Skip to content

[RISC-V] Assertion '!mi2iMap.contains(&MI) && "Instr already indexed."' failed #95865

@patrick-rivos

Description

@patrick-rivos

Reduced LLVM IR:

; ModuleID = 'reduced.ll'
source_filename = "reduced.ll"
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"

; Function Attrs: vscale_range(2,2)
define i32 @main(i1 %arg.1, i64 %arg.2, i1 %arg.3, i64 %arg.4, i1 %arg.5, <vscale x 4 x i1> %arg.6, i64 %arg.7, i1 %arg.8, i64 %arg.9, i32 %arg.10) #0 {
entry:
  %0 = tail call <vscale x 4 x i64> @llvm.experimental.stepvector.nxv4i64()
  br label %for.cond1.preheader.i

for.cond1.preheader.i:                            ; preds = %for.cond.cleanup3.i, %entry
  %arg.21 = phi i64 [ 0, %entry ], [ %indvars.iv.next74.i, %for.cond.cleanup3.i ]
  br label %for.cond5.preheader.i

for.cond5.preheader.i:                            ; preds = %for.cond.cleanup7.i, %for.cond1.preheader.i
  %arg.42 = phi i64 [ 0, %for.cond1.preheader.i ], [ %indvars.iv.next70.i, %for.cond.cleanup7.i ]
  %1 = add i64 %arg.42, %arg.21
  br label %for.cond9.preheader.i

for.cond.cleanup3.i:                              ; preds = %for.cond.cleanup7.i
  %indvars.iv.next74.i = add i64 %arg.21, 1
  br i1 %arg.3, label %l.exit, label %for.cond1.preheader.i

for.cond9.preheader.i:                            ; preds = %for.cond.cleanup11.i, %for.cond5.preheader.i
  %arg.74 = phi i64 [ 0, %for.cond5.preheader.i ], [ %indvars.iv.next66.i, %for.cond.cleanup11.i ]
  %2 = add i64 %1, %arg.74
  br label %vector.ph.i

for.cond.cleanup7.i:                              ; preds = %for.cond.cleanup11.i
  %indvars.iv.next70.i = add i64 %arg.42, 1
  br i1 %arg.5, label %for.cond.cleanup3.i, label %for.cond5.preheader.i

vector.ph.i:                                      ; preds = %for.cond.cleanup15.i, %for.cond9.preheader.i
  %arg.96 = phi i64 [ 0, %for.cond9.preheader.i ], [ %indvars.iv.next62.i, %for.cond.cleanup15.i ]
  %3 = add i64 %2, %arg.96
  %broadcast.splatinsert.i = insertelement <vscale x 4 x i64> zeroinitializer, i64 %3, i64 0
  %broadcast.splat.i = shufflevector <vscale x 4 x i64> %broadcast.splatinsert.i, <vscale x 4 x i64> zeroinitializer, <vscale x 4 x i32> zeroinitializer
  br label %vector.body.i

vector.body.i:                                    ; preds = %vector.body.i, %vector.ph.i
  %index.i = phi i64 [ 0, %vector.ph.i ], [ %index.next.i, %vector.body.i ]
  %vec.ind.i = phi <vscale x 4 x i64> [ %0, %vector.ph.i ], [ %6, %vector.body.i ]
  %4 = add <vscale x 4 x i64> %vec.ind.i, %broadcast.splat.i
  %5 = getelementptr [6 x i32], ptr null, i64 0, <vscale x 4 x i64> %4
  tail call void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32> zeroinitializer, <vscale x 4 x ptr> %5, i32 4, <vscale x 4 x i1> zeroinitializer)
  %6 = add <vscale x 4 x i64> %vec.ind.i, shufflevector (<vscale x 4 x i64> insertelement (<vscale x 4 x i64> poison, i64 1, i64 0), <vscale x 4 x i64> poison, <vscale x 4 x i32> zeroinitializer)
  %7 = getelementptr [6 x i32], ptr null, i64 0, <vscale x 4 x i64> %6
  tail call void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32> zeroinitializer, <vscale x 4 x ptr> %7, i32 4, <vscale x 4 x i1> zeroinitializer)
  %arg.100 = add <vscale x 4 x i64> %4, shufflevector (<vscale x 4 x i64> insertelement (<vscale x 4 x i64> poison, i64 2, i64 0), <vscale x 4 x i64> poison, <vscale x 4 x i32> zeroinitializer)
  %arg.101 = getelementptr [6 x i32], ptr null, i64 0, <vscale x 4 x i64> %arg.100
  tail call void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32> zeroinitializer, <vscale x 4 x ptr> %arg.101, i32 4, <vscale x 4 x i1> %arg.6)
  %arg.102 = add <vscale x 4 x i64> %4, shufflevector (<vscale x 4 x i64> insertelement (<vscale x 4 x i64> poison, i64 3, i64 0), <vscale x 4 x i64> poison, <vscale x 4 x i32> zeroinitializer)
  %arg.103 = getelementptr [6 x i32], ptr null, i64 0, <vscale x 4 x i64> %arg.102
  tail call void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32> zeroinitializer, <vscale x 4 x ptr> %arg.103, i32 4, <vscale x 4 x i1> zeroinitializer)
  %arg.104 = add <vscale x 4 x i64> %4, shufflevector (<vscale x 4 x i64> insertelement (<vscale x 4 x i64> poison, i64 1, i64 0), <vscale x 4 x i64> poison, <vscale x 4 x i32> zeroinitializer)
  %arg.105 = getelementptr [6 x i32], ptr null, i64 0, <vscale x 4 x i64> %arg.104
  tail call void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32> zeroinitializer, <vscale x 4 x ptr> %arg.105, i32 4, <vscale x 4 x i1> %arg.6)
  %arg.106 = add <vscale x 4 x i64> %4, shufflevector (<vscale x 4 x i64> insertelement (<vscale x 4 x i64> poison, i64 5, i64 0), <vscale x 4 x i64> poison, <vscale x 4 x i32> zeroinitializer)
  %arg.107 = getelementptr [6 x i32], ptr null, i64 0, <vscale x 4 x i64> %arg.106
  tail call void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32> zeroinitializer, <vscale x 4 x ptr> %arg.107, i32 4, <vscale x 4 x i1> zeroinitializer)
  %index.next.i = add i64 %index.i, 1
  %arg.108 = icmp eq i64 %index.i, 0
  br i1 %arg.108, label %for.cond.cleanup15.i, label %vector.body.i

