Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[x86_64] Passing v1i1 as function argument crashes on icelake-server #64323

Closed
tinkerrc opened this issue Aug 2, 2023 · 7 comments
Closed

[x86_64] Passing v1i1 as function argument crashes on icelake-server #64323

tinkerrc opened this issue Aug 2, 2023 · 7 comments
Assignees
Labels
crash Prefer [crash-on-valid] or [crash-on-invalid] llvm:SelectionDAG SelectionDAGISel as well

Comments

@tinkerrc
Copy link
Contributor

tinkerrc commented Aug 2, 2023

Demo on Compiler Explorer

  • If the fcmp is replaced with a load <1 x i1>, ptr @G, the crash error changes to "Cannot emit physreg copy instruction"
  • The crash disappears when -mcpu=icelake-server is removed.

Code:

@G = global <1 x i1> <i1 true>
define <1 x i1> @f(<1 x float> %0) {
  %A = fcmp oeq <1 x float> %0, <float 0x36A0000000000000>
  %B = call <1 x i1> @g(<1 x i1> %A)
  ret <1 x i1> %B
}

declare <1 x i1> @g(<1 x i1> %0)

Crash backtrace:

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-trunk/bin/llc -o /app/output.s -x86-asm-syntax=intel -mtriple=x86_64 -mcpu=icelake-server <source>
1.	Running pass 'Function Pass Manager' on module '<source>'.
2.	Running pass 'X86 Domain Reassignment Pass' on function '@f'
 #0 0x000000000305a128 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-trunk/bin/llc+0x305a128)
 #1 0x0000000003057cec SignalHandler(int) Signals.cpp:0:0
 #2 0x00007fe6bc5b8420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #3 0x00000000018d3b4d (anonymous namespace)::X86DomainReassignment::visitRegister((anonymous namespace)::Closure&, llvm::Register, (anonymous namespace)::RegDomain&, llvm::SmallVectorImpl<unsigned int>&) (.isra.0) X86DomainReassignment.cpp:0:0
 #4 0x00000000018d51a9 (anonymous namespace)::X86DomainReassignment::runOnMachineFunction(llvm::MachineFunction&) (.part.0) X86DomainReassignment.cpp:0:0
 #5 0x0000000002439700 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
 #6 0x000000000291aeb2 llvm::FPPassManager::runOnFunction(llvm::Function&) (/opt/compiler-explorer/clang-trunk/bin/llc+0x291aeb2)
 #7 0x000000000291b031 llvm::FPPassManager::runOnModule(llvm::Module&) (/opt/compiler-explorer/clang-trunk/bin/llc+0x291b031)
 #8 0x000000000291cba0 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/opt/compiler-explorer/clang-trunk/bin/llc+0x291cba0)
 #9 0x00000000007673f0 compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0
#10 0x00000000006a8b82 main (/opt/compiler-explorer/clang-trunk/bin/llc+0x6a8b82)
#11 0x00007fe6bc05c083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#12 0x000000000075f33e _start (/opt/compiler-explorer/clang-trunk/bin/llc+0x75f33e)
Program terminated with signal: SIGSEGV
Compiler returned: 139
@tinkerrc
Copy link
Contributor Author

tinkerrc commented Aug 2, 2023

@DataCorrupted
@HazyFish

@EugeneZelenko EugeneZelenko added backend:X86 crash Prefer [crash-on-valid] or [crash-on-invalid] and removed new issue labels Aug 2, 2023
@llvmbot
Copy link
Member

llvmbot commented Aug 2, 2023

@llvm/issue-subscribers-backend-x86

@DataCorrupted
Copy link
Member

After a recent patch D30189, the report become the following. @phoebewang I am afraid this is not totally fixed yet.

