<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/69907>69907</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            SelectionDag Assert (w/ asserts) / backend crash (w/o asserts) with Stack MTE + AFDO
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          hctim
      </td>
    </tr>
</table>

<pre>
    This backend crash was noticed when building the Android source tree with `-fsanitize=memtag-stack`. I have reduced the input test case using creduce, as it's a combination of a few key conditions:

 1. `-fsanitize=memtag-stack`,
 2. An AFDO profile that's only available in the internal branches of Android (but is added here and doesn't contain any confidential information),
 3. Exceptions, stack protector, and hot-cold splitting.

You can see a [workaround](https://android-review.git.corp.google.com/c/platform/art/+/2796073) (from a different source file than the one that's attached below) in the Android tree, but we'd like to see if this miscompile can be debugged.

I've also reproduced this on a tip-of-tree build of LLVM (at cbbb545c4618969850d88bb008ab7f1c2918d5c3) and looks like it fails with a SelectionDAG assert. The Android toolchain is built without asserts, so that results in a backend crash.

The three files (script, cpp, afdo) are attached: [backend-crash.zip](https://github.com/llvm/llvm-project/files/13068367/backend-crash.zip). You'll need to comment out the Android-compiler part of the shell script and point to your own tip-of-tree compiler.

My runlogs below for your convenience:

```
Local LLVM tip-of-tree compiler with assertions at cbbb545c4618969850d88bb008ab7f1c2918d5c3:
clang++: /usr/local/google/home/mitchp/llvm/llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp:1205: bool llvm::SelectionDAG::RemoveNodeFromCSEMaps(SDNode *): Assertion `N->getOpcode() != ISD::EntryToken && "EntryToken in CSEMap!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: /usr/local/google/home/mitchp/llvm-build/opt/bin/clang++ -cc1 -triple aarch64-unknown-linux-android10000 -emit-obj -target-feature +mte -O2 -fsanitize=memtag-stack,memtag-heap,memtag-globals -stack-protector 2 -fprofile-sample-use=libhwui.afdo -fexceptions -mllvm -hot-cold-split=true -x c++ GrVkGpu-9be5c5.cpp
1.      <eof> parser at end of file
2.      Code generation
3.      Running pass 'Function Pass Manager' on module 'GrVkGpu-9be5c5.cpp'.
4.      Running pass 'AArch64 Instruction Selection' on function '@_ZN7GrVkGpu4MakeERK18GrVkBackendContextRK16GrContextOptionsP15GrDirectContext'
