[llvm-bugs] [Bug 36825] New: [PPC] if-converter triggers assertion `!NodePtr->isKnownSentinel()`

Tue Mar 20 14:46:36 PDT 2018

https://bugs.llvm.org/show_bug.cgi?id=36825

            Bug ID: 36825
           Summary: [PPC] if-converter triggers assertion
                    `!NodePtr->isKnownSentinel()`
           Product: new-bugs
           Version: 6.0
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: new bugs
          Assignee: unassignedbugs at nondot.org
          Reporter: v.churavy at gmail.com
                CC: llvm-bugs at lists.llvm.org

Found while upgrading the Julia frontend to LLVM 6.0.

```
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/include/llvm/ADT/ilist_iterator.h:140:
llvm::ilist_iterator<OptionsT, IsReverse, IsConst>::reference
llvm::ilist_iterator<OptionsT, IsReverse, IsConst>::operator*() const [with
OptionsT = llvm::ilist_detail::node_options<llvm::MachineInstr, true, true,
void>; bool IsReverse = false; bool IsConst = false;
llvm::ilist_iterator<OptionsT, IsReverse, IsConst>::reference =
llvm::MachineInstr&]: Assertion `!NodePtr->isKnownSentinel()' failed.

signal (6): Aborted
in expression starting at sysimg.jl:213
gsignal at /lib64/libc.so.6 (unknown line)
abort at /lib64/libc.so.6 (unknown line)
__assert_fail_base at /lib64/libc.so.6 (unknown line)
__assert_fail at /lib64/libc.so.6 (unknown line)
operator* at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/include/llvm/ADT/ilist_iterator.h:140
operator* at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/include/llvm/CodeGen/MachineInstrBundleIterator.h:134
[inlined]
operator* at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/include/llvm/CodeGen/MachineInstrBundleIterator.h:179
[inlined]
operator-> at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/include/llvm/CodeGen/MachineInstrBundleIterator.h:180
[inlined]
IfConvertDiamondCommon at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/CodeGen/IfConversion.cpp:1726
IfConvertDiamond at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/CodeGen/IfConversion.cpp:1910
[inlined]
runOnMachineFunction at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/CodeGen/IfConversion.cpp:461
runOnFunction at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/CodeGen/MachineFunctionPass.cpp:62
runOnFunction at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/IR/LegacyPassManager.cpp:1520
runOnModule at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/IR/LegacyPassManager.cpp:1541
run at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/IR/LegacyPassManager.cpp:1597
run at
/raid1/home/ibm/valentin/src/julia/deps/srccache/llvm-6.0.0/lib/IR/LegacyPassManager.cpp:1731
operator() at /raid1/home/ibm/valentin/src/julia/src/jitlayers.cpp:466
Allocations: 43736398 (Pool: 43715287; Big: 21111); GC: 111
```

I am failing to isolate this failure for the last two weeks (also see
http://lists.llvm.org/pipermail/llvm-dev/2018-March/121932.html)

I nailed it down to the function `japi1__require_7687` (in gdb `MF->getName`)
and I put the log online (124MB)
https://drive.google.com/open?id=1Br0s9Qvr4tzPv8nqbnV_nWezpEH5Ci7B

The setup of the target machine is roughly equivalent to:

```
llc -O3 -fast-isel=0 -code-model=medium -mcpu=pwr8 -relocation-model=static
-emulated-tls
```

and the last Julia specific pass in the log is LowerPTLS. So a pipeline
starting from `bool-ret-to-int` should be able to re-trigger the assertion, but
to no avail. 

I compared the output of `debug-pass=Arguments` and the only difference between
the pipeline used by `llc` and `julia` post `bool-ret-to-int` is:

```
llc: -basicaa -aa -loops -branch-prob -isel -machinedomtree
-ppc-ctr-loops-verify -ppc-vsx-copy -expand-isel-pseudos
Julia: -basicaa -aa -loops -branch-prob -machinedomtree -ppc-ctr-loops-verify
-ppc-vsx-copy -expand-isel-pseudos
```

Note the additional `isel` in the llc pipeline that is missing in Julia, but I
can't find a reason why that would be true.

Some other breadcrumps:

```
Ifcvt: function (4486) 'japi1__require_7687'
Ifcvt (Diamond): %bb.38 (T:44,F:39) 

(gdb) p BBI.BB->dump()
%bb.38: derived from LLVM BB %L762
    Live Ins: %x23
    Predecessors according to CFG: %bb.37
        renamable %x3 = LD 504, %x31; mem:Volatile
LD8[%"#temp#15"](dereferenceable) dbg:loading.jl:1024
        renamable %x4 = XORI8 renamable %x3, 1; dbg:loading.jl:1024
        renamable %cr0 = CMPLDI renamable %x3, 1; dbg:loading.jl:1024
        renamable %x4 = CNTLZD killed renamable %x4; dbg:loading.jl:1024
        renamable %x4 = RLDICL killed renamable %x4, 58, 63;
dbg:loading.jl:1024
        STD killed renamable %x3, 1352, %x31; mem:ST8[%33] dbg:loading.jl:1024
        STB renamable %r4, 1351, %x31, implicit killed %x4; mem:ST1[%34]
dbg:loading.jl:1024
        renamable %x3 = ADDIStocHA %x2, @"jl_global#10"; dbg:loading.jl:1024
        renamable %x3 = LDtocL @"jl_global#10", killed renamable %x3, implicit
%x2; mem:LD8[GOT] dbg:loading.jl:1024
    Successors according to CFG: %bb.39(0x40000000 / 0x80000000 = 50.00%)
%bb.44(0x40000000 / 0x80000000 = 50.00%)
```

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20180320/93fefcf1/attachment.html>