llc: /home/peter/llvm-fix/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp:21705: llvm::SDValue (anonymous namespace)::DAGCombiner::visitEXTRACT_VECTOR_ELT(llvm::SDNode *): Assertion `InOp.getValueType().isInteger() && ScalarVT.isInteger() && InOp.getValueType().bitsGT(ScalarVT)' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: ./bin/llc -mtriple=x86_64 -mcpu=icelake-server ../../64323.ll
1.      Running pass 'Function Pass Manager' on module '../../64323.ll'.
2.      Running pass 'X86 DAG->DAG Instruction Selection' on function '@f'
 #0 0x00007ff0c5e95aad llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/peter/llvm-fix/llvm/lib/Support/Unix/Signals.inc:602:11
 #1 0x00007ff0c5e95f4b PrintStackTraceSignalHandler(void*) /home/peter/llvm-fix/llvm/lib/Support/Unix/Signals.inc:675:1
 #2 0x00007ff0c5e941c6 llvm::sys::RunSignalHandlers() /home/peter/llvm-fix/llvm/lib/Support/Signals.cpp:104:5
 #3 0x00007ff0c5e96765 SignalHandler(int) /home/peter/llvm-fix/llvm/lib/Support/Unix/Signals.inc:413:1
 #4 0x00007ff0c5666520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #5 0x00007ff0c56baa7c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #6 0x00007ff0c56baa7c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #7 0x00007ff0c56baa7c pthread_kill ./nptl/pthread_kill.c:89:10
 #8 0x00007ff0c5666476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #9 0x00007ff0c564c7f3 abort ./stdlib/abort.c:81:7
#10 0x00007ff0c564c71b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#11 0x00007ff0c565de96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#12 0x00007ff0ca2e2eb5 (anonymous namespace)::DAGCombiner::visitEXTRACT_VECTOR_ELT(llvm::SDNode*) /home/peter/llvm-fix/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp:0:7
#13 0x00007ff0ca29594c (anonymous namespace)::DAGCombiner::visit(llvm::SDNode*) /home/peter/llvm-fix/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp:1997:40
#14 0x00007ff0ca294a28 (anonymous namespace)::DAGCombiner::combine(llvm::SDNode*) /home/peter/llvm-fix/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp:2040:10
#15 0x00007ff0ca294048 (anonymous namespace)::DAGCombiner::Run(llvm::CombineLevel) /home/peter/llvm-fix/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp:1832:18
#16 0x00007ff0ca29390f llvm::SelectionDAG::Combine(llvm::CombineLevel, llvm::AAResults*, llvm::CodeGenOpt::Level) /home/peter/llvm-fix/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp:27599:3
#17 0x00007ff0ca6a67b1 llvm::SelectionDAGISel::CodeGenAndEmitDAG() /home/peter/llvm-fix/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:832:5
#18 0x00007ff0ca6a5e8d llvm::SelectionDAGISel::SelectBasicBlock(llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void>, false, true>, llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void>, false, true>, bool&) /home/peter/llvm-fix/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:702:1
#19 0x00007ff0ca6a58c4 llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) /home/peter/llvm-fix/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:1705:11
#20 0x00007ff0ca6a2dea llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) /home/peter/llvm-fix/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:482:3
#21 0x00007ff0cd61243a (anonymous namespace)::X86DAGToDAGISel::runOnMachineFunction(llvm::MachineFunction&) /home/peter/llvm-fix/llvm/lib/Target/X86/X86ISelDAGToDAG.cpp:192:7
#22 0x00007ff0c95c0025 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) /home/peter/llvm-fix/llvm/lib/CodeGen/MachineFunctionPass.cpp:91:8
#23 0x00007ff0c6912eca llvm::FPPassManager::runOnFunction(llvm::Function&) /home/peter/llvm-fix/llvm/lib/IR/LegacyPassManager.cpp:1435:23
#24 0x00007ff0c6917cf2 llvm::FPPassManager::runOnModule(llvm::Module&) /home/peter/llvm-fix/llvm/lib/IR/LegacyPassManager.cpp:1481:16
#25 0x00007ff0c691377b (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) /home/peter/llvm-fix/llvm/lib/IR/LegacyPassManager.cpp:1550:23
#26 0x00007ff0c69132fd llvm::legacy::PassManagerImpl::run(llvm::Module&) /home/peter/llvm-fix/llvm/lib/IR/LegacyPassManager.cpp:535:16
#27 0x00007ff0c6917fd1 llvm::legacy::PassManager::run(llvm::Module&) /home/peter/llvm-fix/llvm/lib/IR/LegacyPassManager.cpp:1677:3
#28 0x000000000041b647 compileModule(char**, llvm::LLVMContext&) /home/peter/llvm-fix/llvm/tools/llc/llc.cpp:754:41
#29 0x000000000041998d main /home/peter/llvm-fix/llvm/tools/llc/llc.cpp:416:13
#30 0x00007ff0c564dd90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#31 0x00007ff0c564de40 call_init ./csu/../csu/libc-start.c:128:20
#32 0x00007ff0c564de40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#33 0x0000000000419165 _start (./bin/llc+0x419165)
Aborted

@phoebewang
Copy link
Contributor

Yeah, D156855 fixed #64322 only. I checked it doesn't fix this but didn't take a deep look. Are you interested in fixing this one?

