<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/55097>55097</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            UNREACHABLE when having DW_OP_LLVM_arg inside DBG_VALUE (caused by debug info salvaging in loop-reduce?)
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          bjope
      </td>
    </tr>
</table>

<pre>
    Given the attached reproducer  [lsr-debug.ll.gz](https://github.com/llvm/llvm-project/files/8561323/lsr-debug.ll.gz)

When running
  `llc -mtriple ppc lsr-debug.ll`
the result is

`
UNREACHABLE executed at ../lib/CodeGen/AsmPrinter/DwarfExpression.cpp:486!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: build-all/bin/llc lsr-debug.ll -mtriple ppc
1.      Running pass 'Function Pass Manager' on module 'lsr-debug.ll'.
2.      Running pass 'Linux PPC Assembly Printer' on function '@loopbody_9'
 #0 0x0000000002af4653 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (build-all/bin/llc+0x2af4653)
 #1 0x0000000002af22ce llvm::sys::RunSignalHandlers() (build-all/bin/llc+0x2af22ce)
 #2 0x0000000002af49d6 SignalHandler(int) Signals.cpp:0:0
 #3 0x00007f2ce1060630 __restore_rt sigaction.c:0:0
 #4 0x00007f2cde7a7387 raise (/lib64/libc.so.6+0x36387)
 #5 0x00007f2cde7a8a78 abort (/lib64/libc.so.6+0x37a78)
 #6 0x0000000002a62c9f (build-all/bin/llc+0x2a62c9f)
 #7 0x0000000001d08139 (build-all/bin/llc+0x1d08139)
 #8 0x0000000001d08116 (build-all/bin/llc+0x1d08116)
 #9 0x0000000001d07613 llvm::DwarfExpression::addExpression(llvm::DIExpressionCursor&&, llvm::function_ref<bool (unsigned int, llvm::DIExpressionCursor&)>) (build-all/bin/llc+0x1d07613)
#10 0x0000000001d072b0 llvm::DwarfExpression::addExpression(llvm::DIExpressionCursor&&) (build-all/bin/llc+0x1d072b0)
#11 0x0000000001d5e92a llvm::DwarfCompileUnit::addComplexAddress(llvm::DbgVariable const&, llvm::DIE&, llvm::dwarf::Attribute, llvm::MachineLocation const&) (build-all/bin/llc+0x1d5e92a)
#12 0x0000000001d5bf9d llvm::DwarfCompileUnit::addVariableAddress(llvm::DbgVariable const&, llvm::DIE&, llvm::MachineLocation) (build-all/bin/llc+0x1d5bf9d)
#13 0x0000000001d5b581 llvm::DwarfCompileUnit::constructVariableDIEImpl(llvm::DbgVariable const&, bool) (build-all/bin/llc+0x1d5b581)
#14 0x0000000001d5a3ec llvm::DwarfCompileUnit::createAndAddScopeChildren(llvm::LexicalScope*, llvm::DIE&) (build-all/bin/llc+0x1d5a3ec)
#15 0x0000000001d5c111 llvm::DwarfCompileUnit::constructSubprogramScopeDIE(llvm::DISubprogram const*, llvm::LexicalScope*) (build-all/bin/llc+0x1d5c111)
#16 0x0000000001ceca29 llvm::DwarfDebug::endFunctionImpl(llvm::MachineFunction const*) (build-all/bin/llc+0x1ceca29)
#17 0x0000000001cd7ebe llvm::DebugHandlerBase::endFunction(llvm::MachineFunction const*) (build-all/bin/llc+0x1cd7ebe)
#18 0x0000000001cc19e7 llvm::AsmPrinter::emitFunctionBody() (build-all/bin/llc+0x1cc19e7)
`

This is what I see if adding "-debug -print-after-all":

