llvm / llvm-project

The LLVM Project is a collection of modular and reusable compiler and toolchain technologies.
http://llvm.org
Other
28.09k stars 11.59k forks source link

llvm backend crash: Assertion `N1.getOpcode() != ISD::DELETED_NODE && "Operand is DELETED_NODE!"' failed. #81432

Open shao-hua-li opened 7 months ago

shao-hua-li commented 7 months ago

llvm backend crash at -O3.

Compiler explorer: https://godbolt.org/z/dvqEePj8T

cat reduced.ll

target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @v(i64 %0) {
entry:
  %conv.i = trunc i64 %0 to i16
  %rem.i26.4.i.2 = mul i16 1, %conv.i
  %rem.i26.4.i.3 = mul i16 1, %conv.i
  %xor.4.i.393 = xor i16 %rem.i26.4.i.2, %rem.i26.4.i.3
  %1 = insertelement <8 x i16> zeroinitializer, i16 %rem.i26.4.i.2, i64 0
  %2 = insertelement <8 x i16> %1, i16 %xor.4.i.393, i64 1
  %.fr104 = freeze <8 x i16> %2
  %3 = icmp eq <8 x i16> %.fr104, zeroinitializer
  %rem.i26.4.i.4 = mul i16 1, %conv.i
  %xor.4.i.494.fr = freeze i16 %rem.i26.4.i.4
  %rem.i26.4.i.5 = mul i16 1, %conv.i
  %xor.4.i.595 = xor i16 %xor.4.i.494.fr, %rem.i26.4.i.5
  %cmp.i22.4.i.5 = icmp eq i16 %xor.4.i.595, 0
  %4 = bitcast <8 x i1> %3 to i8
  %5 = icmp ne i8 %4, 0
  %6 = or i1 %5, %cmp.i22.4.i.5
  %7 = select i1 %6, i32 1, i32 0
  store i32 %7, ptr null, align 4
  ret void
}
% llc -O3 reduced.ll
llc: /tmp/tmp65qcpham/tmp9wqxmpo5/llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp:5421: llvm::SDValue llvm::SelectionDAG::getNode(unsigned int, const llvm::SDLoc&, llvm::EVT, llvm::SDValue, llvm::SDNodeFlags): Assertion `N1.getOpcode() != ISD::DELETED_NODE && "Operand is DELETED_NODE!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.  Program arguments: /zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/llc -O3 reduced.ll
1.  Running pass 'Function Pass Manager' on module 'reduced.ll'.
2.  Running pass 'X86 DAG->DAG Instruction Selection' on function '@v'
 #0 0x00007fdc03d361ff llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x9031ff)
 #1 0x00007fdc03d33954 SignalHandler(int) Signals.cpp:0:0
 #2 0x00007fdc03048090 (/lib/x86_64-linux-gnu/libc.so.6+0x43090)
 #3 0x00007fdc0304800b raise /build/glibc-wuryBv/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
 #4 0x00007fdc03027859 abort /build/glibc-wuryBv/glibc-2.31/stdlib/abort.c:81:7
 #5 0x00007fdc03027729 get_sysdep_segment_value /build/glibc-wuryBv/glibc-2.31/intl/loadmsgcat.c:509:8
 #6 0x00007fdc03027729 _nl_load_domain /build/glibc-wuryBv/glibc-2.31/intl/loadmsgcat.c:970:34
 #7 0x00007fdc03038fd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
 #8 0x00007fdc049241bc llvm::SelectionDAG::getNode(unsigned int, llvm::SDLoc const&, llvm::EVT, llvm::SDValue, llvm::SDNodeFlags) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x14f11bc)
 #9 0x00007fdc04924599 llvm::SelectionDAG::getFreeze(llvm::SDValue) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x14f1599)
#10 0x00007fdc046b7737 (anonymous namespace)::DAGCombiner::visitFREEZE(llvm::SDNode*) (.isra.0) DAGCombiner.cpp:0:0
#11 0x00007fdc0473de61 (anonymous namespace)::DAGCombiner::visit(llvm::SDNode*) DAGCombiner.cpp:0:0
#12 0x00007fdc0473ed85 (anonymous namespace)::DAGCombiner::combine(llvm::SDNode*) DAGCombiner.cpp:0:0
#13 0x00007fdc0474058c (anonymous namespace)::DAGCombiner::Run(llvm::CombineLevel) DAGCombiner.cpp:0:0
#14 0x00007fdc04742bac llvm::SelectionDAG::Combine(llvm::CombineLevel, llvm::AAResults*, llvm::CodeGenOpt::Level) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x130fbac)
#15 0x00007fdc04960da5 llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x152dda5)
#16 0x00007fdc04964958 llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x1531958)
#17 0x00007fdc04966622 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (.part.0) SelectionDAGISel.cpp:0:0
#18 0x00007fdc067668b0 (anonymous namespace)::X86DAGToDAGISel::runOnMachineFunction(llvm::MachineFunction&) X86ISelDAGToDAG.cpp:0:0
#19 0x00007fdc0429897e llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#20 0x00007fdc03ef9ce1 llvm::FPPassManager::runOnFunction(llvm::Function&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0xac6ce1)
#21 0x00007fdc03ef9f29 llvm::FPPassManager::runOnModule(llvm::Module&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0xac6f29)
#22 0x00007fdc03efa7b2 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0xac77b2)
#23 0x00005619f6da6fa4 compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0
#24 0x00005619f6d9d026 main (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/llc+0xd026)
#25 0x00007fdc03029083 __libc_start_main /build/glibc-wuryBv/glibc-2.31/csu/../csu/libc-start.c:342:3
#26 0x00005619f6d9d63e _start (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/llc+0xd63e)
[1]    816479 abort       -O3 reduced.ll
%