@DataCorrupted
Copy link
Member

I am happy to try this weekend. :) Will keep you posted.

@DataCorrupted
Copy link
Member

@phoebewang TL;DR: v1i1 setcc is legalized into two operations, i1 setcc and scalar_to_vector i1. i1 setcc is further promoted to i8 setcc. Yet v1i1 is a legal type in AVX 512, causing typing mismatch. (v1i1 scalar_to_vector i8)

I see many ways to fix this. One of them is the legalizer should tell the instructions that depend on it that data type has changed. But I can see that can be troublesome if the program has complicated DFG. So please advice how should I approach.

Thanks.

I detailed debug log:
First the setcc v1i1 is legalized into two operations, setcc i1 and scalar_to_vector.

Legalizing node: t8: v1i1 = setcc t3, t5, setoeq:ch
Analyzing result type: v1i1
Legal result type
Analyzing operand: t3: v1f32 = BUILD_VECTOR t2
Scalarize node operand 0: t8: v1i1 = setcc t3, t5, setoeq:ch
Creating new node: t27: i1 = setcc t2, ConstantFP:f32<1.401298e-45>, setoeq:ch
Creating new node: t28: v1i1 = scalar_to_vector t27

Then, setcc is further legalized from i1 to i8.

Legalizing node: t27: i1 = setcc t2, ConstantFP:f32<1.401298e-45>, setoeq:ch
Analyzing result type: i1
Promote integer result: t27: i1 = setcc t2, ConstantFP:f32<1.401298e-45>, setoeq:ch
Creating new node: t29: i8 = setcc t2, ConstantFP:f32<1.401298e-45>, setoeq:ch

However, the instruction that uses the result (insertvector i1) is not updated.

Legalizing node: t28: v1i1 = scalar_to_vector t27
Analyzing result type: v1i1
Legal result type
Analyzing operand: t27: i1 = setcc t2, ConstantFP:f32<1.401298e-45>, setoeq:ch
Promote integer operand: t28: v1i1 = scalar_to_vector t27

@DataCorrupted
Copy link
Member

A more in-depth reason is that v1f32 is not a legal type and has to be Scalarized, scalarizing result type v1i1 to i1, then promoted to i8. I am not sure if we want to a) declare v1f32 as a legal type (If so, I am not sure where it is declared), or b) fix the mismatching problem before.

@DataCorrupted DataCorrupted self-assigned this Aug 16, 2023
llvm-premerge-tests-bot pushed a commit to llvm-premerge-tests/llvm-project that referenced this issue Aug 20, 2023
Automated commit created by applying diff 551803

Phabricator-ID: PHID-HMBT-h2j5iofebgzzpdemtztz
Review-ID: D158355
llvm-premerge-tests-bot pushed a commit to llvm-premerge-tests/llvm-project that referenced this issue Aug 22, 2023
Automated commit created by applying diff 552430

Phabricator-ID: PHID-HMBT-qtwd73naazbjab4jq5n3
Review-ID: D158355
llvm-premerge-tests-bot pushed a commit to llvm-premerge-tests/llvm-project that referenced this issue Aug 22, 2023
Automated commit created by applying diff 552434

Phabricator-ID: PHID-HMBT-szq2fqe3rqfhbrkveaxc
Review-ID: D158355
@EugeneZelenko EugeneZelenko added llvm:SelectionDAG SelectionDAGISel as well and removed backend:X86 labels Aug 23, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
crash Prefer [crash-on-valid] or [crash-on-invalid] llvm:SelectionDAG SelectionDAGISel as well
Projects
None yet
Development

No branches or pull requests

5 participants