search

llvm / llvm-project

The LLVM Project is a collection of modular and reusable compiler and toolchain technologies.
http://llvm.org
Other
27.99k stars 11.55k forks source link

[RISC-V] PromoteIntegerResult mulhs Do not know how to promote this operator! #104480

Closed patrick-rivos closed 1 month ago

patrick-rivos commented 1 month ago

C testcase:

extern int c[][4];
extern short d[];
#define e(a, b)                                                                \
  ({                                                                           \
    __typeof__(a) f = a;                                                       \
    __typeof__(b) g = 0;                                                       \
    f < g;                                                                     \
  })
void h(short i[][5][5][5][5][5]) {
  for (unsigned j = 0;;)
    for (unsigned k = 0; k < 49; k += 2) {
      c[k][3] = e(i[j][1][0][j][j][1] % 3, 0);
      d[k] = 0;
    }
}

Godbolt: https://c.godbolt.org/z/bhfrE7drT

Testcase:

; ModuleID = 'reduced.bc'
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"

define void @h(<vscale x 4 x i16> %broadcast.splatinsert, <vscale x 4 x i1> %0, <vscale x 4 x i1> %1) #0 {
entry:
  %broadcast.splat = shufflevector <vscale x 4 x i16> %broadcast.splatinsert, <vscale x 4 x i16> zeroinitializer, <vscale x 4 x i32> zeroinitializer
  %2 = srem <vscale x 4 x i16> %broadcast.splat, shufflevector (<vscale x 4 x i16> insertelement (<vscale x 4 x i16> poison, i16 3, i64 0), <vscale x 4 x i16> poison, <vscale x 4 x i32> zeroinitializer)
  %3 = zext <vscale x 4 x i16> %2 to <vscale x 4 x i32>
  tail call void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32> %3, <vscale x 4 x ptr> zeroinitializer, i32 0, <vscale x 4 x i1> %0)
  ret void
}

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(write)
declare void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32>, <vscale x 4 x ptr>, i32 immarg, <vscale x 4 x i1>) #1

attributes #0 = { "target-features"="+64bit,+d,+f,+relax,+zicsr,+zmmul,+zve32f,+zve32x,+zve64d,+zve64f,+zve64x,+zvl32b,+zvl64b,-a,-b,-c,-e,-experimental-smmpm,-experimental-smnpm,-experimental-ssnpm,-experimental-sspm,-experimental-ssqosid,-experimental-supm,-experimental-zacas,-experimental-zalasr,-experimental-zicfilp,-experimental-zicfiss,-h,-m,-shcounterenw,-shgatpa,-shtvala,-shvsatpa,-shvstvala,-shvstvecd,-smaia,-smcdeleg,-smcsrind,-smepmp,-smstateen,-ssaia,-ssccfg,-ssccptr,-sscofpmf,-sscounterenw,-sscsrind,-ssstateen,-ssstrict,-sstc,-sstvala,-sstvecd,-ssu64xl,-svade,-svadu,-svbare,-svinval,-svnapot,-svpbmt,-v,-xcvalu,-xcvbi,-xcvbitmanip,-xcvelw,-xcvmac,-xcvmem,-xcvsimd,-xsfcease,-xsfvcp,-xsfvfnrclipxfqf,-xsfvfwmaccqqq,-xsfvqmaccdod,-xsfvqmaccqoq,-xsifivecdiscarddlone,-xsifivecflushdlone,-xtheadba,-xtheadbb,-xtheadbs,-xtheadcmo,-xtheadcondmov,-xtheadfmemidx,-xtheadmac,-xtheadmemidx,-xtheadmempair,-xtheadsync,-xtheadvdot,-xventanacondops,-xwchc,-za128rs,-za64rs,-zaamo,-zabha,-zalrsc,-zama16b,-zawrs,-zba,-zbb,-zbc,-zbkb,-zbkc,-zbkx,-zbs,-zca,-zcb,-zcd,-zce,-zcf,-zcmop,-zcmp,-zcmt,-zdinx,-zfa,-zfbfmin,-zfh,-zfhmin,-zfinx,-zhinx,-zhinxmin,-zic64b,-zicbom,-zicbop,-zicboz,-ziccamoa,-ziccif,-zicclsm,-ziccrse,-zicntr,-zicond,-zifencei,-zihintntl,-zihintpause,-zihpm,-zimop,-zk,-zkn,-zknd,-zkne,-zknh,-zkr,-zks,-zksed,-zksh,-zkt,-ztso,-zvbb,-zvbc,-zvfbfmin,-zvfbfwma,-zvfh,-zvfhmin,-zvkb,-zvkg,-zvkn,-zvknc,-zvkned,-zvkng,-zvknha,-zvknhb,-zvks,-zvksc,-zvksed,-zvksg,-zvksh,-zvkt,-zvl1024b,-zvl128b,-zvl16384b,-zvl2048b,-zvl256b,-zvl32768b,-zvl4096b,-zvl512b,-zvl65536b,-zvl8192b" }
attributes #1 = { nocallback nofree nosync nounwind willreturn memory(write) }