for.cond.cleanup11.i:                             ; preds = %for.cond.cleanup15.i
  %indvars.iv.next66.i = add i64 %arg.74, 1
  br i1 %arg.3, label %for.cond.cleanup7.i, label %for.cond9.preheader.i

for.cond.cleanup15.i:                             ; preds = %vector.body.i
  %indvars.iv.next62.i = add i64 %arg.96, 1
  br i1 %arg.1, label %for.cond.cleanup11.i, label %vector.ph.i

l.exit:                                           ; preds = %for.cond.cleanup3.i
  tail call void null()
  br i1 %arg.1, label %for.body7.us.14, label %for.body7.us.19

for.body7.us.14:                                  ; preds = %for.body7.us.14, %l.exit
  br label %for.body7.us.14

for.body7.us.19:                                  ; preds = %l.exit
  %arg.109 = insertelement <32 x i32> zeroinitializer, i32 %arg.10, i64 1
  %8 = icmp ne <32 x i32> %arg.109, zeroinitializer
  %9 = bitcast <32 x i1> %8 to i32
  %op.rdx13 = icmp ne i32 %9, 0
  %op.rdx = zext i1 %op.rdx13 to i8
  store i8 %op.rdx, ptr null, align 1
  ret i32 0
}

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(none)
declare <vscale x 4 x i64> @llvm.experimental.stepvector.nxv4i64() #1

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(write)
declare void @llvm.masked.scatter.nxv4i32.nxv4p0(<vscale x 4 x i32>, <vscale x 4 x ptr>, i32 immarg, <vscale x 4 x i1>) #2

; uselistorder directives
uselistorder i64 0, { 0, 1, 13, 2, 3, 14, 4, 15, 5, 16, 6, 7, 8, 9, 10, 11, 12 }
uselistorder i64 1, { 0, 1, 2, 3, 6, 4, 5 }
uselistorder ptr @llvm.masked.scatter.nxv4i32.nxv4p0, { 5, 4, 3, 2, 1, 0 }

