Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

llvm backend crash: Assertion `N1.getOpcode() != ISD::DELETED_NODE && "Operand is DELETED_NODE!"' failed. #81432

Closed
shao-hua-li opened this issue Feb 11, 2024 · 3 comments
Labels
crash Prefer [crash-on-valid] or [crash-on-invalid] llvm:SelectionDAG SelectionDAGISel as well

Comments

@shao-hua-li
Copy link

llvm backend crash at -O3.

Compiler explorer: https://godbolt.org/z/dvqEePj8T

cat reduced.ll

target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @v(i64 %0) {
entry:
  %conv.i = trunc i64 %0 to i16
  %rem.i26.4.i.2 = mul i16 1, %conv.i
  %rem.i26.4.i.3 = mul i16 1, %conv.i
  %xor.4.i.393 = xor i16 %rem.i26.4.i.2, %rem.i26.4.i.3
  %1 = insertelement <8 x i16> zeroinitializer, i16 %rem.i26.4.i.2, i64 0
  %2 = insertelement <8 x i16> %1, i16 %xor.4.i.393, i64 1
  %.fr104 = freeze <8 x i16> %2
  %3 = icmp eq <8 x i16> %.fr104, zeroinitializer
  %rem.i26.4.i.4 = mul i16 1, %conv.i
  %xor.4.i.494.fr = freeze i16 %rem.i26.4.i.4
  %rem.i26.4.i.5 = mul i16 1, %conv.i
  %xor.4.i.595 = xor i16 %xor.4.i.494.fr, %rem.i26.4.i.5
  %cmp.i22.4.i.5 = icmp eq i16 %xor.4.i.595, 0
  %4 = bitcast <8 x i1> %3 to i8
  %5 = icmp ne i8 %4, 0
  %6 = or i1 %5, %cmp.i22.4.i.5
  %7 = select i1 %6, i32 1, i32 0
  store i32 %7, ptr null, align 4
  ret void
}
% llc -O3 reduced.ll
llc: /tmp/tmp65qcpham/tmp9wqxmpo5/llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp:5421: llvm::SDValue llvm::SelectionDAG::getNode(unsigned int, const llvm::SDLoc&, llvm::EVT, llvm::SDValue, llvm::SDNodeFlags): Assertion `N1.getOpcode() != ISD::DELETED_NODE && "Operand is DELETED_NODE!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/llc -O3 reduced.ll
1.	Running pass 'Function Pass Manager' on module 'reduced.ll'.
2.	Running pass 'X86 DAG->DAG Instruction Selection' on function '@v'
 #0 0x00007fdc03d361ff llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x9031ff)
 #1 0x00007fdc03d33954 SignalHandler(int) Signals.cpp:0:0
 #2 0x00007fdc03048090 (/lib/x86_64-linux-gnu/libc.so.6+0x43090)
 #3 0x00007fdc0304800b raise /build/glibc-wuryBv/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
 #4 0x00007fdc03027859 abort /build/glibc-wuryBv/glibc-2.31/stdlib/abort.c:81:7
 #5 0x00007fdc03027729 get_sysdep_segment_value /build/glibc-wuryBv/glibc-2.31/intl/loadmsgcat.c:509:8
 #6 0x00007fdc03027729 _nl_load_domain /build/glibc-wuryBv/glibc-2.31/intl/loadmsgcat.c:970:34
 #7 0x00007fdc03038fd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
 #8 0x00007fdc049241bc llvm::SelectionDAG::getNode(unsigned int, llvm::SDLoc const&, llvm::EVT, llvm::SDValue, llvm::SDNodeFlags) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x14f11bc)
 #9 0x00007fdc04924599 llvm::SelectionDAG::getFreeze(llvm::SDValue) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x14f1599)
#10 0x00007fdc046b7737 (anonymous namespace)::DAGCombiner::visitFREEZE(llvm::SDNode*) (.isra.0) DAGCombiner.cpp:0:0
#11 0x00007fdc0473de61 (anonymous namespace)::DAGCombiner::visit(llvm::SDNode*) DAGCombiner.cpp:0:0
#12 0x00007fdc0473ed85 (anonymous namespace)::DAGCombiner::combine(llvm::SDNode*) DAGCombiner.cpp:0:0
#13 0x00007fdc0474058c (anonymous namespace)::DAGCombiner::Run(llvm::CombineLevel) DAGCombiner.cpp:0:0
#14 0x00007fdc04742bac llvm::SelectionDAG::Combine(llvm::CombineLevel, llvm::AAResults*, llvm::CodeGenOpt::Level) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x130fbac)
#15 0x00007fdc04960da5 llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x152dda5)
#16 0x00007fdc04964958 llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x1531958)
#17 0x00007fdc04966622 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (.part.0) SelectionDAGISel.cpp:0:0
#18 0x00007fdc067668b0 (anonymous namespace)::X86DAGToDAGISel::runOnMachineFunction(llvm::MachineFunction&) X86ISelDAGToDAG.cpp:0:0
#19 0x00007fdc0429897e llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#20 0x00007fdc03ef9ce1 llvm::FPPassManager::runOnFunction(llvm::Function&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0xac6ce1)
#21 0x00007fdc03ef9f29 llvm::FPPassManager::runOnModule(llvm::Module&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0xac6f29)
#22 0x00007fdc03efa7b2 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0xac77b2)
#23 0x00005619f6da6fa4 compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0
#24 0x00005619f6d9d026 main (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/llc+0xd026)
#25 0x00007fdc03029083 __libc_start_main /build/glibc-wuryBv/glibc-2.31/csu/../csu/libc-start.c:342:3
#26 0x00005619f6d9d63e _start (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/llc+0xd63e)
[1]    816479 abort       -O3 reduced.ll
%

