r305918 and "Bad machine code: Using an undefined physical register"

[Kuba Mracek via llvm-commits]

Here's a minimal reproducer (preprocessed):

int vscanf(const char *format, __builtin_va_list ap);
extern int global1;
extern int global2;
int wrap_vscanf(const char *format, __builtin_va_list ap) {
  __builtin_va_list aq;
  __builtin_va_copy(aq, ap);
  vscanf(format, ap);
  __builtin_va_end(aq);
  return 0;
}
int wrap_scanf(const char *format, ...) {
  __builtin_va_list ap;
  __builtin_va_start(ap, format);
  if (global1)
    return vscanf(format, ap);
  if (global2)
    return vscanf(format, ap);
  wrap_vscanf(format, ap);
  __builtin_va_end(ap);
  return 0;
}

If you run this on a LLVM TOT build with -DLLVM_ENABLE_EXPENSIVE_CHECKS=On (or actually, you can just un-ifdef the one extra verification in TargetPassConfig::addVerifyPass), you get:

$ ./bin/clang -arch arm64 -O3 -x c a.c
# After AArch64 load / store optimization pass
...
  fi#-1: size=4, align=16, fixed, at location [SP]
  fi#0: size=8, align=8, at location [SP-24]
  fi#1: size=8, align=8, at location [SP-32]
  fi#2: size=8, align=8, at location [SP-40]
  fi#3: size=8, align=8, at location [SP-8]
  fi#4: size=8, align=8, at location [SP-16]
...
BB#4: derived from LLVM BB %17
    Live Ins: %X0 %X1
    Predecessors according to CFG: BB#2
	STURXi %X1, %FP, -8; mem:ST8[%2](tbaa=!4)
	%X8<def> = ORRXrs %XZR, %X1<kill>, 0
	STRXui %X8<kill>, %SP, 2; mem:ST8[%20]
	BL <ga:@vscanf>, <regmask %FP %LR %B8 %B9 %B10 %B11 %B12 %B13 %B14 %B15 %D8 %D9 %D10 %D11 %D12 %D13 %D14 %D15 %H8 %H9 %H10 %H11 %H12 %H13 %H14 %H15 %S8 %S9 %S10 %S11 %S12 %S13 %S14 %S15 %W19 %W20 %W21 %W22 %W23 %W24 %W25 %W26 %W27 %W28 %W29 %W30 %X19 %X20 %X21 %X22 %X23 %X24 %X25 %X26 %X27 %X28 %D8_D9 %D9_D10 %D10_D11 %D11_D12 %D12_D13 %D13_D14 %D14_D15 %D8_D9_D10_D11 %D9_D10_D11_D12 %D10_D11_D12_D13 %D11_D12_D13_D14 %D12_D13_D14_D15 %D8_D9_D10 %D9_D10_D11 %D10_D11_D12 %D11_D12_D13 %D12_D13_D14 %D13_D14_D15 %W19_W20 %W20_W21 %W21_W22 %W22_W23 %W23_W24 %W24_W25 %W25_W26 %W26_W27 %W27_W28 %W28_W29 %W29_W30 %FP_LR %X28_FP %X19_X20 %X20_X21 %X21_X22 %X22_X23 %X23_X24 %X24_X25 %X25_X26 %X26_X27 %X27_X28>, %LR<imp-def,dead>, %SP<imp-use>, %X0<imp-use>, %X1<imp-use>, %SP<imp-def>, %W0<imp-def,dead>
	%W0<def> = MOVZWi 0, 0
    Successors according to CFG: BB#5(?%)

...
# End machine code for function wrap_scanf.

*** Bad machine code: Using an undefined physical register ***
- function:    wrap_scanf
- basic block: BB#4  (0x7fb3f00f50e0)
- instruction: BL
- operand 5:   %X1<imp-use>
fatal error: error in backend: Found 1 machine code errors.
...

Kuba


> On 26 Jun 2017, at 10:09, Tim Northover via llvm-commits <llvm-commits at lists.llvm.org> wrote:
> 
>> I think what's actually happening is that parent code is forwarding from the second register in an STP, but r305918 is trying to get the kill flag from the first (unaware that a pair is involved at all). I'll ping the person who wrote it.
> 
> Nope, that doesn't work either. isMatchingStore only allows non-paired operations. So I still don't know what's going on.
> 
> Tim.
> _______________________________________________
> llvm-commits mailing list
> llvm-commits at lists.llvm.org
> http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-commits

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20170626/8594137c/attachment.html>