This IR is reduced from the following C code:

short a, e, f;
int d, j, c;
static int i[] = {7, 7, 7};
static int *k = &j;
static int l;
long m, g, n;
long *b;
short(q)(short r) { return a == 0 ?: r % a; }
int(s)(int r) { return r == 0 ? d : 0; }
void t(char *r) {
  while (r == '/')
    ;
  while (r)
    ;
}
static int u(unsigned r) {
  for (; m;) {
    int h = a = n;
    if (g)
      return 0;
    h = l = 0;
    for (; l <= 4; l++) {
      j = 0;
      for (; j <= 8; j++) {
        *b = e = f = q(e <= r);
        *k = h ^= f;
        c |= s(*k);
      }
    }
  }
  return 0;
}
void v() {
  int **o = &k;
  *o = i;
  u(i[2]);
  char p;
  t(&p);
}
int main() {}
llvmbot commented 7 months ago

@llvm/issue-subscribers-backend-x86

Author: Shaohua Li (shao-hua-li)

llvm backend crash at -O3. Compiler explorer: https://godbolt.org/z/dvqEePj8T cat reduced.ll ```llvm target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128" target triple = "x86_64-unknown-linux-gnu" define void @v(i64 %0) { entry: %conv.i = trunc i64 %0 to i16 %rem.i26.4.i.2 = mul i16 1, %conv.i %rem.i26.4.i.3 = mul i16 1, %conv.i %xor.4.i.393 = xor i16 %rem.i26.4.i.2, %rem.i26.4.i.3 %1 = insertelement <8 x i16> zeroinitializer, i16 %rem.i26.4.i.2, i64 0 %2 = insertelement <8 x i16> %1, i16 %xor.4.i.393, i64 1 %.fr104 = freeze <8 x i16> %2 %3 = icmp eq <8 x i16> %.fr104, zeroinitializer %rem.i26.4.i.4 = mul i16 1, %conv.i %xor.4.i.494.fr = freeze i16 %rem.i26.4.i.4 %rem.i26.4.i.5 = mul i16 1, %conv.i %xor.4.i.595 = xor i16 %xor.4.i.494.fr, %rem.i26.4.i.5 %cmp.i22.4.i.5 = icmp eq i16 %xor.4.i.595, 0 %4 = bitcast <8 x i1> %3 to i8 %5 = icmp ne i8 %4, 0 %6 = or i1 %5, %cmp.i22.4.i.5 %7 = select i1 %6, i32 1, i32 0 store i32 %7, ptr null, align 4 ret void } ``` ```console % llc -O3 reduced.ll llc: /tmp/tmp65qcpham/tmp9wqxmpo5/llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp:5421: llvm::SDValue llvm::SelectionDAG::getNode(unsigned int, const llvm::SDLoc&, llvm::EVT, llvm::SDValue, llvm::SDNodeFlags): Assertion `N1.getOpcode() != ISD::DELETED_NODE && "Operand is DELETED_NODE!"' failed. PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace. Stack dump: 0. Program arguments: /zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/llc -O3 reduced.ll 1. Running pass 'Function Pass Manager' on module 'reduced.ll'. 2. Running pass 'X86 DAG->DAG Instruction Selection' on function '@v' #0 0x00007fdc03d361ff llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x9031ff) #1 0x00007fdc03d33954 SignalHandler(int) Signals.cpp:0:0 #2 0x00007fdc03048090 (/lib/x86_64-linux-gnu/libc.so.6+0x43090) #3 0x00007fdc0304800b raise /build/glibc-wuryBv/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1 #4 0x00007fdc03027859 abort /build/glibc-wuryBv/glibc-2.31/stdlib/abort.c:81:7 #5 0x00007fdc03027729 get_sysdep_segment_value /build/glibc-wuryBv/glibc-2.31/intl/loadmsgcat.c:509:8 #6 0x00007fdc03027729 _nl_load_domain /build/glibc-wuryBv/glibc-2.31/intl/loadmsgcat.c:970:34 #7 0x00007fdc03038fd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6) #8 0x00007fdc049241bc llvm::SelectionDAG::getNode(unsigned