24
++; BE-NEXT:    [[OR3:%.*]] = or i16 [[OR2]], [[SH4]]
++; BE-NEXT:    ret i16 [[OR3]]
++;
++  %p1 = getelementptr i8, ptr %p, i64 1
++  %p2 = getelementptr i8, ptr %p, i64 2
++  %p3 = getelementptr i8, ptr %p, i64 3
++  %l1 = load i8, ptr %p
++  %l2 = load i8, ptr %p1
++  %l3 = load i8, ptr %p2
++  %l4 = load i8, ptr %p3
++  %z1 = zext i8 %l1 to i16
++  %z2 = zext i8 %l2 to i16
++  %z3 = zext i8 %l3 to i16
++  %z4 = zext i8 %l4 to i16
++  %sh2 = shl i16 %z2, 8
++  %or1 = or i16 %z1, %sh2
++  %sh3 = shl i16 %z3, 16
++  %or2 = or i16 %or1, %sh3
++  %sh4 = shl i16 %z4, 24
++  %or3 = or i16 %or2, %sh4
++  ret i16 %or3
++}
++
+-- 
+2.55.0
+

diff --git a/llvm.spec b/llvm.spec
index 05d9a39..9e2bd1c 100644
--- a/llvm.spec
+++ b/llvm.spec
@@ -610,6 +610,10 @@ Patch2105: 43cb4631c1f42dbfce78288b8ae30b5840ed59b3.patch
 # Fix for s390x vector miscompilation (rhbz#2430017)
 Patch2106: 0001-SystemZ-Fix-code-in-widening-vector-multiplication-1.patch
 
+# Fix an illegal zext from combined loads (rhbz#2512927)
+# https://github.com/llvm/llvm-project/pull/207229
+Patch2207: 0001-AggressiveInstCombine-Fix-crash-when-folding-consecu.patch
+
 %if 0%{?rhel} == 8
 %global python3_pkgversion 3.12
 %global __python3 /usr/bin/python3.12