Command/backtrace:

> /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc reduced.ll
PromoteIntegerResult #0: t43: i16 = mulhs t10, Constant:i16<21846>

LLVM ERROR: Do not know how to promote this operator!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc reduced.ll
1.      Running pass 'Function Pass Manager' on module 'reduced.ll'.
2.      Running pass 'RISC-V DAG->DAG Pattern Instruction Selection' on function '@h'
 #0 0x0000593572bef030 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1e6e030)
 #1 0x0000593572bec44f llvm::sys::RunSignalHandlers() (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1e6b44f)
 #2 0x0000593572bec5a5 SignalHandler(int) Signals.cpp:0:0
 #3 0x000075aef0c42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x000075aef0c969fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x000075aef0c969fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x000075aef0c969fc pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x000075aef0c42476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x000075aef0c287f3 abort ./stdlib/abort.c:81:7
 #9 0x000059357132fcee llvm::UniqueStringSaver::save(llvm::StringRef) (.cold) StringSaver.cpp:0:0
#10 0x0000593572b463ee (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1dc53ee)
#11 0x0000593572aea00f llvm::DAGTypeLegalizer::PromoteIntegerResult(llvm::SDNode*, unsigned int) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1d6900f)
#12 0x0000593572a2cc35 llvm::DAGTypeLegalizer::run() (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1cabc35)
#13 0x0000593572a2de51 llvm::SelectionDAG::LegalizeTypes() (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1cace51)
#14 0x000059357297e1fa llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1bfd1fa)
#15 0x00005935729821a2 llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1c011a2)
#16 0x0000593572983977 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1c02977)
#17 0x0000593572973df9 llvm::SelectionDAGISelLegacy::runOnMachineFunction(llvm::MachineFunction&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1bf2df9)
#18 0x0000593571aeebc7 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#19 0x000059357211693c llvm::FPPassManager::runOnFunction(llvm::Function&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x139593c)
#20 0x0000593572116d69 llvm::FPPassManager::runOnModule(llvm::Module&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1395d69)
#21 0x0000593572115c76 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1394c76)
#22 0x00005935713f30c6 compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0
#23 0x0000593571337c06 main (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x5b6c06)
#24 0x000075aef0c29d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#25 0x000075aef0c29e40 call_init ./csu/../csu/libc-start.c:128:20
#26 0x000075aef0c29e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#27 0x00005935713e9f05 _start (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x668f05)
zsh: IOT instruction (core dumped)  /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc

Godbolt: https://ir.godbolt.org/z/GKT1T7v3e

Found via fuzzer.

llvmbot commented 1 month ago

@llvm/issue-subscribers-backend-risc-v

Author: Patrick O'Neill (patrick-rivos)

