<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [PPC] if-converter triggers assertion `!NodePtr->isKnownSentinel()`"
href="https://bugs.llvm.org/show_bug.cgi?id=36825">36825</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[PPC] if-converter triggers assertion `!NodePtr->isKnownSentinel()`
</td>
</tr>
<tr>
<th>Product</th>
<td>new-bugs
</td>
</tr>
<tr>
<th>Version</th>
<td>6.0
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>new bugs
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>v.churavy@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>Found while upgrading the Julia frontend to LLVM 6.0.
```
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/include/llvm/ADT/ilist_iterator.h:140:
llvm::ilist_iterator<OptionsT, IsReverse, IsConst>::reference
llvm::ilist_iterator<OptionsT, IsReverse, IsConst>::operator*() const [with
OptionsT = llvm::ilist_detail::node_options<llvm::MachineInstr, true, true,
void>; bool IsReverse = false; bool IsConst = false;
llvm::ilist_iterator<OptionsT, IsReverse, IsConst>::reference =
llvm::MachineInstr&]: Assertion `!NodePtr->isKnownSentinel()' failed.
signal (6): Aborted
in expression starting at sysimg.jl:213
gsignal at /lib64/libc.so.6 (unknown line)
abort at /lib64/libc.so.6 (unknown line)
__assert_fail_base at /lib64/libc.so.6 (unknown line)
__assert_fail at /lib64/libc.so.6 (unknown line)
operator* at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/include/llvm/ADT/ilist_iterator.h:140
operator* at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/include/llvm/CodeGen/MachineInstrBundleIterator.h:134
[inlined]
operator* at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/include/llvm/CodeGen/MachineInstrBundleIterator.h:179
[inlined]
operator-> at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/include/llvm/CodeGen/MachineInstrBundleIterator.h:180
[inlined]
IfConvertDiamondCommon at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/CodeGen/IfConversion.cpp:1726
IfConvertDiamond at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/CodeGen/IfConversion.cpp:1910
[inlined]
runOnMachineFunction at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/CodeGen/IfConversion.cpp:461
runOnFunction at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/CodeGen/MachineFunctionPass.cpp:62
runOnFunction at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/IR/LegacyPassManager.cpp:1520
runOnModule at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/IR/LegacyPassManager.cpp:1541
run at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/IR/LegacyPassManager.cpp:1597
run at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/IR/LegacyPassManager.cpp:1731
operator() at /raid1/home/ibm/valentin/src/julia/src/jitlayers.cpp:466
Allocations: 43736398 (Pool: 43715287; Big: 21111); GC: 111
```
I am failing to isolate this failure for the last two weeks (also see
<a href="http://lists.llvm.org/pipermail/llvm-dev/2018-March/121932.html">http://lists.llvm.org/pipermail/llvm-dev/2018-March/121932.html</a>)
I nailed it down to the function `japi1__require_7687` (in gdb `MF->getName`)
and I put the log online (124MB)
<a href="https://drive.google.com/open?id=1Br0s9Qvr4tzPv8nqbnV_nWezpEH5Ci7B">https://drive.google.com/open?id=1Br0s9Qvr4tzPv8nqbnV_nWezpEH5Ci7B</a>
The setup of the target machine is roughly equivalent to:
```
llc -O3 -fast-isel=0 -code-model=medium -mcpu=pwr8 -relocation-model=static
-emulated-tls
```
and the last Julia specific pass in the log is LowerPTLS. So a pipeline
starting from `bool-ret-to-int` should be able to re-trigger the assertion, but
to no avail.
I compared the output of `debug-pass=Arguments` and the only difference between
the pipeline used by `llc` and `julia` post `bool-ret-to-int` is:
```
llc: -basicaa -aa -loops -branch-prob -isel -machinedomtree
-ppc-ctr-loops-verify -ppc-vsx-copy -expand-isel-pseudos
Julia: -basicaa -aa -loops -branch-prob -machinedomtree -ppc-ctr-loops-verify
-ppc-vsx-copy -expand-isel-pseudos
```
Note the additional `isel` in the llc pipeline that is missing in Julia, but I
can't find a reason why that would be true.
Some other breadcrumps:
```
Ifcvt: function (4486) 'japi1__require_7687'
Ifcvt (Diamond): %bb.38 (T:44,F:39)
(gdb) p BBI.BB->dump()
%bb.38: derived from LLVM BB %L762
Live Ins: %x23
Predecessors according to CFG: %bb.37
renamable %x3 = LD 504, %x31; mem:Volatile
LD8[%"#temp#15"](dereferenceable) dbg:loading.jl:1024
renamable %x4 = XORI8 renamable %x3, 1; dbg:loading.jl:1024
renamable %cr0 = CMPLDI renamable %x3, 1; dbg:loading.jl:1024
renamable %x4 = CNTLZD killed renamable %x4; dbg:loading.jl:1024
renamable %x4 = RLDICL killed renamable %x4, 58, 63;
dbg:loading.jl:1024
STD killed renamable %x3, 1352, %x31; mem:ST8[%33] dbg:loading.jl:1024
STB renamable %r4, 1351, %x31, implicit killed %x4; mem:ST1[%34]
dbg:loading.jl:1024
renamable %x3 = ADDIStocHA %x2, @"jl_global#10"; dbg:loading.jl:1024
renamable %x3 = LDtocL @"jl_global#10", killed renamable %x3, implicit
%x2; mem:LD8[GOT] dbg:loading.jl:1024
Successors according to CFG: %bb.39(0x40000000 / 0x80000000 = 50.00%)
%bb.44(0x40000000 / 0x80000000 = 50.00%)
```</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>