attributes #0 = { vscale_range(2,2) "target-features"="+64bit,+a,+c,+d,+f,+m,+relax,+v,+zicsr,+zifencei,+zve32f,+zve32x,+zve64d,+zve64f,+zve64x,+zvl128b,+zvl32b,+zvl64b,-b,-e,-experimental-smmpm,-experimental-smnpm,-experimental-ssnpm,-experimental-sspm,-experimental-ssqosid,-experimental-supm,-experimental-zalasr,-experimental-zfbfmin,-experimental-zicfilp,-experimental-zicfiss,-experimental-ztso,-experimental-zvfbfmin,-experimental-zvfbfwma,-h,-shcounterenw,-shgatpa,-shtvala,-shvsatpa,-shvstvala,-shvstvecd,-smaia,-smcdeleg,-smcsrind,-smepmp,-smstateen,-ssaia,-ssccfg,-ssccptr,-sscofpmf,-sscounterenw,-sscsrind,-ssstateen,-ssstrict,-sstc,-sstvala,-sstvecd,-ssu64xl,-svade,-svadu,-svbare,-svinval,-svnapot,-svpbmt,-xcvalu,-xcvbi,-xcvbitmanip,-xcvelw,-xcvmac,-xcvmem,-xcvsimd,-xsfcease,-xsfvcp,-xsfvfnrclipxfqf,-xsfvfwmaccqqq,-xsfvqmaccdod,-xsfvqmaccqoq,-xsifivecdiscarddlone,-xsifivecflushdlone,-xtheadba,-xtheadbb,-xtheadbs,-xtheadcmo,-xtheadcondmov,-xtheadfmemidx,-xtheadmac,-xtheadmemidx,-xtheadmempair,-xtheadsync,-xtheadvdot,-xventanacondops,-za128rs,-za64rs,-zaamo,-zabha,-zacas,-zalrsc,-zama16b,-zawrs,-zba,-zbb,-zbc,-zbkb,-zbkc,-zbkx,-zbs,-zca,-zcb,-zcd,-zce,-zcf,-zcmop,-zcmp,-zcmt,-zdinx,-zfa,-zfh,-zfhmin,-zfinx,-zhinx,-zhinxmin,-zic64b,-zicbom,-zicbop,-zicboz,-ziccamoa,-ziccif,-zicclsm,-ziccrse,-zicntr,-zicond,-zihintntl,-zihintpause,-zihpm,-zimop,-zk,-zkn,-zknd,-zkne,-zknh,-zkr,-zks,-zksed,-zksh,-zkt,-zmmul,-zvbb,-zvbc,-zvfh,-zvfhmin,-zvkb,-zvkg,-zvkn,-zvknc,-zvkned,-zvkng,-zvknha,-zvknhb,-zvks,-zvksc,-zvksed,-zvksg,-zvksh,-zvkt,-zvl1024b,-zvl16384b,-zvl2048b,-zvl256b,-zvl32768b,-zvl4096b,-zvl512b,-zvl65536b,-zvl8192b" }
attributes #1 = { nocallback nofree nosync nounwind willreturn memory(none) }
attributes #2 = { nocallback nofree nosync nounwind willreturn memory(write) }

Godbolt:
https://godbolt.org/z/P6dMnn19q

Backtrace:

> /scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc reduced.ll
llc: /scratch/tc-testing/tc-jun-17/llvm/llvm/include/llvm/CodeGen/SlotIndexes.h:526: llvm::SlotIndex llvm::SlotIndexes::insertMachineInstrInMaps(llvm::MachineInstr&, bool): Assertion `!mi2iMap.contains(&MI) && "Instr already indexed."' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc reduced.ll
1.      Running pass 'Function Pass Manager' on module 'reduced.ll'.
2.      Running pass 'Greedy Register Allocator' on function '@main'
 #0 0x00005d61c398a7e0 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc+0x1d5e7e0)
 #1 0x00005d61c3987bef llvm::sys::RunSignalHandlers() (/scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc+0x1d5bbef)
 #2 0x00005d61c3987d45 SignalHandler(int) Signals.cpp:0:0
 #3 0x000076be14242520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x000076be142969fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x000076be142969fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x000076be142969fc pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x000076be14242476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x000076be142287f3 abort ./stdlib/abort.c:81:7
 #9 0x000076be1422871b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x000076be14239e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x00005d61c22cbc78 llvm::SlotIndexes::insertMachineInstrInMaps(llvm::MachineInstr&, bool) (/scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc+0x69fc78)
#12 0x00005d61c2cd906a (anonymous namespace)::InlineSpiller::spill(llvm::LiveRangeEdit&) InlineSpiller.cpp:0:0
#13 0x00005d61c2a96b00 llvm::RAGreedy::selectOrSplitImpl(llvm::LiveInterval const&, llvm::SmallVectorImpl<llvm::Register>&, llvm::SmallSet<llvm::Register, 16u, std::less<llvm::Register>>&, llvm::SmallVector<std::pair<llvm::LiveInterval const*, llvm::MCRegister>, 8u>&, unsigned int) (/scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc+0xe6ab00)
#14 0x00005d61c2a98978 llvm::RAGreedy::selectOrSplit(llvm::LiveInterval const&, llvm::SmallVectorImpl<llvm::Register>&) (/scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc+0xe6c978)
#15 0x00005d61c2d21e47 llvm::RegAllocBase::allocatePhysRegs() (/scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc+0x10f5e47)
#16 0x00005d61c2a94e13 llvm::RAGreedy::runOnMachineFunction(llvm::MachineFunction&) (/scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc+0xe68e13)
#17 0x00005d61c28c1917 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#18 0x00005d61c2ed4476 llvm::FPPassManager::runOnFunction(llvm::Function&) (/scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc+0x12a8476)
#19 0x00005d61c2ed46c9 llvm::FPPassManager::runOnModule(llvm::Module&) (/scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc+0x12a86c9)
#20 0x00005d61c2ed5035 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc+0x12a9035)
#21 0x00005d61c21c97de compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0
#22 0x00005d61c211295e main (/scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc+0x4e695e)
#23 0x000076be14229d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#24 0x000076be14229e40 call_init ./csu/../csu/libc-start.c:128:20
#25 0x000076be14229e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#26 0x00005d61c21c0085 _start (/scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc+0x594085)
zsh: IOT instruction (core dumped)  /scratch/tc-testing/tc-jun-17/build-rv64gcv/build-llvm-linux/bin/llc

Found via fuzzer.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions