<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - 'Assertion `isa<X>(Val) && "cast<Ty>() argument of incompatible type!"' failed.' with -indvars -loop-instsimplify -loop-reduce"
href="https://bugs.llvm.org/show_bug.cgi?id=37936">37936</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>'Assertion `isa<X>(Val) && "cast<Ty>() argument of incompatible type!"' failed.' with -indvars -loop-instsimplify -loop-reduce
</td>
</tr>
<tr>
<th>Product</th>
<td>new-bugs
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>new bugs
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>mikael.holmen@ericsson.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=20467" name="attach_20467" title="reproducer">attachment 20467</a> <a href="attachment.cgi?id=20467&action=edit" title="reproducer">[details]</a></span>
reproducer
Running
opt -S -o - bbi-15634.ll -indvars -loop-instsimplify -loop-reduce
crashes with
opt: ../include/llvm/Support/Casting.h:255: typename cast_retty<X, Y
*>::ret_type llvm::cast(Y *) [X = llvm::Instruction, Y = llvm::Value]:
Assertion `isa<X>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
Stack dump:
0. Program arguments: /data/repo/llvm-patch/build-all/bin/opt -S -o -
bbi-15634.ll -indvars -verify -loop-instsimplify -verify -loop-reduce
1. Running pass 'Function Pass Manager' on module 'bbi-15634.ll'.
2. Running pass 'Loop Pass Manager' on function '@f1'
3. Running pass 'Loop Strength Reduction' on basic block '%for.cond'
#0 0x0000000001ff4ac4 PrintStackTraceSignalHandler(void*)
(/data/repo/llvm-patch/build-all/bin/opt+0x1ff4ac4)
#1 0x0000000001ff2d30 llvm::sys::RunSignalHandlers()
(/data/repo/llvm-patch/build-all/bin/opt+0x1ff2d30)
#2 0x0000000001ff4e28 SignalHandler(int)
(/data/repo/llvm-patch/build-all/bin/opt+0x1ff4e28)
#3 0x00007f1a4d86f330 __restore_rt
(/lib/x86_64-linux-gnu/libpthread.so.0+0x10330)
#4 0x00007f1a4c45ec37 gsignal
/build/eglibc-ripdx6/eglibc-2.19/signal/../nptl/sysdeps/unix/sysv/linux/raise.c:56:0
#5 0x00007f1a4c462028 abort
/build/eglibc-ripdx6/eglibc-2.19/stdlib/abort.c:91:0
#6 0x00007f1a4c457bf6 __assert_fail_base
/build/eglibc-ripdx6/eglibc-2.19/assert/assert.c:92:0
#7 0x00007f1a4c457ca2 (/lib/x86_64-linux-gnu/libc.so.6+0x2fca2)
#8 0x00000000015e6b71
llvm::SCEVExpander::getAddRecExprPHILiterally(llvm::SCEVAddRecExpr const*,
llvm::Loop const*, llvm::Type*, llvm::Type*, llvm::Type*&, bool&)
(/data/repo/llvm-patch/build-all/bin/opt+0x15e6b71)
#9 0x00000000015e7237
llvm::SCEVExpander::expandAddRecExprLiterally(llvm::SCEVAddRecExpr const*)
(/data/repo/llvm-patch/build-all/bin/opt+0x15e7237)
#10 0x00000000015e2ce3 llvm::SCEVExpander::expand(llvm::SCEV const*)
(/data/repo/llvm-patch/build-all/bin/opt+0x15e2ce3)
#11 0x00000000015e22d9 llvm::SCEVExpander::expandCodeFor(llvm::SCEV const*,
llvm::Type*) (/data/repo/llvm-patch/build-all/bin/opt+0x15e22d9)
#12 0x0000000001e69f87 (anonymous namespace)::LSRInstance::Expand((anonymous
namespace)::LSRUse const&, (anonymous namespace)::LSRFixup const&, (anonymous
namespace)::Formula const&,
llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::Instruction, true,
false, void>, false, false>, llvm::SCEVExpander&,
llvm::SmallVectorImpl<llvm::WeakTrackingVH>&) const
(/data/repo/llvm-patch/build-all/bin/opt+0x1e69f87)
#13 0x0000000001e5b98e (anonymous
namespace)::LSRInstance::LSRInstance(llvm::Loop*, llvm::IVUsers&,
