Merge pull request from GHSA-xm67-587q-r2vw

alexcrichton · web-flow · commit fc13ee17951c · 2023-03-08T13:00:01.000-06:00
This commit fixes an off-by-one error in the subtraction of indices when
shuffling a vector with itself. Lanes 16-and-above are mapped to select
from the first vector since the first and second element are the same,
but the subtraction was with 15 rather than 16 by accident.
diff --git a/cranelift/codegen/src/isa/x64/lower/isle.rs b/cranelift/codegen/src/isa/x64/lower/isle.rs
@@ -756,7 +756,7 @@ impl Context for IsleContext<'_, '_, MInst, X64Backend> {
     fn shuffle_0_31_mask(&mut self, mask: &VecMask) -> VCodeConstant {
         let mask = mask
             .iter()
-            .map(|&b| if b > 15 { b.wrapping_sub(15) } else { b })
+            .map(|&b| if b > 15 { b.wrapping_sub(16) } else { b })
             .map(|b| if b > 15 { 0b10000000 } else { b })
             .collect();
         self.lower_ctx