### LoopStrengthReduce

loop-reduce is salvaging debug info (in two steps, I think the test case perhaps can be reduce to just include the first step):
`
scev-salvage: Updating:   call void @llvm.dbg.value(metadata i16 undef, metadata !14, metadata !DIExpression()), !dbg !15
scev-salvage: to:   call void @llvm.dbg.value(metadata i16 %turns.011, metadata !14, metadata !DIExpression(DW_OP_consts, 8, DW_OP_div, DW_OP_consts, 4, DW_OP_mul, DW_OP_LLVM_arg, 0, DW_OP_plus, DW_OP_stack_value)), !dbg !15
...
scev-salvage: Updating:   call void @llvm.dbg.value(metadata i16 undef, metadata !14, metadata !DIExpression(DW_OP_consts, 8, DW_OP_div, DW_OP_consts, 4, DW_OP_mul, DW_OP_LLVM_arg, 0, DW_OP_plus, DW_OP_stack_value)), !dbg !15
scev-salvage: to:   call void @llvm.dbg.value(metadata i16 %m.010, metadata !14, metadata !DIExpression(DW_OP_consts, 8, DW_OP_mul, DW_OP_consts, 8, DW_OP_div, DW_OP_consts, 4, DW_OP_mul, DW_OP_LLVM_arg, 0, DW_OP_plus, DW_OP_stack_value)), !dbg !15
`
The `applyExprToDbgValue` method is actually taking a decision to use "setShortFinalExpression" based on only having a single DW_OP_LLVM_arg in the new Expr (not taking OldExpr into account, **is that a problem?**). Anyway, this decision is resulting in using DW_OP_LLVM_arg without also having a DIArgList. ** Is that really allowed? Seems like a special case that just complicate the logic for the rest of the backend? **

### ISel

Given that we have 
`
call void @llvm.dbg.value(metadata i16 %m.010, metadata !14, metadata !DIExpression(DW_OP_consts, 8, DW_OP_mul, DW_OP_consts, 8, DW_OP_div, DW_OP_consts, 4, DW_OP_mul, DW_OP_LLVM_arg, 0, DW_OP_plus, DW_OP_stack_value)), !dbg !18
`
in the input to ISel (no DIArgList)  it seems like we get
`
call void @llvm.dbg.value(metadata i16 %m.010, metadata !14, metadata !DIExpression(DW_OP_consts, 8, DW_OP_mul, DW_OP_consts, 8, DW_OP_div, DW_OP_consts, 4, DW_OP_mul, DW_OP_LLVM_arg, 0, DW_OP_plus, DW_OP_stack_value)), !dbg !18
`
out from ISel. I.e. there is a DBG_VALUE with DW_OP_LLVM_arg in the DIExpression and not a DBG_VALUE_LIST.

**Is that supported? Or should MachineVerifier detect this as invalid?**

### DwarfDebug / DwarfExpression

The logic in DwarfDebug::emitDebugLocValue looks like this:

`
  ...

  if (!Value.isVariadic()) {
    if (!EmitValueLocEntry(Value.getLocEntries()[0], ExprCursor))
      return;
    DwarfExpr.addExpression(std::move(ExprCursor));
    return;
  }

  // If any of the location entries are registers with the value 0, then the
  // location is undefined.
  if (any_of(Value.getLocEntries(), [](const DbgValueLocEntry &Entry) {
        return Entry.isLocation() && !Entry.getLoc().getReg();
      }))
    return;

  DwarfExpr.addExpression(
      std::move(ExprCursor),
      [EmitValueLocEntry, &Value](unsigned Idx,
                                  DIExpressionCursor &Cursor) -> bool {
        return EmitValueLocEntry(Value.getLocEntries()[Idx], Cursor);
      });
`

Afaict the isVariadic check is looking for DBG_VALUE_LIST. So unless having such we enter the early if statement and call DwarfExpr.addExpression without the `InsertArg` helper function that is needed to deal with DW_OP_LLVM_arg.

So depending on the correctness of LoopStrengthReduce (and ISel) I guess the isVariadic check might need to scan the DIExpression to look for DW_OP_LLVM_arg rather than just looking for DBG_VALUE_LIST. Or maybe it should provide an  `InsertArg` helper also in that first call to DwarfExpr.addExpression?


