[X86][CodeGen][GlobalISel] Crash: Unable to copy EFLAGS physical register!

[nmosier]

llc's X86 backend crashes (branch release/19.x) when Global ISel is enabled for the following LLVM IR (reduced using bugpoint):

define dso_local void @bitmap_clear_range(i32 %0) local_unnamed_addr #0 {
  br label %.critedge

.critedge:                                        ; preds = %21, %1
  %2 = getelementptr inbounds i8, ptr null, i64 16
  %3 = load i32, ptr %2, align 8
  %4 = shl nuw i32 %3, 7
  %5 = add i32 %4, 128
  %6 = icmp ult i32 %4, %0
  %7 = icmp ugt i32 %5, 0
  %8 = or i1 %6, %7
  br i1 %8, label %9, label %21

9:                                                ; preds = %.critedge
  %10 = icmp ugt i32 %4, %0
  %11 = sub i32 %0, %4
  %12 = lshr i32 %11, 6
  %13 = select i1 %10, i32 0, i32 %12
  %14 = select i1 %7, i32 0, i32 1
  %15 = icmp eq i32 %13, %14
  br i1 %15, label %17, label %16

16:                                               ; preds = %9
  store i64 poison, ptr null, align 8
  br label %17

17:                                               ; preds = %16, %9
  %18 = phi i32 [ %14, %16 ], [ %13, %9 ]
  %19 = zext nneg i32 %18 to i64
  %20 = getelementptr inbounds [2 x i64], ptr null, i64 0, i64 %19
  store i64 0, ptr %20, align 8
  br label %21

21:                                               ; preds = %17, %.critedge
  %22 = icmp eq ptr null, null
  br i1 %22, label %23, label %.critedge

23:                                               ; preds = %21
  ret void
}

Save the above file to bug.ll, then reproduce with the following command on an x86 host:
llc --global-isel bug.ll
This crashes with the following backtrace:

LLVM ERROR: Unable to copy EFLAGS physical register!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: ./bin/llc --global-isel bug.ll
1.	Running pass 'Function Pass Manager' on module 'bug.ll'.
2.	Running pass 'Post-RA pseudo instruction expansion pass' on function '@bitmap_clear_range'
 #0 0x000055fb6b3bb510 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (./bin/llc+0x360b510)
 #1 0x000055fb6b3b8aee SignalHandler(int) Signals.cpp:0:0
 #2 0x00007f3df3d6e520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00007f3df3dc29fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #4 0x00007f3df3dc29fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #5 0x00007f3df3dc29fc pthread_kill ./nptl/pthread_kill.c:89:10
 #6 0x00007f3df3d6e476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #7 0x00007f3df3d547f3 abort ./stdlib/abort.c:81:7
 #8 0x000055fb683c6f59 llvm::DisplayGraph(llvm::StringRef, bool, llvm::GraphProgram::Name) (.cold) GraphWriter.cpp:0:0
 #9 0x000055fb6b30d0ae (./bin/llc+0x355d0ae)
#10 0x000055fb69b65759 llvm::X86InstrInfo::copyPhysReg(llvm::MachineBasicBlock&, llvm::MachineInstrBundleIterator<llvm::MachineInstr, false>, llvm::DebugLoc const&, llvm::MCRegister, llvm::MCRegister, bool) const (./bin/llc+0x1db5759)
#11 0x000055fb6a70294d llvm::TargetInstrInfo::lowerCopy(llvm::MachineInstr*, llvm::TargetRegisterInfo const*) const (./bin/llc+0x295294d)
#12 0x000055fb6a3234b8 (anonymous namespace)::ExpandPostRA::runOnMachineFunction(llvm::MachineFunction&) ExpandPostRAPseudos.cpp:0:0
#13 0x000055fb6a46660f llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#14 0x000055fb6a9be29a llvm::FPPassManager::runOnFunction(llvm::Function&) (./bin/llc+0x2c0e29a)
#15 0x000055fb6a9be424 llvm::FPPassManager::runOnModule(llvm::Module&) (./bin/llc+0x2c0e424)
#16 0x000055fb6a9bee51 llvm::legacy::PassManagerImpl::run(llvm::Module&) (./bin/llc+0x2c0ee51)
#17 0x000055fb684e986f compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0
#18 0x000055fb683d94e6 main (./bin/llc+0x6294e6)
#19 0x00007f3df3d55d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#20 0x00007f3df3d55e40 call_init ./csu/../csu/libc-start.c:128:20
#21 0x00007f3df3d55e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#22 0x000055fb684e0e25 _start (./bin/llc+0x730e25)

[llvmbot]

@llvm/issue-subscribers-backend-x86

Author: Nicholas Mosier (nmosier)

`llc`'s X86 backend crashes (branch release/19.x) when Global ISel is enabled for the following LLVM IR (reduced using bugpoint): ``` define dso_local void @bitmap_clear_range(i32 %0) local_unnamed_addr #0 { br label %.critedge

.critedge: ; preds = %21, %1
%2 = getelementptr inbounds i8, ptr null, i64 16
%3 = load i32, ptr %2, align 8
%4 = shl nuw i32 %3, 7
%5 = add i32 %4, 128
%6 = icmp ult i32 %4, %0
%7 = icmp ugt i32 %5, 0
%8 = or i1 %6, %7
br i1 %8, label %9, label %21

9: ; preds = %.critedge
%10 = icmp ugt i32 %4, %0
%11 = sub i32 %0, %4
%12 = lshr i32 %11, 6
%13 = select i1 %10, i32 0, i32 %12
%14 = select i1 %7, i32 0, i32 1
%15 = icmp eq i32 %13, %14
br i1 %15, label %17, label %16