This IR is reduced from the following C code:

short a, e, f;
int d, j, c;
static int i[] = {7, 7, 7};
static int *k = &j;
static int l;
long m, g, n;
long *b;
short(q)(short r) { return a == 0 ?: r % a; }
int(s)(int r) { return r == 0 ? d : 0; }
void t(char *r) {
  while (r == '/')
    ;
  while (r)
    ;
}
static int u(unsigned r) {
  for (; m;) {
    int h = a = n;
    if (g)
      return 0;
    h = l = 0;
    for (; l <= 4; l++) {
      j = 0;
      for (; j <= 8; j++) {
        *b = e = f = q(e <= r);
        *k = h ^= f;
        c |= s(*k);
      }
    }
  }
  return 0;
}
void v() {
  int **o = &k;
  *o = i;
  u(i[2]);
  char p;
  t(&p);
}
int main() {}
@EugeneZelenko EugeneZelenko added backend:X86 crash Prefer [crash-on-valid] or [crash-on-invalid] llvm:SelectionDAG SelectionDAGISel as well and removed new issue labels Feb 12, 2024
@llvmbot
Copy link
Member

llvmbot commented Feb 12, 2024

@llvm/issue-subscribers-backend-x86

Author: Shaohua Li (shao-hua-li)

llvm backend crash at -O3.

