<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/58924>58924</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [x86] Backend crash during pass `X86 FP Stackifier`
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          HazyFish
      </td>
    </tr>
</table>

<pre>
    ## Description

When targeting `i386` or `i686`, the following code crashes the backend during pass `X86 FP Stackifier`.

The problem doesn't exist when targeting `x86_64` or `aarch64`.
The problem also doesn't exist when v4f64 instead of v8f64 is used.

## Minimal Reproduction

https://godbolt.org/z/1vh8jf7YT

### Code 

```ll
; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare float @llvm.pow.f32(float, float) #0

define float @f(<8 x double> %0, i1 %1, <8 x double>* %2, float* %3) {
BB:
  %C2 = call float @llvm.pow.f32(float 0.25, float 0.5)
  %C = fcmp true double 0.25, 0.5
  %B1 = fmul <8 x double> %0, <double 0.25, double 0.25, double 0.25, double 0.25, double 0.25, double 0.25, double 0.25, double 0.25>
  %B = or i1 %1, %C
  %F = load float, float* %3
  store <8 x double> %B1, <8 x double>* %2
  br i1 %B, label %BB1, label %BB2

BB1:                                             ; preds = %BB
  ret float %F

BB2:                                             ; preds = %BB
  ret float %C2
}
```

### Stack Trace

```
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: ./llvm-project/build-debug/bin/llc -mtriple=i686 ./crash-reports/dagisel-i686/1.ll
1.      Running pass 'Function Pass Manager' on module './crash-reports/dagisel-i686/1.ll'.
2.      Running pass 'X86 FP Stackifier' on function '@f'
 #0 0x00000000047ada8a llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Support/Unix/Signals.inc:569:11
 #1 0x00000000047adc3b PrintStackTraceSignalHandler(void*) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Support/Unix/Signals.inc:636:1
 #2 0x00000000047ac286 llvm::sys::RunSignalHandlers() /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Support/Signals.cpp:104:5
 #3 0x00000000047ae365 SignalHandler(int) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Support/Unix/Signals.inc:407:1
 #4 0x00007f7a1c8fa980 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x12980)
 #5 0x0000000002614df6 (anonymous namespace)::FPS::freeStackSlotBefore(llvm::MachineInstrBundleIterator<llvm::MachineInstr, false>, unsigned int) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Target/X86/X86FloatingPoint.cpp:907:21
 #6 0x000000000261475c (anonymous namespace)::FPS::adjustLiveRegs(unsigned int, llvm::MachineInstrBundleIterator<llvm::MachineInstr, false>) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Target/X86/X86FloatingPoint.cpp:961:5
 #7 0x0000000002613fea (anonymous namespace)::FPS::finishBlockStack() /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Target/X86/X86FloatingPoint.cpp:558:8
 #8 0x0000000002610c56 (anonymous namespace)::FPS::processBasicBlock(llvm::MachineFunction&, llvm::MachineBasicBlock&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Target/X86/X86FloatingPoint.cpp:501:10
 #9 0x000000000260fed8 (anonymous namespace)::FPS::runOnMachineFunction(llvm::MachineFunction&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Target/X86/X86FloatingPoint.cpp:375:16
#10 0x00000000035783e5 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/CodeGen/MachineFunctionPass.cpp:91:8
