<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/126107>126107</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [MachineCP] Assertion `Reg.isPhysical()' failed in MCRegUnitIterator
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            bug,
            llvm:regalloc
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
            ostannard
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          aleks-tmb
      </td>
    </tr>
</table>

<pre>
    During our local testing, we encountered the assertion failure `Reg.isPhysical()` in the `MachineCP` pass.

Reduced reproducer:
 ```
---
name: main
body:             |
  bb.0.entry:  
    liveins: $ymm7
    renamable $ymm6 = COPY killed renamable $ymm7
    CALL64r killed renamable $rax, csr_64_mostregs
    renamable $ymm6 = VPADDWZ256rr $ymm6, $ymm6
```
Steps to reproduce:
```
$ bin/llc  -run-pass machine-cp test.mir
llc: /root/llvm-project/llvm/include/llvm/MC/MCRegisterInfo.h:649: llvm::MCRegUnitIterator::MCRegUnitIterator(llvm::MCRegister, const llvm::MCRegisterInfo*): Assertion `Reg.isPhysical()' failed
```
Proof: https://godbolt.org/z/PnqdcKbfe

The problematic patch seems to be: https://github.com/llvm/llvm-project/commit/9e436c2daa446da05e9219f0e6a22f932ba8e3cb

Based on my investigation, the issue arises when we remove `renamable $ymm6 = COPY killed renamable $ymm7` due to regmask clobbering. However, during this process, we skip dropping the corresponding RegUnit from the tracking copies, since it's preserved:

```c++
        LLVM_DEBUG(dbgs() << "MCP: Removing copy due to regmask clobbering: ";
 MaybeDead->dump());

        // Invalidate all entries in the copy map which are not preserved by
        // this register mask.
        for (unsigned RegUnit : TRI->regunits(Reg))
          if (!PreservedRegUnits.test(RegUnit))
 Tracker.clobberRegUnit(RegUnit, *TRI, *TII, UseCopyInstr);

        // erase() will return the next valid iterator pointing to the next
        // element after the erased one.
        DI = MaybeDeadCopies.erase(DI);
 MaybeDead->eraseFromParent();
```

As a result, we retain a pointer to the erased instruction in tracking copies, which leads to a failure when accessing it while processing `renamable $ymm6 = VPADDWZ256rr $ymm6, $ymm6`, clobbering any previous copy definitions.

@ostannard hi, could you please take a look?

</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJycVt1u47wRfRr6ZmCDpmzZvvCFYq9bowlqpNkt2psFRY4lNhSpkpSz7tMXpOSfzW72w36BEVDkcDg8c-YMufeqMohrMn8gjFkfuDHcScIYmW9HvAu1dWuu8dWPQ1OOSivP623nlKnAdg60FVxDQB-UqQjbwBsCGmE7E9ChhFAjcO_RBWUNHLnSnUMgOX3GaqL8oT57JbgmbEnYiuQUlEl7SE6fuKiVwc0hTrfc-wmhBaHFM8pOoASHrbNx6EgW5-Oe4UeL8XhMaGF4gyQroOHKEFrE4OPn_R9ZbOJeKMsJnaAJrrdIcwBanVAZH6cIm52bZjEsODS84aXGYT4Hkm1h8_fDv-BVaZ3C-97isnNTPD7mM_dTM8e_RQyFd1_z2dfG-uCw8r888suh2G7_-W82z527LEQflyEt7mH5R8DWQ7A38Hrs7m0Im0GpDGE7rQXA2HVmHOGHpk_IWLQp4ZNGOUILrUUPz85ZG9KuUzNunf0PissnYTtlhO4k3iaeNunfM1bKB3R7c7STmmRFPltFf8kqK0hWJJvPRoV9QMeDdR9Ns-W7TclxAtQaH967vB5LWBHJlxVQXJn6EUPZIpEY5TvQDs7aY3RRh9BGvhC2I2xXWVlaHSbWVYTt_kfY7mD-K8XfyiP2ZH6pEVpnS40ND0pAy4OowSM2KU0l_sSnCnVXToRtbmC-w1zYplFxsMJZlgsmOZ_NcsnpHFdsujpSzDljx1XGSr7ETJR9MA_cowRroDmDMqdY1BWPcEQMY1Uq7zsE7pRHD281mljuDht7ShX7Z4oipyA77ClZNdy_gtC2LDEqzAT-at_w1OdQ9qITauUjYgK9H_TGv6oWpLNt2xsgCOsc-tYaGWcGnsDR2SYtB8fFa1wRtlWY3HhlBELEbBHdo0d3QjkUx12qBWEP8UevKvL4-OXp6_bTw-e_ELaUZeV7pgDJNiSLdcieNoeYxeeI03Dq-eNL98XESJYOeeLnErfI5Zhkn2TXtBcernqDu0B6dsDenLhWkgcErjVESVPoL7qazm54C2-1EjVwh2BsuN0YyvOPLhPmbqgYiPFO7oyONgrPsjOpk8gr3PEiL8_7GLjDqjMqRGiesRrip3dCrI6QLjY9XAIZvPhJlJp-X_y-7X2JSUQ3GZC7rt8sI_jFy_P-Mtqn0WePG9ue98YH9wsY0XGPQyrflNbgMHSuB9HgtwAJZVCD-EBrlQmJf_Zq8xOvGhs0AfgxIhnt0jmx6PAe0-0-lc41-5tE1MklqO3-Gvn3DEkGO2ebA3dowkCW_or3Ek-LwgMHh77TYSgjh4ErA7y_SgzP3keoImCdSOoYyfRjDfWU0shl0i5-bfdJKbiIJRt3qBBNNV7KOM59qB5_1N9ymgT-Wj7AzTnS-aRs54dSw6MyKgZ-eUKQGb2-dKBWfYvotISz7aDVyD1C4K8IHLS1ryTbEVqM5DqTq2zFR7ieLrLlMl9MF7NRvZ4ucb46TmeUHpkUq_kqozO5LI-SSjwKvhipNaNsThnNp8tslWWTfD7NJHKGZb4QEpHMKDZc6UnU8dgsRklp11OWT-lipHmJ2g9PtLKrojywDWFs6GgOK661FcOjza1TOyi7ypMZ1coHf3McVNDptXd7Xs23v9P4YvJ_6L2jzun1b7epdElP2G6452nN_h8AAP__-WFRKw">