opt crashes in SROA

[scchan]

This test case (https://gist.github.com/0bf0e257663a02890f36.git) will cause opt (hsail-stable-3.7) to crash.
It looks like to be an issue in SROA. For now, this problem could be worked around by disabling SROA with -use-new-sroa=false

opt -O3 -disable-simplify-libcalls -debug  -verify ./dump.linked.bc -o ./dump.opt.bc

CGSCCPASSMGR: SCC Refresh didn't change call graph. 
Inliner visiting SCC: opencl_frexp_global: 1 call sites. 
    Inlining: cost=always, Call:   %4 = call spir_func double @_Z5frexpdPU3AS4i(double %x, i32 addrspace(4)* %3)
CGSCCPASSMGR: Refreshing SCC with 1 nodes: 
Call graph node for function: 'opencl_frexp_global'<<0x4e1d920>>  #uses=1

CGSCCPASSMGR: SCC Refresh didn't change call graph. 
SROA function: opencl_frexp_global
SROA alloca:   %1 = alloca i32 addrspace(1)*, align 8
  Rewriting FCA loads and stores...
Slices of alloca:   %1 = alloca i32 addrspace(1)*, align 8
  [0,8) slice #0
    used by:   store i32 addrspace(1)* %exp, i32 addrspace(1)** %1, align 8
  [0,8) slice #1
    used by:   %3 = load i32 addrspace(4)*, i32 addrspace(4)** %2, align 8
Pre-splitting loads and stores 
  Searching for candidate loads and stores 
Rewriting alloca partition [0,8) to:   %1 = alloca i32 addrspace(1)*, align 8
  rewriting [0,8) slice #0
    original:   store i32 addrspace(1)* %exp, i32 addrspace(1)** %1, align 8
          to:   store i32 addrspace(1)* %exp, i32 addrspace(1)** %1, align 8
  rewriting [0,8) slice #1
    original:   %3 = load i32 addrspace(4)*, i32 addrspace(4)** %2, align 8
opt: /home/xkerox/docker_volume/HSA_1.0f/HLC-HSAIL-Development-LLVM.hsail-stable-3.7/HLC-HSAIL-Development-LLVM/lib/IR/Instructions.cpp:2257: static llvm::CastInst* llvm::CastInst::Create(llvm::Instructi
#0 0x23ea033 llvm::sys::PrintStackTrace(llvm::raw_ostream&) (/opt/amd/bin/opt+0x23ea033)
#1 0x23ea348 PrintStackTraceSignalHandler(void*) (/opt/amd/bin/opt+0x23ea348)
#2 0x23e8c80 SignalHandler(int) (/opt/amd/bin/opt+0x23e8c80)
#3 0x7f5785300340 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x10340)
#4 0x7f5784516cc9 gsignal /build/buildd/eglibc-2.19/signal/../nptl/sysdeps/unix/sysv/linux/raise.c:56:0
#5 0x7f578451a0d8 abort /build/buildd/eglibc-2.19/stdlib/abort.c:91:0
#6 0x7f578450fb86 __assert_fail_base /build/buildd/eglibc-2.19/assert/assert.c:92:0
#7 0x7f578450fc32 (/lib/x86_64-linux-gnu/libc.so.6+0x2fc32)
#8 0x1f2349b llvm::CastInst::Create(llvm::Instruction::CastOps, llvm::Value*, llvm::Type*, llvm::Twine const&, llvm::Instruction*) (/opt/amd/bin/opt+0x1f2349b)
#9 0x22f3185 llvm::IRBuilder<true, llvm::ConstantFolder, (anonymous namespace)::IRBuilderPrefixedInserter<true> >::CreateCast(llvm::Instruction::CastOps, llvm::Value*, llvm::Type*, llvm::Twine const&) (/
#10 0x22ed966 llvm::IRBuilder<true, llvm::ConstantFolder, (anonymous namespace)::IRBuilderPrefixedInserter<true> >::CreateBitCast(llvm::Value*, llvm::Type*, llvm::Twine const&) (/opt/amd/bin/opt+0x22ed96
#11 0x22dd4bb convertValue(llvm::DataLayout const&, llvm::IRBuilder<true, llvm::ConstantFolder, (anonymous namespace)::IRBuilderPrefixedInserter<true> >&, llvm::Value*, llvm::Type*) (/opt/amd/bin/opt+0x2
#12 0x22e11b6 (anonymous namespace)::AllocaSliceRewriter::visitLoadInst(llvm::LoadInst&) (/opt/amd/bin/opt+0x22e11b6)
#13 0x22f8a9f llvm::InstVisitor<(anonymous namespace)::AllocaSliceRewriter, bool>::visitLoad(llvm::LoadInst&) (/opt/amd/bin/opt+0x22f8a9f)
