From a5b75b8179d7db4ff720e19233d2b99fd15b94f0 Mon Sep 17 00:00:00 2001
From: Jakob Botsch Nielsen <Jakob.botsch.nielsen@gmail.com>
Date: Wed, 20 Sep 2023 22:04:58 +0200
Subject: [PATCH] JIT: Fix invalid containment of vector broadcasts (#92333)

The containment checks for vector broadcasts were missing a size check,
meaning that a uint broadcast could contain a ubyte/ushort indirection.
That would lead to out-of-bounds reads.

Fix #83387
---
 src/coreclr/jit/gentree.cpp                   |  4 ++--
 src/coreclr/jit/lowerxarch.cpp                |  3 +++
 .../JitBlue/Runtime_83387/Runtime_83387.cs    | 19 +++++++++++++++++++
 .../Runtime_83387/Runtime_83387.csproj        |  8 ++++++++
 4 files changed, 32 insertions(+), 2 deletions(-)
 create mode 100644 src/tests/JIT/Regression/JitBlue/Runtime_83387/Runtime_83387.cs
 create mode 100644 src/tests/JIT/Regression/JitBlue/Runtime_83387/Runtime_83387.csproj

diff --git a/src/coreclr/jit/gentree.cpp b/src/coreclr/jit/gentree.cpp
index 239ddfaff5b29..d42175f98300e 100644
--- a/src/coreclr/jit/gentree.cpp
+++ b/src/coreclr/jit/gentree.cpp
@@ -19636,8 +19636,8 @@ GenTree* Compiler::gtNewSimdBinOpNode(
     }
     else
     {
-        assert(op2->TypeIs(type, simdBaseType, genActualType(simdBaseType)) ||
-               (op2->TypeIs(TYP_SIMD12) && type == TYP_SIMD16));
+        assert((genActualType(op2) == genActualType(type)) || (genActualType(op2) == genActualType(simdBaseType)) ||
+               (op2->TypeIs(TYP_SIMD12) && (type == TYP_SIMD16)));
     }
 
     NamedIntrinsic intrinsic = NI_Illegal;
diff --git a/src/coreclr/jit/lowerxarch.cpp b/src/coreclr/jit/lowerxarch.cpp
index 483370dab9f7f..d68c3e0d2689a 100644
--- a/src/coreclr/jit/lowerxarch.cpp
+++ b/src/coreclr/jit/lowerxarch.cpp
@@ -7956,6 +7956,9 @@ bool Lowering::IsContainableHWIntrinsicOp(GenTreeHWIntrinsic* parentNode, GenTre
                         // The memory form of this already takes a pointer and should be treated like a MemoryLoad
                         supportsGeneralLoads = !childNode->OperIsHWIntrinsic();
                     }
+
+                    supportsGeneralLoads =
+                        supportsGeneralLoads && (genTypeSize(childNode) >= genTypeSize(parentNode->GetSimdBaseType()));
                     break;
                 }
 
diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_83387/Runtime_83387.cs b/src/tests/JIT/Regression/JitBlue/Runtime_83387/Runtime_83387.cs
new file mode 100644
index 0000000000000..cb70acd167757
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_83387/Runtime_83387.cs
@@ -0,0 +1,19 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Runtime.CompilerServices;
+using System.Runtime.Intrinsics;
+using Xunit;
+
+public class Runtime_83387
+{
+    [MethodImpl(MethodImplOptions.NoOptimization)]
+    [Fact]
+    public static int TestEntryPoint()
+    {
+        (ushort A, ushort R) c = (1, 65535);
+        Vector128<uint> v1 = Vector128.Create((uint)100);
+        v1 = v1 * c.A;
+        return (int)v1.ToScalar();
+    }
+}
diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_83387/Runtime_83387.csproj b/src/tests/JIT/Regression/JitBlue/Runtime_83387/Runtime_83387.csproj
new file mode 100644
index 0000000000000..15edd99711a1a
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_83387/Runtime_83387.csproj
@@ -0,0 +1,8 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <Optimize>True</Optimize>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="$(MSBuildProjectName).cs" />
+  </ItemGroup>
+</Project>
\ No newline at end of file