16: ; preds = %9
store i64 poison, ptr null, align 8
br label %17

17: ; preds = %16, %9
%18 = phi i32 [ %14, %16 ], [ %13, %9 ]
%19 = zext nneg i32 %18 to i64
%20 = getelementptr inbounds [2 x i64], ptr null, i64 0, i64 %19
store i64 0, ptr %20, align 8
br label %21

21: ; preds = %17, %.critedge
%22 = icmp eq ptr null, null
br i1 %22, label %23, label %.critedge

23: ; preds = %21
ret void
}

Save the above file to `bug.ll`, then reproduce with the following command on an x86 host:
`llc --global-isel bug.ll`
This crashes with the following backtrace:

LLVM ERROR: Unable to copy EFLAGS physical register!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0. Program arguments: ./bin/llc --global-isel bug.ll

1. Running pass 'Function Pass Manager' on module 'bug.ll'.
2. Running pass 'Post-RA pseudo instruction expansion pass' on function '@bitmap_clear_range'
   #0 0x000055fb6b3bb510 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (./bin/llc+0x360b510)
   #1 0x000055fb6b3b8aee SignalHandler(int) Signals.cpp:0:0
   #2 0x00007f3df3d6e520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
   #3 0x00007f3df3dc29fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
   #4 0x00007f3df3dc29fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
   #5 0x00007f3df3dc29fc pthread_kill ./nptl/pthread_kill.c:89:10
   #6 0x00007f3df3d6e476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
   #7 0x00007f3df3d547f3 abort ./stdlib/abort.c:81:7
   #8 0x000055fb683c6f59 llvm::DisplayGraph(llvm::StringRef, bool, llvm::GraphProgram::Name) (.cold) GraphWriter.cpp:0:0
   #9 0x000055fb6b30d0ae (./bin/llc+0x355d0ae)
   #10 0x000055fb69b65759 llvm::X86InstrInfo::copyPhysReg(llvm::MachineBasicBlock&, llvm::MachineInstrBundleIterator<llvm::MachineInstr, false>, llvm::DebugLoc const&, llvm::MCRegister, llvm::MCRegister, bool) const (./bin/llc+0x1db5759)
   #11 0x000055fb6a70294d llvm::TargetInstrInfo::lowerCopy(llvm::MachineInstr*, llvm::TargetRegisterInfo const*) const (./bin/llc+0x295294d)
   #12 0x000055fb6a3234b8 (anonymous namespace)::ExpandPostRA::runOnMachineFunction(llvm::MachineFunction&) ExpandPostRAPseudos.cpp:0:0
   #13 0x000055fb6a46660f llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
   #14 0x000055fb6a9be29a llvm::FPPassManager::runOnFunction(llvm::Function&) (./bin/llc+0x2c0e29a)
   #15 0x000055fb6a9be424 llvm::FPPassManager::runOnModule(llvm::Module&) (./bin/llc+0x2c0e424)
   #16 0x000055fb6a9bee51 llvm::legacy::PassManagerImpl::run(llvm::Module&) (./bin/llc+0x2c0ee51)
   #17 0x000055fb684e986f compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0
   #18 0x000055fb683d94e6 main (./bin/llc+0x6294e6)
   #19 0x00007f3df3d55d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
   #20 0x00007f3df3d55e40 call_init ./csu/../csu/libc-start.c:128:20
   #21 0x00007f3df3d55e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
   #22 0x000055fb684e0e25 _start (./bin/llc+0x730e25)

</details>

[RKSimon]

x86 GlobalISel is not ready for use, we do try to avoid crashes and make it fallback to SelectionDAG as much as possible, but I would not expect it to run properly for anything but the most basic (probably branchless) code snippets.

[e-kud]

Known issue. The smaller reproducer is

define i16 @foo(i16 %2) {
  %4 = call { i16, i1 } @llvm.uadd.with.overflow.i16(i16 %2, i16 1)
  %5 = extractvalue { i16, i1 } %4, 0
  %6 = extractvalue { i16, i1 } %4, 1
  %7 = select i1 %6, i16 %2, i16 %5
  ret i16 %7
}

The same we see in the code above after some optimization

...
9:                                                ; preds = %.critedge
  %10 = icmp ugt i32 %5, 0
  %11 = call { i32, i1 } @llvm.usub.with.overflow.i32(i32 %0, i32 %4)
  %math = extractvalue { i32, i1 } %11, 0
  %ov = extractvalue { i32, i1 } %11, 1
...

The workaround I temporary apply is

--- a/llvm/lib/Target/X86/GISel/X86LegalizerInfo.cpp
+++ b/llvm/lib/Target/X86/GISel/X86LegalizerInfo.cpp
@@ -154,16 +154,6 @@ X86LegalizerInfo::X86LegalizerInfo(const X86Subtarget &STI,
       .clampScalar(0, s8, sMaxScalar)
       .scalarize(0);

-  getActionDefinitionsBuilder({G_UADDE, G_UADDO, G_USUBE, G_USUBO})
-      .legalIf([=](const LegalityQuery &Query) -> bool {
-        return typePairInSet(0, 1, {{s8, s1}, {s16, s1}, {s32, s1}})(Query) ||
-               (Is64Bit && typePairInSet(0, 1, {{s64, s1}})(Query));
-      })
-      .widenScalarToNextPow2(0, /*Min=*/32)
-      .clampScalar(0, s8, sMaxScalar)
-      .clampScalar(1, s1, s1)
-      .scalarize(0);
-
   // integer multiply
   getActionDefinitionsBuilder(G_MUL)
       .legalIf([=](const LegalityQuery &Query) -> bool {