#11 0x0000000003c55c66 llvm::FPPassManager::runOnFunction(llvm::Function&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1430:23
#12 0x0000000003c5aa92 llvm::FPPassManager::runOnModule(llvm::Module&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1476:16
#13 0x0000000003c56539 (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1545:23
#14 0x0000000003c560ad llvm::legacy::PassManagerImpl::run(llvm::Module&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:535:16
#15 0x0000000003c5ad71 llvm::legacy::PassManager::run(llvm::Module&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1672:3
#16 0x0000000000d38a5c compileModule(char**, llvm::LLVMContext&) /home/henry/aflplusplus-isel/llvm-project/llvm/tools/llc/llc.cpp:737:41
#17 0x0000000000d36e02 main /home/henry/aflplusplus-isel/llvm-project/llvm/tools/llc/llc.cpp:418:13
#18 0x00007f7a1b7cdc87 __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:344:0
#19 0x0000000000d3660a _start (./llvm-project/build-debug/bin/llc+0xd3660a)
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzNWFtzqzgS_jX4RWUKxP3BD7FzPHO2ktrUyZnL7ktKSMLmDCBKErnMr5-WwAZj1xzvbiazKQd07f76ou4WuWBvKwcH8EO3XFFZtroUjePdOt5N__xlzxukidxxXTY75MReGaQxvJCQthfbnoM3SO85KkRViRezkgrGEZVE7bmyUzmhv_GGIdZJM98SpQyBX9MYbR_Qo4bpsii5hDF3iuAr7G2lyCteIya4ahycaMRfS6XRyxm61zR-isMRHyGS7u2Ae06OVEpcpvkcFnGIykZpThgSBXpO7YBCneLsBN-gv_uyKWtSoS8cqLOOzhW517pVTgDLt_DbCZaLSrtC7qD3O_z7z_v0W5H86-s5bUN-Y9R5MgVKt7-qGgaCNdp2jWWMbrSWhhtqBCVVZXQPzUJyDi_11lB4dQ0YiiHVctpVRBNQCXopq0py3ckG1bwW8s3BaSMa7uCs58I4rYgEQ1eCaOSEwP65dlvx4hYBhsV23HjD0MgQoPemwBkvymZCoIBdTrBJ0SuYogMQTvAJNkXWp0rfNH3TnK9x8I2ZwxNmdiCwTJN1z229Njq3TWRmNxgI3SKjlD-XAXkujo60oRcdddATsnQKWrdIy44PuI67zPpx8drvV9dddSbHUVaYmBH5mC6ocoLUAoWzM9U8SDtZsrVLQCsMza09GGBYq7QAT7kk7_rPLTrszw8o1mZ1RXJe2V6_e9LHU_8y0-D4_8mfOTqt5ExZySzJAwY4DAc_AclP-eC_is_mIFByOzvsl4ODDZ7oqySUXwwRfffh7tPN4yekurwuNSIo73bAthVSIy3QLD6Vet_lLhU1dMzxGF5LCG7fOAVTb0ulOq6ggQhEkbKhVQchykR6G_VtvNcG0hAte5Csq9vjiTQxOXuQYicJBGO562reaBu23HN-eVdWbMk4wDa9srFLKFrWGvKWcaBbk4zsVotg2QtnIDKyKxWvljZbQax1D0HTNwi-dE0zpiScHKPogxm4Jw3ZQVrCCYKhGmI7HBzoXcvHrLS88CVe5-mv51McMEC_D5LJ4ComniLv1Tv8hQlhJCXIWgk0G9yoN9U3HiDTaku69w2cjoskeXkSSktOwLaxjbXNEK-3e1Fz8-KNSQBbUlRt1SnzvzTindvm4CFlDs_HrjX6gNZPTflqBspdA6nWBR8BxlGcwdP3R3H8uTg0yNEMe0_jR3C1yugofRYlg3jxEYDjIDaAR7x4hpdiMOIF9YOtT2Ark-neF_ABKW3NqfK90Ch4RBrMkPIgjtBclR9k99BLTtUYDuCSIiE-TQuSpR56epLc5o0naUJheqTeF3bLqmy61-Wu6fqJVu_Bg5mrhAs5dO29-hiojJka2ERTHeDYD1kRG8oE6pq3WnQKNaTmqrUHJOstt3147BumYrJO-FgJveYFADs5RfeE7qGa-QyFolx3RqOfNZcEBIDkdnmZTZeglj7jbVDXKNATZ-92_r7aehgav9ogBM-tSSwQdR4E8Bh8JbPmwBN7xHNFJRG9WlGEfeuUviuf-Re-M45-KtYGvaPOPk5HsX96npKZioKCk-t9CW4Iar-uBHiTcan3igbXyRJFUGXfpKMs6UwWj0bXnwuAQrlSa6JKaiW6dCoOeXTIL2fz093xR6rC822wHHWRnerCKzhLr9aF7Jp_Nmcif0cdHyZskERG2PhYM_on1UMQJWnAo3PjHNCaGmgi50UB31syc9n9gZsC7wKYw9n0R3c2Up0UEQGNIhpPk_L2wew91HIfLM_nL_C44ztC3yYoDkk7hPsxROJglAXPZCEkw1fIcm9r01PXG4Y-RI4knnlaMJMjjoLse8fq_v9TuCiMZkYK58J5cCEewVWW0lCHj_Q-1211lOrvkiYK5jEhmnscS_zvC_O3C-LHibmET6xyUsR4LEgJFDFwjW3Lih9diO6JtJeHm9O8dHf38_1GNJq_6v8dvhaiUrZL--eAOQlM4RX6I-ZkhjnmHkY1KZu_gn3omzrAn6gsndbheUIZTROow0H99ElpIvXTAYu9gsN7Z-aWm5__8fLv_NjFLlxR4UqsTGnuusemnbR0XHMNCEJzR_FG9tlcejhIqGdsYsX1XwJs_d_vP14Ajp9AFnzlx3Hq4xAS3oKtApYFGVnoUld85URruF440S1aDx-p-08YV3yqXnSyWv33306iNMPhYr-KvDyMARHFeUYZy1OaxwGhvpcxnOAsX9ivXcogdTBu-AuyJKANqBflCnsY-77vwXUn9lM3ilPC0zSFeMtyEmIn9DgYsXLtl04hdwu5spBAhcp8AC2VVuMkyGtqd6sYQ590ei_k6kfy-xtA3y8s75XF_gdaUk0T">