 #0 0x000056119ec38fa8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x7c3dfa8)
 #1 0x000056119ec36b3e llvm::sys::RunSignalHandlers() (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x7c3bb3e)
 #2 0x000056119ec39658 SignalHandler(int) Signals.cpp:0:0
 #3 0x00007f634725a510 (/lib/x86_64-linux-gnu/libc.so.6+0x3c510)
 #4 0x00007f63472a80fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x00007f634725a472 raise ./signal/../sysdeps/posix/raise.c:27:6
 #6 0x00007f63472444b2 abort ./stdlib/abort.c:81:7
 #7 0x00007f63472443d5 _nl_load_domain ./intl/loadmsgcat.c:1177:9
 #8 0x00007f63472533a2 (/lib/x86_64-linux-gnu/libc.so.6+0x353a2)
 #9 0x000056119fd48a71 llvm::SelectionDAG::RemoveNodeFromCSEMaps(llvm::SDNode*) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x8d4da71)
#10 0x000056119fd48e8f llvm::SelectionDAG::DeleteNode(llvm::SDNode*) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x8d4de8f)
#11 0x000056119fc0382a (anonymous namespace)::DAGCombiner::recursivelyDeleteUnusedNodes(llvm::SDNode*) DAGCombiner.cpp:0:0
#12 0x000056119fc04288 llvm::SelectionDAG::Combine(llvm::CombineLevel, llvm::AAResults*, llvm::CodeGenOptLevel) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x8c09288)
#13 0x000056119fda5f3a llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x8daaf3a)
#14 0x000056119fda4b9f llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x8da9b9f)
#15 0x000056119fda1942 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x8da6942)
#16 0x000056119e12c8c9 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x71318c9)
#17 0x000056119e647387 llvm::FPPassManager::runOnFunction(llvm::Function&) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x764c387)
#18 0x000056119e64f962 llvm::FPPassManager::runOnModule(llvm::Module&) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x7654962)
#19 0x000056119e647ea7 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x764cea7)
#20 0x000056119f3d6b15 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x83dbb15)
#21 0x000056119f8c97e1 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) CodeGenAction.cpp:0:0
#22 0x00005611a100ec26 clang::ParseAST(clang::Sema&, bool, bool) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0xa013c26)
#23 0x000056119f7e066f clang::FrontendAction::Execute() (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x87e566f)
#24 0x000056119f7518dd clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x87568dd)
#25 0x000056119f8c1d27 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x88c6d27)