int, llvm::SDLoc const&, llvm::EVT, llvm::SDValue, llvm::SDNodeFlags) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x14f11bc) #9 0x00007fdc04924599 llvm::SelectionDAG::getFreeze(llvm::SDValue) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x14f1599) #10 0x00007fdc046b7737 (anonymous namespace)::DAGCombiner::visitFREEZE(llvm::SDNode*) (.isra.0) DAGCombiner.cpp:0:0 #11 0x00007fdc0473de61 (anonymous namespace)::DAGCombiner::visit(llvm::SDNode*) DAGCombiner.cpp:0:0 #12 0x00007fdc0473ed85 (anonymous namespace)::DAGCombiner::combine(llvm::SDNode*) DAGCombiner.cpp:0:0 #13 0x00007fdc0474058c (anonymous namespace)::DAGCombiner::Run(llvm::CombineLevel) DAGCombiner.cpp:0:0 #14 0x00007fdc04742bac llvm::SelectionDAG::Combine(llvm::CombineLevel, llvm::AAResults*, llvm::CodeGenOpt::Level) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x130fbac) #15 0x00007fdc04960da5 llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x152dda5) #16 0x00007fdc04964958 llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0x1531958) #17 0x00007fdc04966622 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (.part.0) SelectionDAGISel.cpp:0:0 #18 0x00007fdc067668b0 (anonymous namespace)::X86DAGToDAGISel::runOnMachineFunction(llvm::MachineFunction&) X86ISelDAGToDAG.cpp:0:0 #19 0x00007fdc0429897e llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0 #20 0x00007fdc03ef9ce1 llvm::FPPassManager::runOnFunction(llvm::Function&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0xac6ce1) #21 0x00007fdc03ef9f29 llvm::FPPassManager::runOnModule(llvm::Module&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0xac6f29) #22 0x00007fdc03efa7b2 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/../lib/libLLVM-18git.so+0xac77b2) #23 0x00005619f6da6fa4 compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0 #24 0x00005619f6d9d026 main (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/llc+0xd026) #25 0x00007fdc03029083 __libc_start_main /build/glibc-wuryBv/glibc-2.31/csu/../csu/libc-start.c:342:3 #26 0x00005619f6d9d63e _start (/zdata/shaoli/compilers/ccbuilder-compilers/clang-19a1b67b6d7a955ea5856a00d29b6358441448dd/bin/llc+0xd63e) [1] 816479 abort -O3 reduced.ll % ``` This IR is reduced from the following C code: ```C short a, e, f; int d, j, c; static int i[] = {7, 7, 7}; static int *k = &j; static int l; long m, g, n; long *b; short(q)(short r) { return a == 0 ?: r % a; } int(s)(int r) { return r == 0 ? d : 0; } void t(char *r) { while (r == '/') ; while (r) ; } static int u(unsigned r) { for (; m;) { int h = a = n; if (g) return 0; h = l = 0; for (; l <= 4; l++) { j = 0; for (; j <= 8; j++) { *b = e = f = q(e <= r); *k = h ^= f; c |= s(*k); } } } return 0; } void v() { int **o = &k; *o = i; u(i[2]); char p; t(&p); } int main() {} ```
RKSimon commented 7 months ago

Generic DAG bug in DAGCombiner::visitFREEZE - we're collecting all unique maybe poison operands in SmallSetVector<SDValue, 8> MaybePoisonOperands and then calling ReplaceAllUsesOfValueWith on them which can result in later nodes in the set being replaced/deleted before they get processed.