C testcase: ```c extern int c[][4]; extern short d[]; #define e(a, b) \ ({ \ __typeof__(a) f = a; \ __typeof__(b) g = 0; \ f < g; \ }) void h(short i[][5][5][5][5][5]) { for (unsigned j = 0;;) for (unsigned k = 0; k < 49; k += 2) { c[k][3] = e(i[j][1][0][j][j][1] % 3, 0); d[k] = 0; } } ``` Godbolt: https://c.godbolt.org/z/bhfrE7drT Testcase: ```llvm ir ; ModuleID = 'reduced.bc' target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128" target triple = "riscv64-unknown-linux-gnu" define void @h(<vscale x 4 x i16> %broadcast.splatinsert, <vscale x 4 x i1> %0, <vscale x 4 x i1> %1) #0 { entry: %broadcast.splat = shufflevector <vscale x 4 x i16> %broadcast.splatinsert, <vscale x 4 x i16> zeroinitializer, <vscale x 4 x i32> zeroinitializer %2 = srem <vscale x 4 x i16> %broadcast.splat, shufflevector (<vscale x 4 x i16> insertelement (<vscale x 4 x i16> poison, i16 3, i64 0), <vscale x 4 x i16> poison, <vscale x 4 x i32> zeroinitializer) %3 = zext <vscale x 4 x i16> %2 to <vscale x 4 x i32> tail call void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32> %3, <vscale x 4 x ptr> zeroinitializer, i32 0, <vscale x 4 x i1> %0) ret void } ; Function Attrs: nocallback nofree nosync nounwind willreturn memory(write) declare void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32>, <vscale x 4 x ptr>, i32 immarg, <vscale x 4 x i1>) #1 attributes #0 = { "target-features"="+64bit,+d,+f,+relax,+zicsr,+zmmul,+zve32f,+zve32x,+zve64d,+zve64f,+zve64x,+zvl32b,+zvl64b,-a,-b,-c,-e,-experimental-smmpm,-experimental-smnpm,-experimental-ssnpm,-experimental-sspm,-experimental-ssqosid,-experimental-supm,-experimental-zacas,-experimental-zalasr,-experimental-zicfilp,-experimental-zicfiss,-h,-m,-shcounterenw,-shgatpa,-shtvala,-shvsatpa,-shvstvala,-shvstvecd,-smaia,-smcdeleg,-smcsrind,-smepmp,-smstateen,-ssaia,-ssccfg,-ssccptr,-sscofpmf,-sscounterenw,-sscsrind,-ssstateen,-ssstrict,-sstc,-sstvala,-sstvecd,-ssu64xl,-svade,-svadu,-svbare,-svinval,-svnapot,-svpbmt,-v,-xcvalu,-xcvbi,-xcvbitmanip,-xcvelw,-xcvmac,-xcvmem,-xcvsimd,-xsfcease,-xsfvcp,-xsfvfnrclipxfqf,-xsfvfwmaccqqq,-xsfvqmaccdod,-xsfvqmaccqoq,-xsifivecdiscarddlone,-xsifivecflushdlone,-xtheadba,-xtheadbb,-xtheadbs,-xtheadcmo,-xtheadcondmov,-xtheadfmemidx,-xtheadmac,-xtheadmemidx,-xtheadmempair,-xtheadsync,-xtheadvdot,-xventanacondops,-xwchc,-za128rs,-za64rs,-zaamo,-zabha,-zalrsc,-zama16b,-zawrs,-zba,-zbb,-zbc,-zbkb,-zbkc,-zbkx,-zbs,-zca,-zcb,-zcd,-zce,-zcf,-zcmop,-zcmp,-zcmt,-zdinx,-zfa,-zfbfmin,-zfh,-zfhmin,-zfinx,-zhinx,-zhinxmin,-zic64b,-zicbom,-zicbop,-zicboz,-ziccamoa,-ziccif,-zicclsm,-ziccrse,-zicntr,-zicond,-zifencei,-zihintntl,-zihintpause,-zihpm,-zimop,-zk,-zkn,-zknd,-zkne,-zknh,-zkr,-zks,-zksed,-zksh,-zkt,-ztso,-zvbb,-zvbc,-zvfbfmin,-zvfbfwma,-zvfh,-zvfhmin,-zvkb,-zvkg,-zvkn,-zvknc,-zvkned,-zvkng,-zvknha,-zvknhb,-zvks,-zvksc,-zvksed,-zvksg,-zvksh,-zvkt,-zvl1024b,-zvl128b,-zvl16384b,-zvl2048b,-zvl256b,-zvl32768b,-zvl4096b,-zvl512b,-zvl65536b,-zvl8192b" } attributes #1 = { nocallback nofree nosync nounwind willreturn memory(write) } ``` Command/backtrace: ``` > /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc reduced.ll PromoteIntegerResult #0: t43: i16 = mulhs t10, Constant:i16<21846> LLVM ERROR: Do not know how to promote this operator! PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace. Stack dump: 0. Program arguments: /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc reduced.ll 1. Running pass 'Function Pass Manager' on module 'reduced.ll'. 