llvm::ScalarEvolution&, llvm::DominatorTree&, llvm::LoopInfo&,
llvm::TargetTransformInfo const&)
(/data/repo/llvm-patch/build-all/bin/opt+0x1e5b98e)
#14 0x0000000001e545fa ReduceLoopStrength(llvm::Loop*, llvm::IVUsers&,
llvm::ScalarEvolution&, llvm::DominatorTree&, llvm::LoopInfo&,
llvm::TargetTransformInfo const&)
(/data/repo/llvm-patch/build-all/bin/opt+0x1e545fa)
#15 0x0000000001e5514f (anonymous
namespace)::LoopStrengthReduce::runOnLoop(llvm::Loop*, llvm::LPPassManager&)
(/data/repo/llvm-patch/build-all/bin/opt+0x1e5514f)
#16 0x00000000015301e5 llvm::LPPassManager::runOnFunction(llvm::Function&)
(/data/repo/llvm-patch/build-all/bin/opt+0x15301e5)
#17 0x0000000001a7c2ba llvm::FPPassManager::runOnFunction(llvm::Function&)
(/data/repo/llvm-patch/build-all/bin/opt+0x1a7c2ba)
#18 0x0000000001a7c518 llvm::FPPassManager::runOnModule(llvm::Module&)
(/data/repo/llvm-patch/build-all/bin/opt+0x1a7c518)
#19 0x0000000001a7ca4d llvm::legacy::PassManagerImpl::run(llvm::Module&)
(/data/repo/llvm-patch/build-all/bin/opt+0x1a7ca4d)
#20 0x0000000000745e8c main (/data/repo/llvm-patch/build-all/bin/opt+0x745e8c)
#21 0x00007f1a4c449f45 __libc_start_main
/build/eglibc-ripdx6/eglibc-2.19/csu/libc-start.c:321:0
#22 0x000000000072f1ed _start
(/data/repo/llvm-patch/build-all/bin/opt+0x72f1ed)
Abort
It starts crashing with r334298:
[InstSimplify] add nuw %x, -1 -> -1 fold.
Summary:
`%ret = add nuw i8 %x, C`
From [[ <a href="https://llvm.org/docs/LangRef.html#add-instruction">https://llvm.org/docs/LangRef.html#add-instruction</a> | langref ]]:
nuw and nsw stand for “No Unsigned Wrap” and “No Signed Wrap”,
respectively. If the nuw and/or nsw keywords are present,
the result value of the add is a poison value if unsigned
and/or signed overflow, respectively, occurs.
So if `C` is `-1`, `%x` can only be `0`, and the result is always `-1`.
I'm not sure we want to use `KnownBits`/`LVI` here, because there is
exactly one possible value (all bits set, `-1`), so some other pass
should take care of replacing the known-all-ones with constant `-1`.
The `test/Transforms/InstCombine/set-lowbits-mask-canonicalize.ll` change
*is* confusing.
What happening is, before this: (omitting `nuw` for simplicity)
1. First, InstCombine D47428/rL334127 folds `shl i32 1, %NBits`) to `shl
nuw i32 -1, %NBits`
2. Then, InstSimplify D47883/rL334222 folds `shl nuw i32 -1, %NBits` to
`-1`,
3. `-1` is inverted to `0`.
But now:
1. *This* InstSimplify fold `%ret = add nuw i32 %setbit, -1` -> `-1`
happens first,
before InstCombine D47428/rL334127 fold could happen.
Thus we now end up with the opposite constant,
and it is all good: <a href="https://rise4fun.com/Alive/OA9">https://rise4fun.com/Alive/OA9</a>
<a href="https://rise4fun.com/Alive/sldC">https://rise4fun.com/Alive/sldC</a>
Was mentioned in D47428 review.
Follow-up for D47883.
Reviewers: spatel, craig.topper
Reviewed By: spatel
Subscribers: llvm-commits
Differential Revision: <a href="https://reviews.llvm.org/D47908">https://reviews.llvm.org/D47908</a>
git-svn-id: <a href="https://llvm.org/svn/llvm-project/llvm/trunk@334298">https://llvm.org/svn/llvm-project/llvm/trunk@334298</a>
91177308-0d34-0410-b5e6-96231b3b80d8
Found this when fuzz testing with random passes on random input.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>