Compiler explorer: https://godbolt.org/z/dvqEePj8T

cat reduced.ll

target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @<!-- -->v(i64 %0) {
entry:
  %conv.i = trunc i64 %0 to i16
  %rem.i26.4.i.2 = mul i16 1, %conv.i
  %rem.i26.4.i.3 = mul i16 1, %conv.i
  %xor.4.i.393 = xor i16 %rem.i26.4.i.2, %rem.i26.4.i.3
  %1 = insertelement &lt;8 x i16&gt; zeroinitializer, i16 %rem.i26.4.i.2, i64 0
  %2 = insertelement &lt;8 x i16&gt; %1, i16 %xor.4.i.393, i64 1
  %.fr104 = freeze &lt;8 x i16&gt; %2
  %3 = icmp eq &lt;8 x i16&gt; %.fr104, zeroinitializer
  %rem.i26.4.i.4 = mul i16 1, %conv.i
  %xor.4.i.494.fr = freeze i16 %rem.i26.4.i.4
  %rem.i26.4.i.5 = mul i16 1, %conv.i
  %xor.4.i.595 = xor i16 %xor.4.i.494.fr, %rem.i26.4.i.5
  %cmp.i22.4.i.5 = icmp eq i16 %xor.4.i.595, 0
  %4 = bitcast &lt;8 x i1&gt; %3 to i8
  %5 = icmp ne i8 %4, 0
  %6 = or i1 %5, %cmp.i22.4.i.5
  %7 = select i1 %6, i32 1, i32 0
  store i32 %7, ptr null, align 4
  ret void
}
% llc -O3 reduced.ll
llc: /tmp/tmp65qcpham/tmp9wqxmpo5/llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp:5421: llvm::SDValue llvm::SelectionDAG::getNode(unsigned int, const llvm::SDLoc&amp;, llvm::EVT, llvm::SDValue, llvm::SDNodeFlags): Assertion `N1.getOpcode() != ISD::DELETED_NODE &amp;&amp; "Operand is DELETED_NODE!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/llc -O3 reduced.ll
1.	Running pass 'Function Pass Manager' on module 'reduced.ll'.
2.	Running pass 'X86 DAG-&gt;DAG Instruction Selection' on function '@<!-- -->v'
 #<!-- -->0 0x00007fdc03d361ff llvm::sys::PrintStackTrace(llvm::raw_ostream&amp;, int) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x9031ff)
 #<!-- -->1 0x00007fdc03d33954 SignalHandler(int) Signals.cpp:0:0
 #<!-- -->2 0x00007fdc03048090 (/lib/x86_64-linux-gnu/libc.so.6+0x43090)
 #<!-- -->3 0x00007fdc0304800b raise /build/glibc-wuryBv/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
 #<!-- -->4 0x00007fdc03027859 abort /build/glibc-wuryBv/glibc-2.31/stdlib/abort.c:81:7
 #<!-- -->5 0x00007fdc03027729 get_sysdep_segment_value /build/glibc-wuryBv/glibc-2.31/intl/loadmsgcat.c:509:8
 #<!-- -->6 0x00007fdc03027729 _nl_load_domain /build/glibc-wuryBv/glibc-2.31/intl/loadmsgcat.c:970:34
 #<!-- -->7 0x00007fdc03038fd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
 #<!-- -->8 0x00007fdc049241bc llvm::SelectionDAG::getNode(unsigned int, llvm::SDLoc const&amp;, llvm::EVT, llvm::SDValue, llvm::SDNodeFlags) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x14f11bc)
 #<!-- -->9 0x00007fdc04924599 llvm::SelectionDAG::getFreeze(llvm::SDValue) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x14f1599)
#<!-- -->10 0x00007fdc046b7737 (anonymous namespace)::DAGCombiner::visitFREEZE(llvm::SDNode*) (.isra.0) DAGCombiner.cpp:0:0
#<!-- -->11 0x00007fdc0473de61 (anonymous namespace)::DAGCombiner::visit(llvm::SDNode*) DAGCombiner.cpp:0:0
#<!-- -->12 0x00007fdc0473ed85 (anonymous namespace)::DAGCombiner::combine(llvm::SDNode*) DAGCombiner.cpp:0:0
#<!-- -->13 0x00007fdc0474058c (anonymous namespace)::DAGCombiner::Run(llvm::CombineLevel) DAGCombiner.cpp:0:0
#<!-- -->14 0x00007fdc04742bac llvm::SelectionDAG::Combine(llvm::CombineLevel, llvm::AAResults*, llvm::CodeGenOpt::Level) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x130fbac)
#<!-- -->15 0x00007fdc04960da5 llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x152dda5)
#<!-- -->16 0x00007fdc04964958 llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&amp;) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x1531958)
#<!-- -->17 0x00007fdc04966622 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&amp;) (.part.0) SelectionDAGISel.cpp:0:0
#<!-- -->18 0x00007fdc067668b0 (anonymous namespace)::X86DAGToDAGISel::runOnMachineFunction(llvm::MachineFunction&amp;) X86ISelDAGToDAG.cpp:0:0
#<!-- -->19 0x00007fdc0429897e llvm::MachineFunctionPass::runOnFunction(llvm::Function&amp;) (.part.0) MachineFunctionPass.cpp:0:0
#<!-- -->20 0x00007fdc03ef9ce1 llvm::FPPassManager::runOnFunction(llvm::Function&amp;) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0xac6ce1)
#<!-- -->21 0x00007fdc03ef9f29 llvm::FPPassManager::runOnModule(llvm::Module&amp;) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0xac6f29)
#<!-- -->22 0x00007fdc03efa7b2 llvm::legacy::PassManagerImpl::run(llvm::Module&amp;) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0xac77b2)
#<!-- -->23 0x00005619f6da6fa4 compileModule(char**, llvm::LLVMContext&amp;) llc.cpp:0:0
#<!-- -->24 0x00005619f6d9d026 main (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/llc+0xd026)
#<!-- -->25 0x00007fdc03029083 __libc_start_main /build/glibc-wuryBv/glibc-2.31/csu/../csu/libc-start.c:342:3
#<!-- -->26 0x00005619f6d9d63e _start (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/llc+0xd63e)
[1]    816479 abort       -O3 reduced.ll
%

This IR is reduced from the following C code:

short a, e, f;
int d, j, c;
static int i[] = {7, 7, 7};
static int *k = &amp;j;
static int l;
long m, g, n;
long *b;
short(q)(short r) { return a == 0 ?: r % a; }
int(s)(int r) { return r == 0 ? d : 0; }
void t(char *r) {
  while (r == '/')
    ;
  while (r)
    ;
}
static int u(unsigned r) {
  for (; m;) {
    int h = a = n;
    if (g)
      return 0;
    h = l = 0;
    for (; l &lt;= 4; l++) {
      j = 0;
      for (; j &lt;= 8; j++) {
        *b = e = f = q(e &lt;= r);
        *k = h ^= f;
        c |= s(*k);
      }
    }
  }
  return 0;
}
void v() {
  int **o = &amp;k;
  *o = i;
  u(i[2]);
  char p;
  t(&amp;p);
}
int main() {}

@RKSimon
Copy link
Collaborator

RKSimon commented Feb 12, 2024

Generic DAG bug in DAGCombiner::visitFREEZE - we're collecting all unique maybe poison operands in SmallSetVector<SDValue, 8> MaybePoisonOperands and then calling ReplaceAllUsesOfValueWith on them which can result in later nodes in the set being replaced/deleted before they get processed.

@dtcxzyw
Copy link
Member

dtcxzyw commented Nov 16, 2024

Fixed by #104924.

@dtcxzyw dtcxzyw closed this as completed Nov 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
crash Prefer [crash-on-valid] or [crash-on-invalid] llvm:SelectionDAG SelectionDAGISel as well
Projects
None yet
Development

No branches or pull requests

5 participants