[llvm] SLPVectorizer: Avoid looking at uselists of constants (PR #134578)

Fri Apr 11 19:08:08 PDT 2025

alexfh wrote:

We're seeing Clang crashes after this commit. The same setup didn't cause any problems before, and I verified that this only started happening after 65c7ea713e0b411a707b0ccac374bda9f30234ea.

The crash is happening in very specific circumstances, which are not trivial to reproduce and reason about, so I fully realize that the problem may be elsewhere, and this commit is just a trigger.

The way I can consistently reproduce the crash is:
1. bootstrap clang in plain opt mode (`-O3`)
2. build instrumented clang (`-fprofile-generate=...`)
3. using instrumented clang, run a number compilations of representative code samples with a few sets of options each
4. merge the resulting profiles
5. build clang with the resulting profile (`-fprofile-use=...`) and context-sensitive profile instrumentation (`-fcs-profile-generate=...`)
6. and this CSFDO-instrumented clang crashes on some piece of the code (the same IR doesn't cause crashes for other clang builds)

So far I figured out that changing the set of inputs used in step 3 can make the crash disappear.

The crash stack trace looks like this:
```
1.      <eof> parser at end of file
2.      Optimizer
3.      Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,chr,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O3>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "bcm.cc"
4.      Running pass "slp-vectorizer" on function "_ZL8keccak_fPm"
 #0 0x0000557db1db479b llvm::sys::CleanupOnSignal(unsigned long)
 #1 0x0000557db1d8daca (anonymous namespace)::CrashRecoveryContextImpl::HandleCrash(int, unsigned long)
 #2 0x0000557db1d8dce1 CrashRecoverySignalHandler(int) (.llvm.1583429734693567393)
 #3 0x00007f6df9192e80 __restore_rt (/usr/grte/v5/lib64/libpthread.so.0+0x14e80)
 #4 0x0000557dad590315 llvm::SLPVectorizerPass::vectorizeStores(llvm::ArrayRef<llvm::StoreInst*>, llvm::slpvectorizer::BoUpSLP&, llvm::DenseSet<std::__u::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, llvm::DenseMapInfo<std::__u::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, void>>&)::$_0::operator()(std::__u::map<int, unsigned int, std::__u::less<int>, std::__u::allocator<std::__u::pair<int const, unsigned int>>> const&) const (.cold)
 #5 0x0000557dac3c4185 llvm::SLPVectorizerPass::vectorizeStores(llvm::ArrayRef<llvm::StoreInst*>, llvm::slpvectorizer::BoUpSLP&, llvm::DenseSet<std::__u::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, llvm::DenseMapInfo<std::__u::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, void>>&)
 #6 0x0000557dac5e6129 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*)
 #7 0x0000557dabb87d05 llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&)
 #8 0x0000557dabb87a59 llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&)
 #9 0x0000557dac668e9b llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&)
#10 0x0000557dac65a0fc llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&)
#11 0x0000557dabe44b19 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&)
#12 0x0000557dabd48eb5 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&)
#13 0x0000557dadf94c7d (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::__u::unique_ptr<llvm::raw_pwrite_stream, std::__u::default_delete<llvm::raw_pwrite_stream>>&, std::__u::unique_ptr<llvm::ToolOutputFile, std::__u::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*)
#14 0x0000557daca5f557 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::__u::unique_ptr<llvm::raw_pwrite_stream, std::__u::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (.cold)
#15 0x0000557dadd13b70 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&)
#16 0x0000557dae9a2e9a clang::ParseAST(clang::Sema&, bool, bool)
#17 0x0000557dabddc381 clang::FrontendAction::Execute()
#18 0x0000557dabddc1a5 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&)
#19 0x0000557dabdd4c8e clang::ExecuteCompilerInvocation(clang::CompilerInstance*)
#20 0x0000557dabdd609b cc1_main(llvm::ArrayRef<char const*>, char const*, void*)
#21 0x0000557dabdd5045 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) (.llvm.5713672688515963801)
#22 0x0000557dabe49405 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::__u::optional<llvm::StringRef>>, std::__u::basic_string<char, std::__u::char_traits<char>, std::__u::allocator<char>>*, bool*) const::$_0>(long) (.llvm.12200153564871006636)
#23 0x0000557dabde9e99 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>)
#24 0x0000557dabde9d3e clang::driver::CC1Command::Execute(llvm::ArrayRef<std::__u::optional<llvm::StringRef>>, std::__u::basic_string<char, std::__u::char_traits<char>, std::__u::allocator<char>>*, bool*) const
#25 0x0000557dabc97391 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const
#26 0x0000557dabc97137 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::__u::pair<int, clang::driver::Command const*>>&)
#27 0x0000557dac4b1752 clang_main(int, char**, llvm::ToolContext const&)
#28 0x0000557dabc91c9f main
```

https://github.com/llvm/llvm-project/pull/134578