[llvm-bugs] [Bug 31486] New: Faulty expansion of UMAX/SMAX/UMIN/SMIN in ExpandIntRes_MINMAX

[via llvm-bugs]

https://llvm.org/bugs/show_bug.cgi?id=31486

            Bug ID: 31486
           Summary: Faulty expansion of UMAX/SMAX/UMIN/SMIN in
                    ExpandIntRes_MINMAX
           Product: new-bugs
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: new bugs
          Assignee: unassignedbugs at nondot.org
          Reporter: mikael.holmen at ericsson.com
                CC: llvm-bugs at lists.llvm.org
    Classification: Unclassified

Created attachment 17785
  --> https://llvm.org/bugs/attachment.cgi?id=17785&action=edit
r600 mir reproducer

Originally found for an out-of-tree target.

Debug printouts show

SelectionDAG has 14 nodes:
  t0: ch = EntryToken
              t2: i32,ch = CopyFromReg t0, Register:i32 %vreg0
            t5: i32,ch = CopyFromReg t2:1, Register:i32 %vreg1
          t7: i32 = AssertSext t5, ValueType:ch:i8
        t8: i64 = build_pair t7, Constant:i32<0>
      t12: i64 = umax t8, Constant:i64<4>
    t15: ch = store<ST4[undef](align=1)> t0, t12, undef:i16, undef:i16
  t16: ch = PHXISD::RETURN t15

and then

Expand integer result: t12: i64 = umax t8, Constant:i64<4>

and

Legally typed node: t18: i32,i32 = umax Constant:i32<0>, Constant:i32<0>
Legally typed node: t23: i32,i32 = umax t7, Constant:i32<4>

so the i64 umax has ben expanded into two i32, i32 umax:es.

I would instead have expected two i32 umax.

So we get

Type-legalized selection DAG: BB#3 'func_37:bb11'
SelectionDAG has 16 nodes:
  t0: ch = EntryToken
        t18: i32,i32 = umax Constant:i32<0>, Constant:i32<0>
      t24: ch = store<ST2[undef](align=1)> t0, t18, undef:i16, undef:i16
              t2: i32,ch = CopyFromReg t0, Register:i32 %vreg0
            t5: i32,ch = CopyFromReg t2:1, Register:i32 %vreg1
          t7: i32 = AssertSext t5, ValueType:ch:i8
        t23: i32,i32 = umax t7, Constant:i32<4>
      t26: ch = store<ST2[undef+2](align=1)> t0, t23, undef:i16, undef:i16
    t27: ch = TokenFactor t24, t26
  t16: ch = PHXISD::RETURN t27

and shortly after this we get a failing assertion

llc: ../lib/CodeGen/SelectionDAG/DAGCombiner.cpp:1363: void (anonymous
namespace)::DAGCombiner::Run(llvm::CombineLevel): Assertion `N->getValueType(0)
== RV.getValueType() && N->getNumValues() == 1 && "Type mismatch"' failed.
#0 0x0000000001b1c398 llvm::sys::PrintStackTrace(llvm::raw_ostream&)
(/data/repo/llvm-dev2/build-all/./bin/llc+0x1b1c398)
#1 0x0000000001b1cf36 SignalHandler(int)
(/data/repo/llvm-dev2/build-all/./bin/llc+0x1b1cf36)
#2 0x00007f5e4c855330 __restore_rt
(/lib/x86_64-linux-gnu/libpthread.so.0+0x10330)
#3 0x00007f5e4b448c37 gsignal
/build/eglibc-oGUzwX/eglibc-2.19/signal/../nptl/sysdeps/unix/sysv/linux/raise.c:56:0
#4 0x00007f5e4b44c028 abort
/build/eglibc-oGUzwX/eglibc-2.19/stdlib/abort.c:91:0
#5 0x00007f5e4b441bf6 __assert_fail_base
/build/eglibc-oGUzwX/eglibc-2.19/assert/assert.c:92:0
#6 0x00007f5e4b441ca2 (/lib/x86_64-linux-gnu/libc.so.6+0x2fca2)
#7 0x0000000001889210 llvm::SelectionDAG::Combine(llvm::CombineLevel,
llvm::AAResults&, llvm::CodeGenOpt::Level)
(/data/repo/llvm-dev2/build-all/./bin/llc+0x1889210)
#8 0x00000000019e07d4 llvm::SelectionDAGISel::CodeGenAndEmitDAG()
(/data/repo/llvm-dev2/build-all/./bin/llc+0x19e07d4)
#9 0x00000000019dec58
llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&)
(/data/repo/llvm-dev2/build-all/./bin/llc+0x19dec58)
#10 0x00000000019db4db
llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&)
(/data/repo/llvm-dev2/build-all/./bin/llc+0x19db4db)

and here we have

(gdb) call N->dump()
t18: i32,i32 = umax Constant:i32<0>, Constant:i32<0>
(gdb) call RV.dump()
t3: i32 = Constant<0>
(gdb)

Changing

  // Hi part is always the same op
  Hi = DAG.getNode(N->getOpcode(), DL, {NVT, NVT}, {LHSH, RHSH});
into
  // Hi part is always the same op
  Hi = DAG.getNode(N->getOpcode(), DL, NVT, {LHSH, RHSH});
and 
  // Recursed Lo part if Hi parts are equal, this uses unsigned version
  SDValue LoMinMax = DAG.getNode(LoOpc, DL, {NVT, NVT}, {LHSL, RHSL});
into
  // Recursed Lo part if Hi parts are equal, this uses unsigned version
  SDValue LoMinMax = DAG.getNode(LoOpc, DL, NVT, {LHSL, RHSL});

makes the crash go away, and no test cases under test fail.

Can also be reproduced on r600/cypress with
llc -march=r600 -mcpu=cypress -start-after safe-stack foo.mir

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20161228/6e3998de/attachment.html>