[RISC-V] Segfault during pass 'RISC-V DAG->DAG Pattern Instruction Selection'

[patrick-rivos]

Testcase:

int a, b;
_Bool c[2];
_Bool f;
int main() {
  for (long d = 0; d < 1; d += b)
    for (_Bool e = d; e < f; e = 1)
      a = 5 ? c[e] : 0;
}

LLVM IR:

; ModuleID = 'bugpoint-reduced-simplified.bc'
source_filename = "reduced.ll"
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"

define void @main(<vscale x 4 x i1> %0) #0 {
entry:
  %1 = zext <vscale x 4 x i1> %0 to <vscale x 4 x i64>
  %2 = getelementptr [2 x i8], ptr null, i64 0, <vscale x 4 x i64> %1
  %wide.masked.gather = tail call <vscale x 4 x i8> @llvm.masked.gather.nxv4i8.nxv4p0(<vscale x 4 x ptr> %2, i32 0, <vscale x 4 x i1> %0, <vscale x 4 x i8> zeroinitializer)
  tail call void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32> zeroinitializer, <vscale x 4 x ptr> zeroinitializer, i32 0, <vscale x 4 x i1> zeroinitializer)
  ret void
}

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(read)
declare <vscale x 4 x i8> @llvm.masked.gather.nxv4i8.nxv4p0(<vscale x 4 x ptr>, i32 immarg, <vscale x 4 x i1>, <vscale x 4 x i8>) #1

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(write)
declare void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32>, <vscale x 4 x ptr>, i32 immarg, <vscale x 4 x i1>) #2

attributes #0 = { "target-features"="+64bit,+v" }
attributes #1 = { nocallback nofree nosync nounwind willreturn memory(read) }
attributes #2 = { nocallback nofree nosync nounwind willreturn memory(write) }

Backtrace:

> /scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc bugpoint-reduced-simplified.ll
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc bugpoint-reduced-simplified.ll
1.      Running pass 'Function Pass Manager' on module 'bugpoint-reduced-simplified.ll'.
2.      Running pass 'RISC-V DAG->DAG Pattern Instruction Selection' on function '@main'
 #0 0x000055b76e342350 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x1c89350)
 #1 0x000055b76e33f75f llvm::sys::RunSignalHandlers() (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x1c8675f)
 #2 0x000055b76e33f8b5 SignalHandler(int) Signals.cpp:0:0
 #3 0x00007f8457242520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x000055b76cd08cd3 llvm::RISCVDAGToDAGISel::Select(llvm::SDNode*) (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x64fcd3)
 #5 0x000055b76e0d44ba llvm::SelectionDAGISel::DoInstructionSelection() (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x1a1b4ba)
 #6 0x000055b76e0e239c llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x1a2939c)
 #7 0x000055b76e0e5fbf llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x1a2cfbf)
 #8 0x000055b76e0e7b35 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (.part.0) SelectionDAGISel.cpp:0:0
 #9 0x000055b76d2cddf7 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#10 0x000055b76d8b6cee llvm::FPPassManager::runOnFunction(llvm::Function&) (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x11fdcee)
#11 0x000055b76d8b6f39 llvm::FPPassManager::runOnModule(llvm::Module&) (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x11fdf39)
#12 0x000055b76d8b78a5 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x11fe8a5)
#13 0x000055b76cbebcda compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0
#14 0x000055b76cb4b7c6 main (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x4927c6)
#15 0x00007f8457229d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#16 0x00007f8457229e40 call_init ./csu/../csu/libc-start.c:128:20
#17 0x00007f8457229e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#18 0x000055b76cbe2505 _start (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x529505)
zsh: segmentation fault (core dumped)  /scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc

Godbolt: https://godbolt.org/z/c8v8h9fxo

Found via fuzzer

[llvmbot]

@llvm/issue-subscribers-backend-risc-v

Author: Patrick O'Neill (patrick-rivos)

Testcase: ``` int a, b; _Bool c[2]; _Bool f; int main() { for (long d = 0; d < 1; d += b) for (_Bool e = d; e < f; e = 1) a = 5 ? c[e] : 0; } ``` LLVM IR: ```llvm ir ; ModuleID = 'bugpoint-reduced-simplified.bc' source_filename = "reduced.ll" target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128" target triple = "riscv64-unknown-linux-gnu" define void @main(<vscale x 4 x i1> %0) #0 { entry: %1 = zext <vscale x 4 x i1> %0 to <vscale x 4 x i64> %2 = getelementptr [2 x i8], ptr null, i64 0, <vscale x 4 x i64> %1 %wide.masked.gather = tail call <vscale x 4 x i8> @llvm.masked.gather.nxv4i8.nxv4p0(<vscale x 4 x ptr> %2, i32 0, <vscale x 4 x i1> %0, <vscale x 4 x i8> zeroinitializer) tail call void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32> zeroinitializer, <vscale x 4 x ptr> zeroinitializer, i32 0, <vscale x 4 x i1> zeroinitializer) ret void } ; Function Attrs: nocallback nofree nosync nounwind willreturn memory(read) declare <vscale x 4 x i8> @llvm.masked.gather.nxv4i8.nxv4p0(<vscale x 4 x ptr>, i32 immarg, <vscale x 4 x i1>, <vscale x 4 x i8>) #1 ; Function Attrs: nocallback nofree nosync nounwind willreturn memory(write) declare void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32>, <vscale x 4 x ptr>, i32 immarg, <vscale x 4 x i1>) #2 attributes #0 = { "target-features"="+64bit,+v" } attributes #1 = { nocallback nofree nosync nounwind willreturn memory(read) } attributes #2 = { nocallback nofree nosync nounwind willreturn memory(write) } ``` Backtrace: ``` > /scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc bugpoint-reduced-simplified.ll PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace. Stack dump: 0. Program arguments: /scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc bugpoint-reduced-simplified.ll 1. Running pass 'Function Pass Manager' on module 'bugpoint-reduced-simplified.ll'. 2. Running pass 'RISC-V DAG->DAG Pattern Instruction Selection' on function '@main' #0 0x000055b76e342350 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x1c89350) #1 0x000055b76e33f75f llvm::sys::RunSignalHandlers() (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x1c8675f) #2 0x000055b76e33f8b5 SignalHandler(int) Signals.cpp:0:0 #3 0x00007f8457242520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520) #4 0x000055b76cd08cd3 llvm::RISCVDAGToDAGISel::Select(llvm::SDNode*) (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x64fcd3) #5 0x000055b76e0d44ba llvm::SelectionDAGISel::DoInstructionSelection() (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x1a1b4ba) #6 0x000055b76e0e239c llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x1a2939c) #7 0x000055b76e0e5fbf llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x1a2cfbf) #8 0x000055b76e0e7b35 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (.part.0) SelectionDAGISel.cpp:0:0 #9 0x000055b76d2cddf7 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0 #10 0x000055b76d8b6cee llvm::FPPassManager::runOnFunction(llvm::Function&) (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x11fdcee) #11 0x000055b76d8b6f39 llvm::FPPassManager::runOnModule(llvm::Module&) (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x11fdf39) #12 0x000055b76d8b78a5 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x11fe8a5) #13 0x000055b76cbebcda compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0 #14 0x000055b76cb4b7c6 main (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x4927c6) #15 0x00007f8457229d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #16 0x00007f8457229e40 call_init ./csu/../csu/libc-start.c:128:20 #17 0x00007f8457229e40 __libc_start_main ./csu/../csu/libc-start.c:379:5 #18 0x000055b76cbe2505 _start (/scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc+0x529505) zsh: segmentation fault (core dumped) /scratch/tc-testing/tc-feb-22-llvm/build/build-llvm-linux/bin/llc ``` Godbolt: https://godbolt.org/z/c8v8h9fxo Found via fuzzer

[topperc]

Looks like we create a gather with a vector of i1 index vector.

[topperc]

I think this will fix it

diff --git a/llvm/lib/Target/RISCV/RISCVISelLowering.cpp b/llvm/lib/Target/RISCV/RISCVISelLowering.cpp
index 7da074e055a7..2d5ca3341ab7 100644
--- a/llvm/lib/Target/RISCV/RISCVISelLowering.cpp
+++ b/llvm/lib/Target/RISCV/RISCVISelLowering.cpp
@@ -20044,7 +20044,8 @@ bool RISCVTargetLowering::shouldRemoveExtendFromGSIndex(SDValue Extend,
   // zero extended
   return Extend.getOpcode() == ISD::ZERO_EXTEND &&
     isTypeLegal(Extend.getValueType()) &&
-    isTypeLegal(Extend.getOperand(0).getValueType());
+    isTypeLegal(Extend.getOperand(0).getValueType()) &&
+    Extend.getOperand(0).getValueType().getVectorElementType() != MVT::i1;
 }

 bool RISCVTargetLowering::shouldConvertFpToSat(unsigned Op, EVT FPVT,

[topperc]

@lukel97 @yetingk @wangpc-pp any of you able to verify my proposed fix and make a PR?

[lukel97]

@topperc Will take a look now