slp vectorizer produces invalid IR

[Quuxplusone]

Bugzilla Link	PR18060
Status	RESOLVED FIXED
Importance	P normal
Reported by	Richard Pennington (rich@pennware.com)
Reported on	2013-11-25 14:51:50 -0800
Last modified on	2013-11-26 16:25:19 -0800
Version	trunk
Hardware	All All
CC	aschwaighofer@apple.com, geek4civic@gmail.com, llvm-bugs@lists.llvm.org, nadav.rotem@me.com, rafael@espindo.la, yjiang@apple.com
Fixed by commit(s)
Attachments	ARMAsmBackend-265222.sh (819 bytes, application/x-shellscript) ARMAsmBackend-265222.cpp.bz2 (524301 bytes, application/x-bzip) test2.ll (1608 bytes, application/octet-stream)
Blocks
Blocked by
See also

Created attachment 11610
Test compile line.

I build clang/LLVM on my x86_64 Linux box and then build it using itself and
lie libc++, libc++ABI, libunwind, musl, and compiler-rt libraries.

For testing purposes, I then use that compiler to replicate itself by building
executables that run on arm, armeb, i386, microblaze, mips, mipsel, ppc, and
x86_64.

The i386 build fails with
PHI node has multiple entries for the same basic block with different incoming
values!
  %Value.addr.1.off0 = phi i32 [ %7, %entry ], [ %8, %entry ], [ %9, %entry ], [ %extract.t521, %sw.bb9 ]
label %entry
  %9 = extractelement <2 x i32> %3, i32 0
  %8 = extractelement <2 x i32> %3, i32 0
PHI node has multiple entries for the same basic block with different incoming
values!
  %retval.0 = phi i32 [ %conv366, %if.then357 ], [ %conv368, %if.end367 ], [ %conv333, %if.end323 ], [ %conv309, %sw.bb305 ], [ %conv304, %sw.bb300 ], [ %or299, %sw.bb290 ], [ %conv289, %sw.bb285 ], [ %or284, %sw.bb239 ], [ %or238, %sw.bb203 ], [ %conv202, %sw.bb176 ], [ %or174517, %sw.bb120 ], [ %conv119, %sw.bb115 ], [ %or113518, %sw.bb84 ], [ %or83, %_ZN4llvm6ARM_AML11getSOImmValEj.exit ], [ %conv64, %sw.bb60 ], [ %conv57, %if.then50 ], [ %conv59, %if.end58 ], [ %or35, %sw.bb11 ], [ %or, %sw.bb2 ], [ %4, %entry ], [ %5, %entry ], [ %6, %entry ]
label %entry
  %6 = extractelement <2 x i32> %3, i32 0
  %5 = extractelement <2 x i32> %3, i32 0
Broken module found, compilation aborted!

I have attached the failing file which failed with TOT r195680.

[Quuxplusone]

FYI it is also reproducible on i686-cygwin.

http://bb.pgr.jp/builders/clang-3stage-cygwin/builds/1321

[Quuxplusone]

Attached ARMAsmBackend-265222.sh (819 bytes, application/x-shellscript): Test compile line.

[Quuxplusone]

Attached ARMAsmBackend-265222.cpp.bz2 (524301 bytes, application/x-bzip): bz2 source

[Quuxplusone]

Attached test2.ll (1608 bytes, application/octet-stream): reduced testcase

[Quuxplusone]

FYI, it seems this issue doesn't happen on release_34.

With bisecting, r195406 was the first bad commit. I am not sure if it were culprit.

http://llvm-reviews.chandlerc.com/rL195406

[Quuxplusone]

This is only a change to the cost model. It must be triggering another bug. The switch in the test case looks like something that we may not handle right. Is there a backtrack to the crash ? I am traveling now but I hope to look at it later today.

[Quuxplusone]

(In reply to comment #5)
> This is only a change to the cost model. It must be triggering another bug.
> The switch in the test case looks like something that we may not handle
> right. Is there a backtrack to the crash ? I am traveling now but I hope to
> look at it later today.

No, it produces invalid IR and the verifier is the one that complains about it.

[Quuxplusone]

It looks like the switch is giving us problems:

PHI node has multiple entries for the same basic block with different incoming
values!
  %retval.0 = phi i32 [ %or11, %sw.bb2 ], [ %3, %entry ], [ %4, %entry ]
label %entry
  %4 = extractelement <2 x i32> %2, i32 0
  %3 = extractelement <2 x i32> %2, i32 0

[Quuxplusone]

The problem is that we RAUW some values in two different places and we end up
breaking a PHINode that uses these values:

 %9 = extractelement <2 x i32> %3, i32 0
 %8 = extractelement <2 x i32> %3, i32 0
..
 %retval.0 = phi i32 [ %or11, %sw.bb2 ], [ %3, %entry ], [ %4, %entry ]

%3 is replaced with %9,   %4 is replaced with %8, which are the same but the
verifier does not know that.

[Quuxplusone]

CSE-ing the extracts solves the problem. I plan to commit a fix soon.

[Quuxplusone]

Fixed in 195773.

[Quuxplusone]

Tested in 195782.

[Quuxplusone]

I am working on a fix for the ASan bot.

[Quuxplusone]

Fixed ASan problem and the test case in r195791.