#26 0x000056119c6f7b42 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x56fcb42)
#27 0x000056119c6f3f3e ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#28 0x000056119c6f2c2d clang_main(int, char**, llvm::ToolContext const&) (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x56f7c2d)
#29 0x000056119c704541 main (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x5709541)
#30 0x00007f63472456ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#31 0x00007f6347245785 call_init ./csu/../csu/libc-start.c:128:20
#32 0x00007f6347245785 __libc_start_main ./csu/../csu/libc-start.c:347:5
#33 0x000056119c6f0421 _start (/usr/local/google/home/mitchp/llvm-build/opt/bin/clang+++0x56f5421)
./GrVkGpu-9be5c5.sh: line 15: 192788 Aborted /usr/local/google/home/mitchp/llvm-build/opt/bin/clang++ $ARGS
```
```
Android compiler built without assertions:
fatal error: error in backend: Cannot select: 0x558cc61b0e40: ch,glue = <<Unknown DAG Node>>
In function: _ZN7GrVkGpu4MakeERK18GrVkBackendContextRK16GrContextOptionsP15GrDirectContext
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzMWt1u4ziyfhrmhrAhUf8XuVDsONvY7ulGkhlgz41BkSWbG4rUIan87NMfkJJjy52e2R6MBwfoji2KLNZX9VWxSJpaK3YK4BplNyhbX9HB7bW53jMnuqtG87frx72wuKHsCRTHzFC7xy_UYqWdYMDxyx4UbgYhuVA77PaAa8WNFhxbPRgG2BkA_CLcHqM8WrSWKuHEfwAl6w46R3cL6yh7Qnm0xJ_wnj4DNsAHL9oLE6ofHHZgHWbUAh6sn4aNXRBZYWqxcIgUFlPMdNcIRZ3QCusWU9zCC36CN8y04sI3W5TUKFqjaPqL4-UfqYXIaupLlrhWuN6sv-Le6FZIwG5Px8m1km-YPlMhaSO92pP2DoyiEjeGKrYH69U62AeRshkcFhZTzoHjPRjAVHHMNViFSOG83o4KhakKGFrBQTlBJRaq1aYLSBGpjiomS3z7yqAfsZIVDii8ug6Y0yZYTHG8127BtOTY9lI4J9RueWqWf-kBM6qwBcAUo-zmRZsnavSgOMrWiJR75_pgS7JBZENHRAsDzwJeljvhlkybfrnTeidhyXSHyIYhsukldV5xP8a4MPgGkQ0pqjwqEkQqb5TW6A5TzEXbggHlDkQ6GHw0rVYn1qfOUbYHjhuQ-sXLmRxwsLUnocfuDf4CiBQcS_EE2OmAUbTYeZp3wjLd9X4iD78BzKEZdjvgM_N8QqR4Bkyl1dhAb_SBr8ITAVPsRL_Q7SJQP8SG9_vnz7998fiow6xpmizNWJrHZZVXZRbxsmyaKCppU7QxI1Vc8owFi3h3Sa2f7KixcLilQtoxpCh-AAnMu3td32FqLRi3xI-n0LWWbO9Z5ON4ENKFoXpwU_eRJzpYExuwg3TW24_Oo35mAT-B23t43ivWw7LMiN55WazvA89argMAT-vJQSipPZ0mwYtR8H9E_xGrdsLth2Zij5TPh49Fb_S_gXn6hMkR2cRJlJdJXiCy-V40qZb4X3pApJASK_CO0j5VdJ5b3gwnRFlM7je4p8Z5r_mXdg9S4hFg8EevhXJezJseDNYvaubxg4yZxb68YTMoqXd2JClutRmHM62eQQlQDM6yk88-47_w-FkzKkcafTTdxIjgUx_--GeIdpiYSap2ISpvgq_IZrDGG97P7Z0SQhqRzV53_qMTju37uYP8h2gQ2aw0hztQiGxOWXr2uPR0SeqYRJmfsdFa4iAlqVFSzwaGlnvo9DP8ojlsjO5WD7dfaG8RKR_Wvg0jUvuMmNS4PljCZ_hfFii53YH72jPNAZFyTDYxStb408N6FH2rnHl71E-gMCI5IjlGhJw0CoXH-fxAQhApQiy-Z4dvn2_rh1tsh6YTzsfPsPP5QZvAlZ9mt7B2CPQOnBOKyYFDIOS4DHuqO0PHdbAPiYiBtXBYeg_JnlqrmaAOuKfgxONJ5YewPvCh698pEC1RVH0zemdoh6nZDT5Q7M-zYREyHyIb