2. Running pass 'RISC-V DAG->DAG Pattern Instruction Selection' on function '@h' #0 0x0000593572bef030 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1e6e030) #1 0x0000593572bec44f llvm::sys::RunSignalHandlers() (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1e6b44f) #2 0x0000593572bec5a5 SignalHandler(int) Signals.cpp:0:0 #3 0x000075aef0c42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520) #4 0x000075aef0c969fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76 #5 0x000075aef0c969fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10 #6 0x000075aef0c969fc pthread_kill ./nptl/pthread_kill.c:89:10 #7 0x000075aef0c42476 gsignal ./signal/../sysdeps/posix/raise.c:27:6 #8 0x000075aef0c287f3 abort ./stdlib/abort.c:81:7 #9 0x000059357132fcee llvm::UniqueStringSaver::save(llvm::StringRef) (.cold) StringSaver.cpp:0:0 #10 0x0000593572b463ee (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1dc53ee) #11 0x0000593572aea00f llvm::DAGTypeLegalizer::PromoteIntegerResult(llvm::SDNode*, unsigned int) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1d6900f) #12 0x0000593572a2cc35 llvm::DAGTypeLegalizer::run() (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1cabc35) #13 0x0000593572a2de51 llvm::SelectionDAG::LegalizeTypes() (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1cace51) #14 0x000059357297e1fa llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1bfd1fa) #15 0x00005935729821a2 llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1c011a2) #16 0x0000593572983977 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1c02977) #17 0x0000593572973df9 llvm::SelectionDAGISelLegacy::runOnMachineFunction(llvm::MachineFunction&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1bf2df9) #18 0x0000593571aeebc7 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0 #19 0x000059357211693c llvm::FPPassManager::runOnFunction(llvm::Function&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x139593c) #20 0x0000593572116d69 llvm::FPPassManager::runOnModule(llvm::Module&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1395d69) #21 0x0000593572115c76 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1394c76) #22 0x00005935713f30c6 compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0 #23 0x0000593571337c06 main (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x5b6c06) #24 0x000075aef0c29d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #25 0x000075aef0c29e40 call_init ./csu/../csu/libc-start.c:128:20 #26 0x000075aef0c29e40 __libc_start_main ./csu/../csu/libc-start.c:379:5 #27 0x00005935713e9f05 _start (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x668f05) zsh: IOT instruction (core dumped) /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc ``` Godbolt: https://ir.godbolt.org/z/GKT1T7v3e Found via fuzzer.
topperc commented 1 month ago

Looks like it was caused by 234cb4c6e3a382a5c0b3396647a1839699944ec0

topperc commented 1 month ago

Related variant that crashes differently on RV32. It crashes in Promote instead of Expand.

define <vscale x 4 x i64> @h(<vscale x 4 x i64> %broadcast.splatinsert, <vscale x 4 x i1> %0, <vscale x 4 x i1> %1) #0 {
entry:                                                                           
  %broadcast.splat = shufflevector <vscale x 4 x i64> %broadcast.splatinsert, <vscale x 4 x i64> zeroinitializer, <vscale x 4 x i32> zeroinitializer
  %2 = srem <vscale x 4 x i64> %broadcast.splat, shufflevector (<vscale x 4 x i64> insertelement (<vscale x 4 x i64> poison, i64 3, i64 0), <vscale x 4 x i64> poison, <vscale x 4 x i32> zeroinitializer)
  ret <vscale x 4 x i64> %2                                                      
}
ExpandIntegerResult #0: t39: i64 = mulhs t61, Constant:i64<6148914691236517206>

LLVM ERROR: Do not know how to expand the result of this operator!
Fros1er commented 1 month ago

Does #104525 also related to this?