### Summary

Either LSR, ISel or DwarfDebug seem to be broken. Or maybe in some sense all of them unless MachineVerifier would stipulate some rules here and then the passes wouldn't need to check validity themselves.
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJztWVtz2roW_jXkRROPsYOBBx4Iod3M0NNMSbsfGdmWQY1teSQZwvn1Zy3JxhdIk-zpmenDzhDAsrz0rfsnEYr4NPvMDywnes8I1ZpGexYTyQop4jJikpDB6D5V8jZmYblz0tTZ_Xcwehh4k73WhRr484H3CV47rvdl6EQig4s0PdQftyDoJ4s0XCY8ZQo-J6Ng6Hs-TujJ9aYD92Hgzu3733uAJcs85_nOjgCYwE3TiNxmWvIiZaQoItKWAvftVFRHMlWmmnDVlnqe8f0_35bzxV_z-_WSsBcWlRoUp5o4DiLjIbwvRMw-sxy-zVX2KHmumYSLhyOVyfKlAPmKi9yJigLscDcJBt7Qyn5cL-ebJVFlmHFNKAFwaFMhNdGCfNhyXKnSmI7QPCY8j9IyZsZjkaRqT0IaPWtJI-bY5TfgxmcSlxniskOuQ8zfoxQ7STNC5a7MWK4RB8DjaXxLwXzep5DnBkDXrh2LW4nDSuI36yFSUKXIwBt_KvNIg1nIIw58oTndodXGBIYyCCqQAVcdp3njCrj3isw1z8sX8vi4IHOlWBamJ3J2hxGc1IvC9eDOTYUoQojt7RSvbewMPN8l7otb_3k0uQtGPjEmBzP5c3VS9ouRbYz4hFaFYG8mSXrcCqUlo-Ao8PgC_AE-moL8yVU7Drx796Va7BzhiGbYQ-N5EbuGBoyx4bucpn-B91MmIRAm71kQ5XUW9PrqT-OAdESDyEobO6yq2HbN_1mQXwkaJ7DE0A3cAEy73UI-aCHZFqJc8R01DnGiy8fvWo_HbEzH_mRMJOUKI2Nisy-4s5-Ro4QTGJX8AOZ1FBr1BE3oeEJoiGn2S0Gw5KQjKOhaJvCiafKWfc2kjpRxW8owdidD_w0vVZM6UiYXUobBO6QMg46UaU_KGGpuK7h6JcwO0jhuDbWD_mHV3FiUUglpYt-EfzOrTkIIhGTgL0IhUgRe5hANOYttorQfeEXsdOAv3wzwSqemZ0BCuX2lvdD9fyj9DmiwcgfasAttxKYe7UNbiKyAHvk95_qMDcdS9jKPY0TSxRfuflDJaQgVNRK50hcOAQ0uxmJcyX6da6jpIfS97owvwAF4ztYioqakNrLf1Nuo1dHb6-kdJtP4PXrXmv0-xXtqvUcbBNvRxu9rM5oM39TGQJRlpGvQgG4FXn2XTphE74IKSDpQ73pQqc-it6FCW9Nsnsdg9k0kCrbYw5qSdRNjzV54RFMzYeDNr5v-bciIqAN51IMcDYcfsO6mDAtLbgwwg6OTzc2E2sI96Bd6va0DQuzo0Okkw4hFFKT0dHhA3mOvWR7XfOkiJKqAPfOpBvRbuOyyHVzd3hTFYxa2yYaBVJGAe6rYBbrfhcws3EHW7XdRNJyycQtZi3lbTMCo64XvgeK9hwxVUptl6z2AfX_acwW7BHLcA_1fEcUY4QmBIoQUdOB5lqgSIOSA45YmgMUu453p9Vkd-yJrIKAbIIn5Tu-_MdxJtechPb2VZhjXVTQ90B0uZhfieSKIoWJEHwVRmsF2ASJ1BZSf58-G-GvgWiQCT5GCyT0tFFzkJMRNjxEL24yfJUxpbxYSLmEExZke298QqYgdbi0W9D_5XsRQKXOMVKDkkBgpOQgeE-TX4B4nDnfOgaYl8uOMaQqzKeGQAWUeAwEAwOdR2BgN7_oj7f5qvWheC7wHss1Do-vQtPgwqIE30qXMleNixn4Q28Pf26-PWxPmxhMTfLODMT80F82Mu2YwK9PmYr3-8WULmy8ccZvhIi1Vc6Vw67Gt1HjdKo7j_BGe-zOt83tiJoN4cX-nRTr6_mk2O9eCJygXcEGLIj2hZk_CEBR8PHBR872IsXTBJq8Ee56Ips9YwCiUsIijFbAClWZH5ymmN3vYlH3isKVs28kjIVSwGDfwIgche3qwQhR8ABHqKki4PaXK2ZGgFCyRudD10l9TQ-RxlyEAVyRKu90wfWkOWDWWd0qAAwDJgu7yyd4BYzhknp-O9ITTNTaDsxLw3Z4i4QqwfonI-riOHMxRguxUiUaHh9Vc7tZcaaeCQFYVBiBZaDJ4E0cWAxCyYSxTJOXPDJUvYHWa2upuHjCVPMKdAPATbYt5KnY8IomQpDrq0kQk5jueBkHnRrmVhldb1GrD0vad-hgQ1jsyVAN81w2KfzPnSuZMekaqgpTnRWkO-9DMNlKbiEDCQrhGplG7HUy-Y_pfg3_c4Jh5iRSZsbRDVg5z0APSUCtIw_vP2x_z9felSdNXSkrbJuaMFetK69nterV5crp5hK86o1VZ4OGuTeavkiioB2lMKp78g0mecCahrGgWaVtiKFDOHLTkcVOJruZps2UgeALcP8To8Ni6LIBaFzsN4M3mEjbAppDDVPFcRR8i6nPZ2r6EnHlGPcATe742NIIcrszWNebRmcaRwfi-nt2avwQQ5hkAscy1RPZuZUDwV2OcVQecg9G9a35qWJhyXx_BtE7LzJ9kyOsGfmu9s42c_umO0rE1RyYOmEMXgttiLiQPxg9dQ9gTfLKC3UJ-qutvWh-cMKsNoRIL9A4Sn0llwxDnmRC3eaD39heYntyzJIgXQ80gmGKn6wVYeCuSX9oR82d0b3-1MUlK6mZeuwEEBZU_eq5r7EDMBHB2c4JS7bzwUAxT006wCOxNvPjGdhUOvyMXjdlzZs_g9Y3X3dmW94ZrF521R_dXQhHLTGBJjrHV-eByFb_0BPzq7_LcEOWeoZDbgb8k9nD0NUt_ME0Qn02URuGrxj5btrsBnieUm7qENbPOZRLtWfSMoYeFAjkNko1eSSQbYHl5CsrWxEeV0R67GcMtuxHJqAS2A9EKlV0z_NHJlFjT3F5x7ZlSactDV7liUkP3RPa5ZynseZuffEwFBpg5YzE4C3puDATrWrnvlLENziuAKCFqYftAJKSECp2jPpDNl7t4m3GxJU_gyxXZlTj5qukyvttrAwtBKdygXzQbuIHmtbbt9iZJsY2herllgL_yAzSdjJ5g_4-0wnYfILoHDlt_ePw1GxrGyisT2uMB4xZA9VrSQbNqd4les9qUWUYhXls3l9yosd58M2cYSIcQf9PVkAXhigA-lAKoa1ubnCiRMZgD6JExV0U2q6Ou32KPRnWleVGmSJXN07KEucRwAnReXW3Nz4twwzwD5WTcOMs60LRnrk9mRcXSA1POTTzz46k_pTea65TN2j8jH1FwlQcXREOhLxo2grWYlrj7CU_tc5_mMAh0bx0UGZYwvSllOvvnvx-PRu50fLOfRe7Uv3O9oR8G_iRMgsT1Ipd6k8nUn3huOLlJachSNcO24Xm44TIi8MRr9HDDZ57ree6dF7hTdzgcOnQaTFzGApqM42kY-8BWWUZ56hjOKuTuRs4MJNBSIZWFVqiam-AFrLNsZrvUDS0h-eUs_CkKdmMWnhng_wPCAgfQ">