7dPCphGeCCf8wgvGYrxwRvQSMKWG7fN0MagnpV_UQgo1vC6mlSWOoijCC-iEW-jm33jhqNmBW7RA3WC80286B3jxleAfL-VkNT3uwXvw8LSTuqHS4rHX4n2pxF7WtM4vLO16CYvBeqlSNPuXQSx9gsOLFt4XXLzoPHC8OCyvi7C8omTtzAB48YrZBP3O_PZ01w-LqoGMZSEEgu1jb3uUrEC3KLn1SciC8YHs07BuQ7YdexLf0wcY3oECM5YC4U3i39wPSvlKqafWZ-diM6gQRvibb_hCFd2B8QTWCneaD9IbsfhALVJMTEk_ElvXwWv4k7LODOMM7yE7iW8PUyNSoDTa_s8vh3nSL_QJbu__GZe-4WbM3CutHLy6-3_G-Z2ZHr6O9v0WZ3dmLQwwN73wIsfKB5EkwtGrJ0qWx3EFLClbWp6kEvtmxy_fjFAuEP9xjJ7y2MnQl622zgDtQgpY-RpuKkz-WvojchO9FizhLfXJ6AgjPoORNwl8BON-UA9ip6j8B1VcgrHvWe1CmjZNAjNNyZmmVZ6VeKYTIuVkv7HZTtk-Cv_fBSWToKLNk7QgGc3iaMIxriSvZb7N0ykp7NQwvmBLq5d5UC9hWRzNlEvnMmkZtQxvt70vWyjfPgkpt8JHtU9v455hichG9c4b7LTbkqGkTlOU1EV-lJ-d65wWBBsqLAQ5NuBFZLMMT2-Wg1-mNr224hWRTegZJJMCJfWJ4HwuOE3ThmDa-FUkiHJ8tEloChLK2Ot2lFCcS0h4hrdKbqWmfMt156tBL0uoANY3d3bH6Cgujguv0oktyzOsSULJT_onSyiZ-ac6JU_L05IW8Z9a-E_GhBJgrAAuFAYlTzkt4nckPl6jcyRQtr-LZA0SHIy6_v3qQ9nO1J_lm5ZFSUlo2Kcord46PVisaAe2D6mymhDUd6uw2QYz5U1gg7HiGeTbiO5XNVjgHtDv-OhEzPeJwetGznRLSVn-rmkncbMpp7bP8AzSZ_Tjm7q-H_c7QZ_TN1Pp-rV307CLeYRFFSnLmUeSOaFo1ib0B6g_PYCcaVwrftsJF-rsCy4HJae0TehM7fRM7bSpfhQHR7XH1lrKG2oFu5GaPc0J8165MK2sC4vyBUFVTTWPjuwMVFyl5A9BmUF9VV8o2wsFB_1noL57d1lUeZWSGap8tnLHhJWswj9Uz9eMJ8A-RPS3QCniJC5ZNYNSzKDkaZGUxQmUzTev_aHg_X8BIk9ZUhYzEOUZiLbKyX8B4kuo3OfMmpouCiBLq3xOqOrcC0BPvSBhR9nbVH4foXzq-mPE_P0wUgZ05gcyX8oTnjdxhseB4wlBJ9y0T_k6uH5wiJQnr9eC7pS2TjB7q3ZhHQp7iJMu_wDKwTyA3-5O25qTzDbrelyDfq_XY9gK_0Gnz1TtPupyksicEWp3D-28-eCH-kzgZIR6CpfTIZ-UM4MvBe6hXSn3zRmUrI6vn9spl2yEhIc366BDye14Vs3HN4MS_zvAtj8b6fdm_YsRDraHHdrJIA4tHaTb8lB-_MHA5DbMebGUm_CmibMZteZlVsmqAuIPLLrSyg7dIcrHbdSjocrKsEf5VYkzztUPj--b4RAth0IguObDsoqcllU0jiJgJD_V5Rs1FuqHx_lMD9DRiTeN1vL4eSkz0ihOWAB1VH1eGxUQ5Xl7qvrGeGO8M3OM2ldgg4PLFkQFZHk-qx3IvCAqsrjkfB7g48ntJ2UdnY5_37U9hFb5Y3AXrRqKLC85n-HJzigcc1LMsuOo-RHWs2b0exTfwb7ojqdkOSfzLD-rfljeFk1KMGPx1m-MZ8tQbQx980kxWbE9NYfcWU8Za95GVvhZC35ROFnesmZezJHiDE7SJoAPvljFjyFGT7dgHZXyt3DIOS7AH2A7Wx28jCnLzOpwbsTzD_ZupDxTizAysf9g53A0NFoxGK3-7ya9mGULRuaEn1U1rIjSLI1xOD25kA5FVGXp7HTh_VTzcJiT5Yzi7VaKhm2to8ZtGZVy-36mw-zw_anTdKr10aDlHiV1kaKkTo6TxueTFmWGwxChhDufZ_zqhS-C8PEUiZQoqcmREO_HhTOhMyQfgfhQeJIWKKmzo-zkjGxRSmI8Sr0cX7KUHH3ldT07P7fetFgKBTgOl1txRYqyxHWjjQP-V9-nIJLW93cPH94dnj0eLoff7w4_uhie_V6ipY5KDMZoX5qMX7BQhzti37aiSmmHbdgS-4boNctKxvK4iSD12QGzPSKrnRwAo2SNUbJCyerX8cYHr-s7HM6GxuJsvGk_Xh_44X_t3cHcMFf8OuFVUtEruI7zqowyUsbx1f66LfKkgByinJA2paxKCK3KKo8Ia5qIpVfimkQkiSOSRBWJ4niZNTzKWgopLYBkZYHSCDoq5NK7canN7ipc7V3nVRUVV5I2IG34AQ4hCl5weIkIQdn6ylxPrt9ZlEZSWGePUpxwEq6PRxB0N116esq_hIvDww2_z5qbs5_xTJ30aa9whzxeCn55vMWeVvVm_fVqMPL6z19gBqD_FwAA___HNTjF">