Crash in Neon (unexpected intrinsic for Neon base update UNREACHABLE executed at /disk/llvm/llvm-project/llvm/lib/Target/ARM/ARMISelLowering.cpp:13844!)

[stephenhines]

Bugzilla Link	46615
Resolution	FIXED
Resolved on	Sep 09, 2020 09:22
Version	trunk
OS	Linux
Attachments	reduced.cpp input file
CC	@DMG862,@kbeyls,@nickdesaulniers,@sjoerdmeijer,@smithp35,@stephenhines

Extended Description

I reduced down the following crash from an NDK bug report (https://github.com/android/ndk/issues/1303). https://godbolt.org/z/MXuui4 shows the crash as well. This isn't specifically a regression, but is a crash on what appears to be valid code.

$ clang++ --target=armv7-none-linux-androideabi -c -Oz reduced.cpp
srhines@ringworld:__:llvm_neon_crash$ /disk/llvm/build/bin/clang++ --target=armv7-none-linux-androideabi -c -Oz ~/reduced.cpp 
unexpected intrinsic for Neon base update                                                                                                                                                                                              
UNREACHABLE executed at /disk/llvm/llvm-project/llvm/lib/Target/ARM/ARMISelLowering.cpp:13844!                                                                                                                                         
PLEASE submit a bug report to https://bugs.llvm.org/ and include the crash backtrace, preprocessed source, and associated run script.                                                                         
Stack dump:                                                                                                        
0.      Program arguments: /disk/llvm/build/bin/clang++ --target=armv7-none-linux-androideabi -c -Oz /usr/local/google/home/srhines/reduced.cpp 
1.      <eof> parser at end of file                                                                                
2.      Code generation                                                                                            
3.      Running pass 'Function Pass Manager' on module '/usr/local/google/home/srhines/reduced.cpp'.    
4.      Running pass 'ARM Instruction Selection' on function '@_GLOBAL__sub_I_reduced.cpp'
 #&#8203;0 0x0000000004297677 llvm::sys::PrintStackTrace(llvm::raw_ostream&) (/disk/llvm/build/bin/clang+++0x4297677)
 #&#8203;1 0x0000000004297819 PrintStackTraceSignalHandler(void*) (/disk/llvm/build/bin/clang+++0x4297819)
 #&#8203;2 0x000000000429601b llvm::sys::RunSignalHandlers() (/disk/llvm/build/bin/clang+++0x429601b)
 #&#8203;3 0x0000000004296f6e llvm::sys::CleanupOnSignal(unsigned long) (/disk/llvm/build/bin/clang+++0x4296f6e)
 #&#8203;4 0x00000000041907b8 (anonymous namespace)::CrashRecoveryContextImpl::HandleCrash(int, unsigned long) (/disk/llvm/build/bin/clang+++0x41907b8)
 #&#8203;5 0x0000000004190a3e CrashRecoverySignalHandler(int) (/disk/llvm/build/bin/clang+++0x4190a3e)
 #&#8203;6 0x00007f07b6a56110 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14110)
 #&#8203;7 0x00007f07b6530761 raise /build/glibc-M65Gwz/glibc-2.30/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
 #&#8203;8 0x00007f07b651a55b abort /build/glibc-M65Gwz/glibc-2.30/stdlib/abort.c:81:7
 #&#8203;9 0x0000000004198b34 (/disk/llvm/build/bin/clang+++0x4198b34)
#&#8203;10 0x0000000001c51eed CombineBaseUpdate(llvm::SDNode*, llvm::TargetLowering::DAGCombinerInfo&) (/disk/llvm/build/bin/clang+++0x1c51eed)
#&#8203;11 0x0000000001c2d11c PerformVLDCombine(llvm::SDNode*, llvm::TargetLowering::DAGCombinerInfo&) (/disk/llvm/build/bin/clang+++0x1c2d11c)
#&#8203;12 0x0000000001c2137a llvm::ARMTargetLowering::PerformDAGCombine(llvm::SDNode*, llvm::TargetLowering::DAGCombinerInfo&) const (/disk/llvm/build/bin/clang+++0x1c2137a)
#&#8203;13 0x00000000056c3741 (anonymous namespace)::DAGCombiner::combine(llvm::SDNode*) (/disk/llvm/build/bin/clang+++0x56c3741)
#&#8203;14 0x00000000056c2bc0 (anonymous namespace)::DAGCombiner::Run(llvm::CombineLevel) (/disk/llvm/build/bin/clang+++0x56c2bc0)
#&#8203;15 0x00000000056c248f llvm::SelectionDAG::Combine(llvm::CombineLevel, llvm::AAResults*, llvm::CodeGenOpt::Level) (/disk/llvm/build/bin/clang+++0x56c248f)
#&#8203;16 0x00000000058c1710 llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/disk/llvm/build/bin/clang+++0x58c1710)
#&#8203;17 0x00000000058c029f llvm::SelectionDAGISel::SelectBasicBlock(llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void>, false, true>, llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::
Instruction, true, false, void>, false, true>, bool&) (/disk/llvm/build/bin/clang+++0x58c029f)
