llvm-stress causes type legalizer to crash

[Quuxplusone]

Bugzilla Link	PR32275
Status	RESOLVED FIXED
Importance	P normal
Reported by	Jonas Paulsson (paulsson@linux.vnet.ibm.com)
Reported on	2017-03-15 00:19:34 -0700
Last modified on	2017-03-22 03:58:06 -0700
Version	trunk
Hardware	PC Linux
CC	efriedma@quicinc.com, llvm-bugs@lists.llvm.org, llvm-dev@redking.me.uk, paulsson@linux.vnet.ibm.com, ulrich.weigand@de.ibm.com
Fixed by commit(s)
Attachments	DAGTypeLegalizer_crash.ll (3313 bytes, text/plain)
Blocks
Blocked by
See also

Created attachment 18094
test case

Optimized lowered selection DAG: BB#4 'autogen_SD29574:CF34'
electionDAG has 46 nodes:
  t0: ch = EntryToken
    t17: v16i8,ch = CopyFromReg t0, Register:v16i8 %vreg13
  t18: v4i8 = extract_subvector t17, Constant:i32<0>
  t36: v2i64,ch = CopyFromReg t0, Register:v2i64 %vreg5
  t38: v2i64,ch = CopyFromReg t36:1, Register:v2i64 %vreg6
  t40: v2i64,ch = CopyFromReg t38:1, Register:v2i64 %vreg7
  t42: v2i64,ch = CopyFromReg t40:1, Register:v2i64 %vreg8
  t44: v2i64,ch = CopyFromReg t42:1, Register:v2i64 %vreg9
  t46: v2i64,ch = CopyFromReg t44:1, Register:v2i64 %vreg10
  t48: v2i64,ch = CopyFromReg t46:1, Register:v2i64 %vreg11
          t2: v8i16 = BUILD_VECTOR Constant:i16<0>, Constant:i16<0>, Constant:i16<0>, Constant:i16<0>, Constant:i16<0>, Constant:i16<0>, Constant:i
16<0>, Constant:i16<0>
        t5: ch = CopyToReg t0, Register:v8i16 %vreg16, t2
          t59: v4i32 = any_extend t18
        t22: ch = CopyToReg t0, Register:v4i32 %vreg17, t59
            t50: v2i64,ch = CopyFromReg t48:1, Register:v2i64 %vreg12
          t51: v16i64 = concat_vectors t36, t38, t40, t42, t44, t46, t48, t50
          t31: i64,ch = CopyFromReg t0, Register:i64 %vreg4
        t52: ch = store<ST128[%Sl9]> t0, t51, t31, undef:i64
      t55: ch = TokenFactor t5, t22, t52
          t19: v4i1 = truncate t18
            t26: v4i32,ch = CopyFromReg t0, Register:v4i32 %vreg14
          t27: v4i1 = truncate t26
        t29: v4i1 = setcc t19, t27, setlt:ch
      t53: i1 = extract_vector_elt t29, Constant:i32<3>
    t56: ch = brcond t55, t53, BasicBlock:ch<CF34 0x55692e8>
  t58: ch = br t56, BasicBlock:ch<CF36 0x5569398>

DAGTypeLegalizer::PromoteIntRes_TRUNCATE(t19) crashes, as it should be widened
on SystemZ, and this method won't do that.

Why does this end up here?

bin/llc -mtriple=s390x-linux-gnu -mcpu=z13

[Quuxplusone]

Attached DAGTypeLegalizer_crash.ll (3313 bytes, text/plain): test case

[Quuxplusone]

The type action for v4i1 is TypePromoteInteger on SystemZ, to promote it to v4i32, so we call PromoteIntRes_TRUNCATE. That's working as expected.

I guess you're hitting the unreachable because the action for the operand is TypeWidenVector? (IIRC, this code was written before widening vectors was supported). You probably just need to add a case for it: widen the operand, produce a new truncate to the right element type, then extract_subvector the low elements, or something like that.

[Quuxplusone]

Please have a look at https://reviews.llvm.org/D31077

[Quuxplusone]

r298357