#14 0x22f3bc5 llvm::InstVisitor<(anonymous namespace)::AllocaSliceRewriter, bool>::visit(llvm::Instruction&) (/opt/amd/bin/opt+0x22f3bc5)
#15 0x22ee687 llvm::InstVisitor<(anonymous namespace)::AllocaSliceRewriter, bool>::visit(llvm::Instruction*) (/opt/amd/bin/opt+0x22ee687)
#16 0x22e0490 (anonymous namespace)::AllocaSliceRewriter::visit((anonymous namespace)::Slice const*) (/opt/amd/bin/opt+0x22e0490)
#17 0x22e905f (anonymous namespace)::SROA::rewritePartition(llvm::AllocaInst&, (anonymous namespace)::AllocaSlices&, (anonymous namespace)::AllocaSlices::Partition&) (/opt/amd/bin/opt+0x22e905f)
#18 0x22e98c8 (anonymous namespace)::SROA::splitAlloca(llvm::AllocaInst&, (anonymous namespace)::AllocaSlices&) (/opt/amd/bin/opt+0x22e98c8)
#19 0x22ea3d5 (anonymous namespace)::SROA::runOnAlloca(llvm::AllocaInst&) (/opt/amd/bin/opt+0x22ea3d5)
#20 0x22eb1ed (anonymous namespace)::SROA::runOnFunction(llvm::Function&) (/opt/amd/bin/opt+0x22eb1ed)
#21 0x1f49bcd llvm::FPPassManager::runOnFunction(llvm::Function&) (/opt/amd/bin/opt+0x1f49bcd)
#22 0x1fc5323 (anonymous namespace)::CGPassManager::RunPassOnSCC(llvm::Pass*, llvm::CallGraphSCC&, llvm::CallGraph&, bool&, bool&) (/opt/amd/bin/opt+0x1fc5323)
#23 0x1fc64bf (anonymous namespace)::CGPassManager::RunAllPassesOnSCC(llvm::CallGraphSCC&, llvm::CallGraph&, bool&) (/opt/amd/bin/opt+0x1fc64bf)
#24 0x1fc682a (anonymous namespace)::CGPassManager::runOnModule(llvm::Module&) (/opt/amd/bin/opt+0x1fc682a)
#25 0x1f4a0f6 (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) (/opt/amd/bin/opt+0x1f4a0f6)
#26 0x1f4a873 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/opt/amd/bin/opt+0x1f4a873)
#27 0x1f4aadd llvm::legacy::PassManager::run(llvm::Module&) (/opt/amd/bin/opt+0x1f4aadd)
#28 0xeb955e main (/opt/amd/bin/opt+0xeb955e)
#29 0x7f5784501ec5 __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:321:0
#30 0xe96b69 _start (/opt/amd/bin/opt+0xe96b69)
Stack dump:
0.  Program arguments: /opt/amd/bin/opt -O3 -disable-simplify-libcalls -debug -verify ./dump.linked.bc -o ./dump.opt.bc 
1.  Running pass 'CallGraph Pass Manager' on module './dump.linked.bc'.
. Running pass 'SROA' on function '@opencl_frexp_global'

[arsenm]

I think this is the same issue as this patch was supposed to fix: http://reviews.llvm.org/D3002

[arsenm]

Reduced version:

; Function Attrs: nounwind
define void @opencl_sincos_local(double %x, double addrspace(3)* %s, double addrspace(3)* %c) #0 {
%1 = alloca double addrspace(3), align 8
store double addrspace(3) %c, double addrspace(3)* %1, align 8
%2 = bitcast double addrspace(3)* %1 to double addrspace(4)**
%3 = load double addrspace(4), double addrspace(4)* %2, align 8
%4 = call spir_func double @_Z6sincosdPU3AS4d(double undef, double addrspace(4)* %3)
unreachable
}

; Function Attrs: alwaysinline nounwind
declare double @_Z6sincosdPU3AS4d(double, double addrspace(4)* nocapture) #1

[arsenm]

However, it is worth noting this is doing an operation that is invalid in the first place. This is storing a local pointer to the stack, reloading from it as a generic pointer and trying to use it. An addrspacecast is necessary for this to work as expected, so even if this didn't crash in SROA this isn't what should be happening. The ptrtoint / inttoptr combination in the original IR should be an addrspacecast.