llvm-stress causes DAGCombiner to produce an illegal BUILD_VECTOR

[Quuxplusone]

Bugzilla Link	PR32422
Status	RESOLVED FIXED
Importance	P enhancement
Reported by	Jonas Paulsson (paulsson@linux.vnet.ibm.com)
Reported on	2017-03-25 10:07:24 -0700
Last modified on	2017-04-05 07:11:35 -0700
Version	trunk
Hardware	PC Linux
CC	efriedma@quicinc.com, llvm-bugs@lists.llvm.org, llvm-dev@ndave.org, llvm-dev@redking.me.uk, paulsson@linux.vnet.ibm.com, ulrich.weigand@de.ibm.com
Fixed by commit(s)
Attachments	stress_fail_illegal_BUILD_VECTOR.ll (742 bytes, text/plain)
Blocks
Blocked by
See also

Created attachment 18170
reduced llvm-stress test case

A nonsense function:

*** IR Dump After Module Verifier ***
define void @autogen_SD28844() #0 {
BB:
  %I = insertelement <8 x i8> zeroinitializer, i8 -95, i32 3
  %I8 = insertelement <8 x i8> zeroinitializer, i8 -119, i32 2
  %FC = uitofp <8 x i8> %I8 to <8 x float>
  %Cmp18 = fcmp uno <8 x float> zeroinitializer, %FC
  %I22 = insertelement <8 x i1> %Cmp18, i1 true, i32 5
  br label %CF

CF:                                               ; preds = %CF, %BB
  %Cmp40 = fcmp uno double 0xC663C682E9619F00, undef
  br i1 %Cmp40, label %CF, label %CF353

CF353:                                            ; preds = %CF
  %E195 = extractelement <8 x i1> %I22, i32 4
  ret void
}

causes ISel to crash:

DAGCombiner transforms

26: DAG.dump() = SelectionDAG has 10 nodes:
    t0: ch = EntryToken
        t64: v8i16 = BUILD_VECTOR Constant:i32<0>, Constant:i32<0>, Constant:i32<0>, Constant:i32<0>, Constant:i32<0>, Constant:i32<0>, Constant:i32<0>, Constant:i32<0>
      t66: v8i16 = sign_extend_inreg t64, ValueType:ch:v8i1
    t34: v8i16 = insert_vector_elt t66, Constant:i32<1>, Constant:i32<5>
  t19: ch = CopyToReg t0, Register:v8i16 %vreg0, t34

to

26: DAG.dump() = SelectionDAG has 8 nodes:
    t0: ch = EntryToken
      t76: v8i16 = BUILD_VECTOR Constant:i16<0>, Constant:i16<0>, Constant:i16<0>, Constant:i16<0>, Constant:i16<0>, Constant:i16<0>, Constant:i16<0>, Constant:i16<0>
    t34: v8i16 = insert_vector_elt t76, Constant:i32<1>, Constant:i32<5>
  t19: ch = CopyToReg t0, Register:v8i16 %vreg0, t34

, which later triggers (on BUILD_VECTOR)

/llvm/llvm-dev/lib/CodeGen/SelectionDAG/LegalizeDAG.cpp:921: void
{anonymous}::SelectionDAGLegalize::LegalizeOp(llvm::SDNode*): Assertion
`(TLI.getTypeAction(*DAG.getContext(), Op.getValueType()) ==
TargetLowering::TypeLegal || TLI.isTypeLegal(Op.getValueType()) ||
Op.getOpcode() == ISD::TargetConstant) && "Unexpected illegal type!"' failed.

This is because i16 is not a legal type on SystemZ, which means the
BUILD_VECTOR was transformed incorrectly. Could it be that the BUILD_VECTOR
should have TargetConstant operands, instead of Constant operands?

run with
bin/llc -mtriple=s390x-linux-gnu -mcpu=z13

[Quuxplusone]

Attached stress_fail_illegal_BUILD_VECTOR.ll (742 bytes, text/plain): reduced llvm-stress test case

[Quuxplusone]

ping.

any idea anyone?

[Quuxplusone]

The arguments to the BUILD_VECTOR are i32 but BUILD_VECTOR (and SCALAR_TO_VECTOR) implicitly truncates integer arguments. The assertion looks like it's too strict here. Making it less strict fixes the crash but I didn't check the output itself.

Other backends have had this error in the past but the bugs I've looked at all appear to be working now. It's not clear to me if this is deliberate or just incidental.

[Quuxplusone]

I think the problem here is just that the constant folding for SIGN_EXTEND_INREG in SelectionDAG::getNode() is producing constants with illegal types. Probably need to preserve the type of the operands to the BUILD_VECTOR.

[Quuxplusone]

https://reviews.llvm.org/D31651

[Quuxplusone]

rL299540