<html>
<head>
<base href="https://llvm.org/bugs/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - llvm.eh.sjlj.setjmp builtin lowering may result in a compiler crash in pic mode"
href="https://llvm.org/bugs/show_bug.cgi?id=26742">26742</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>llvm.eh.sjlj.setjmp builtin lowering may result in a compiler crash in pic mode
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Backend: X86
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>qcolombet@apple.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=15947" name="attach_15947" title="Reproducer">attachment 15947</a> <a href="attachment.cgi?id=15947&action=edit" title="Reproducer">[details]</a></span>
Reproducer
Lowering of the llvm.eh.sjlj.setjmp builtin on i386 may result in a compiler
crash in pic mode.
The problem is that in this particular mode, the builtin needs to access the
global base reg which is never set. We thus ended up with a use of a virtual
register without any definition.
The definition of the global base reg is supposed to be interested by the CGBR
pass. However, by the time we run this pass (right after ISel), we do not know
we needed it and the pass does nothing.
We actually discover that we need the global base reg when we do the expansion
of the pseudo instruction a little bit after isel, which is too late.
To reproduce:
llc test.ll -relocation-model=pic -verify-machineinstrs
Result:
# After Expand ISel Pseudo-instructions
# Machine code for function test: SSA
Frame Objects:
fi#-1: size=4, align=16, fixed, at location [SP+4]
BB#0: derived from LLVM BB %entry
%vreg0<def> = MOV32rm <fi#-1>, 1, %noreg, 0, %noreg;
mem:LD4[FixedStack-1](align=16) GR32:%vreg0
%vreg4<def> = LEA32r %vreg5, 0, %noreg, <BB#3>[TF=2], %noreg; GR32:%vreg4
GR32_NOSP:%vreg5
MOV32mr %vreg0<kill>, 1, %noreg, 4, %noreg, %vreg4; GR32:%vreg0,%vreg4
EH_SjLj_Setup <BB#3>, <regmask>
Successors according to CFG: BB#1(?%) BB#3(?%)
BB#1: derived from LLVM BB %entry
Predecessors according to CFG: BB#0
%vreg2<def> = MOV32r0 %EFLAGS<imp-def>; GR32:%vreg2
Successors according to CFG: BB#2(?%)
BB#2: derived from LLVM BB %entry
Predecessors according to CFG: BB#1 BB#3
%vreg1<def> = PHI %vreg2, <BB#1>, %vreg3, <BB#3>; GR32:%vreg1,%vreg2,%vreg3
%EAX<def> = COPY %vreg1; GR32:%vreg1
RETL %EAX
BB#3: derived from LLVM BB %entry, ADDRESS TAKEN
Predecessors according to CFG: BB#0
%vreg3<def> = MOV32ri 1; GR32:%vreg3
JMP_1 <BB#2>
Successors according to CFG: BB#2(?%)
# End machine code for function test.
*** Bad machine code: Reading virtual register without a def ***
- function: test
- basic block: BB#0 entry (0x7fb8c184b5d8)
- instruction: %vreg4<def> = LEA32r
- operand 1: %vreg5
LLVM ERROR: Found 1 machine code errors.
Note:
Without the verifier report, you get random crashes in passes that try to
access the definition of vreg5.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>