#&#8203;18 0x00000000058bfcfa llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (/disk/llvm/build/bin/clang+++0x58bfcfa)
#&#8203;19 0x00000000058bce1f llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (/disk/llvm/build/bin/clang+++0x58bce1f)
#&#8203;20 0x0000000001b8cf68 (anonymous namespace)::ARMDAGToDAGISel::runOnMachineFunction(llvm::MachineFunction&) (/disk/llvm/build/bin/clang+++0x1b8cf68)
#&#8203;21 0x00000000032183e7 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (/disk/llvm/build/bin/clang+++0x32183e7)
#&#8203;22 0x00000000037bee6c llvm::FPPassManager::runOnFunction(llvm::Function&) (/disk/llvm/build/bin/clang+++0x37bee6c)
#&#8203;23 0x00000000037bf295 llvm::FPPassManager::runOnModule(llvm::Module&) (/disk/llvm/build/bin/clang+++0x37bf295)
#&#8203;24 0x00000000037bfa14 (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) (/disk/llvm/build/bin/clang+++0x37bfa14)
#&#8203;25 0x00000000037bf538 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/disk/llvm/build/bin/clang+++0x37bf538)
#&#8203;26 0x00000000037bffb1 llvm::legacy::PassManager::run(llvm::Module&) (/disk/llvm/build/bin/clang+++0x37bffb1)
#&#8203;27 0x000000000467001c (anonymous namespace)::EmitAssemblyHelper::EmitAssembly(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream> >) (/disk/llvm/build/bin/clang+++0x467001c)
#&#8203;28 0x000000000466c0b5 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::DataLayout const&, llvm::Modu
le*, clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream> >) (/disk/llvm/build/bin/clang+++0x466c0b5)
#&#8203;29 0x0000000005a0fddc clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/disk/llvm/build/bin/clang+++0x5a0fddc)
#&#8203;30 0x00000000075d8c5e clang::ParseAST(clang::Sema&, bool, bool) (/disk/llvm/build/bin/clang+++0x75d8c5e)
#&#8203;31 0x0000000004facb02 clang::ASTFrontendAction::ExecuteAction() (/disk/llvm/build/bin/clang+++0x4facb02)
#&#8203;32 0x0000000005a0c148 clang::CodeGenAction::ExecuteAction() (/disk/llvm/build/bin/clang+++0x5a0c148)
#&#8203;33 0x0000000004fac4c8 clang::FrontendAction::Execute() (/disk/llvm/build/bin/clang+++0x4fac4c8)
#&#8203;34 0x0000000004f3c5ad clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/disk/llvm/build/bin/clang+++0x4f3c5ad)
#&#8203;35 0x0000000005166a6f clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/disk/llvm/build/bin/clang+++0x5166a6f)
#&#8203;36 0x0000000001235f42 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/disk/llvm/build/bin/clang+++0x1235f42)
#&#8203;37 0x0000000001229ab2 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&) (/disk/llvm/build/bin/clang+++0x1229ab2) 
#&#8203;38 0x0000000004e302c8 clang::driver::CC1Command::Execute(llvm::ArrayRef<llvm::Optional<llvm::StringRef> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, bool*) const::$_1::operator()() const (/d
isk/llvm/build/bin/clang+++0x4e302c8)
#&#8203;39 0x0000000004e30295 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<llvm::Optional<llvm::StringRef> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>
 >*, bool*) const::$_1>(long) (/disk/llvm/build/bin/clang+++0x4e30295)
#&#8203;40 0x0000000004185619 llvm::function_ref<void ()>::operator()() const (/disk/llvm/build/bin/clang+++0x4185619)
#&#8203;41 0x00000000041905a4 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/disk/llvm/build/bin/clang+++0x41905a4)
#&#8203;42 0x0000000004e2f6d6 clang::driver::CC1Command::Execute(llvm::ArrayRef<llvm::Optional<llvm::StringRef> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, bool*) const (/disk/llvm/build/bin/clang+
++0x4e2f6d6)
#&#8203;43 0x0000000004ddfa92 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&) const (/disk/llvm/build/bin/clang+++0x4ddfa92)
#&#8203;44 0x0000000004ddfc7b clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*> >&) const (/disk/llvm/build/bin/clang+++0x4ddfc7b)
#&#8203;45 0x0000000004df5a8e clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*> >&) (/disk/llvm/build/bin/clang+++0x4df5a8e)
#&#8203;46 0x0000000001229442 main (/disk/llvm/build/bin/clang+++0x1229442)
#&#8203;47 0x00007f07b651be0b __libc_start_main /build/glibc-M65Gwz/glibc-2.30/csu/../csu/libc-start.c:342:3
#&#8203;48 0x000000000122846a _start (/disk/llvm/build/bin/clang+++0x122846a)
clang-11: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 11.0.0 (https://github.com/llvm/llvm-project.git c359c5d534429c96f1cebdf8d845b8120e9c2ef0)
Target: armv7-none-linux-android
Thread model: posix
InstalledDir: /disk/llvm/build/bin
clang-11: note: diagnostic msg: 
********************

[sjoerdmeijer]

I think this is a duplicate of llvm/llvm-project#45169 , which has been fixed. I couldn't reproduce this anymore, so resolving this.

[nickdesaulniers]

At the the least, do we need to add 3 new cases for these 3 new intrinsics to CombineUpdateBase? Maybe add those cases to the continue to skip these for now?

Looks like doing so doesn't fix the crash.

[nickdesaulniers]

D47121 adds 3 new intrinsics:

• arm_neon_vld1x2
• arm_neon_vld1x3
• arm_neon_vld1x4

CombineBaseUpdate has logic: if (isIntrinsic) {

Where the intrinsic cases include the other nearby defined intrinsics such as * arm_neon_vld1 * arm_neon_vld2 At the the least, do we need to add 3 new cases for these 3 new intrinsics to CombineUpdateBase? Maybe add those cases to the `continue` to skip these for now?

[kbeyls]

When git bisecting this, this points to the commit that enabled Neon by default on Android. When git bisecting this but instead for a armv7a-linux-gnueabihf target, this points to the following commit: 9c40c0ad0ca49a0b4eff20bf85b088daecb0014f is the first bad commit commit 9c40c0ad0ca49a0b4eff20bf85b088daecb0014f Author: Ivan A. Kosarev ikosarev@accesssoftek.com Date: Sat Jun 2 17:42:59 2018 +0000

[NEON] Support VLD1xN intrinsics in AArch32 mode (Clang part)

We currently support them only in AArch64. The NEON Reference,
however, says they are 'ARMv7, ARMv8' intrinsics.

Differential Revision: https://reviews.llvm.org/D47121

llvm-svn: 333829

clang/include/clang/Basic/arm_neon.td | 16 +- clang/lib/CodeGen/CGBuiltin.cpp | 57 +- clang/test/CodeGen/aarch64-neon-intrinsics.c | 1276 +---------------------- clang/test/CodeGen/arm-neon-vld.c | 1411 ++++++++++++++++++++++++++ 4 files changed, 1457 insertions(+), 1303 deletions(-) create mode 100644 clang/test/CodeGen/arm-neon-vld.c

So, this points to the commit that introduced support for these intrinsics for AArch32 (ARM) that was earlier enabled for AArch64 (see http://llvm.org/viewvc/llvm-project?view=revision&revision=194990)

When running the reproducer under a debugger, it points to an assertion in function CombineBaseUpdate in ARMISelLowering.cpp, indicating that a switch isn't handling the newly introduced intrinsics.

It looks very much like a number of pieces of functionality were not introduced as part of https://reviews.llvm.org/D47121 that should have been introduced. When comparing to the commit that introduced support for these intrinsics in AArch64 there are e.g. no additions to function CombineBaseUpdate in ARMISelLowering.cpp in https://reviews.llvm.org/D47121, whereas there are additions for them in the same function in AArch64ISelLowering.cpp, see http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Target/AArch64/AArch64ISelLowering.cpp?view=diff&r1=194989&r2=194990&pathrev=194990).

To fix this, it seems that a comparison should be made for where in the AArch64 backend additions were made for the new intrinsics under commit http://llvm.org/viewvc/llvm-project?view=revision&revision=19499; for which equivalent additions in the ARM backend are missing under patch https://reviews.llvm.org/D47121.