[llvm] [SystemZ] Add a SystemZ specific pre-RA scheduling strategy. (PR #135076)

Wed Mar 11 18:16:24 PDT 2026

nathanchance wrote:

I am seeing a crash when building the Linux kernel with the `allmodconfig` target after this change.

`cvise` spits out:

```c
typedef struct {
  const unsigned char *next_in;
  unsigned char *next_out;
} *z_streamp;
int dfltcc_fn;
z_streamp dfltcc_xpnd_strm;
void kmsan_unpoison_memory(long size) {}
typedef enum { DFLTCC_CC_OP2_CORRUPT } dfltcc_cc;
inline dfltcc_cc dfltcc(unsigned char **op1, const unsigned char **op2,
                        void *hist) {
  void *param = 0, *r1 = param;
  unsigned char *t2 = op1 ? *op1 : 0, *r2 = t2;
  char orig_t2 = *t2;
  long t3 = 0, t5 = 0, r3 = t3;
  const unsigned char *t4 = op2 ? *op2 : 0, *r4 = t4;
  int r0 = dfltcc_fn, cc;
  register long r5 __asm__("r5") = t5;
  __asm__ volatile(""
                   : "+r"(r2), "+r"(r3), "+r"(r4), "+r"(r5), "=r"(cc)
                   : "r"(r0), "r"(r1));
  kmsan_unpoison_memory(orig_t2);
  if (op1)
    *op1 = t2;
  return 3;
}
dfltcc_cc dfltcc_xpnd() {
  int *state = (int *)dfltcc_xpnd_strm;
  dfltcc_cc cc =
      dfltcc(&dfltcc_xpnd_strm->next_out, &dfltcc_xpnd_strm->next_in, state);
  return cc;
}
```

```
$ clang --target=s390x-linux-gnu -mtune=z196 -O2 -fno-delete-null-pointer-checks -fno-strict-overflow -c -o /dev/null dfltcc_inflate.i
clang: llvm/lib/Target/SystemZ/SystemZMachineScheduler.cpp:80: bool llvm::SystemZPreRASchedStrategy::definesCmp0Src(const MachineInstr *, bool) const: Assertion `!isPhysRegDef(MO0) && "Did not expect physreg def!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: clang --target=s390x-linux-gnu -mtune=z196 -O2 -fno-delete-null-pointer-checks -fno-strict-overflow -c -o /dev/null dfltcc_inflate.i
1.      <eof> parser at end of file
2.      Code generation
3.      Running pass 'Function Pass Manager' on module 'dfltcc_inflate.i'.
4.      Running pass 'Machine Instruction Scheduler' on function '@dfltcc_xpnd'
 #0 0x000055abd19b5a98 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (clang+0x611fa98)
 #1 0x000055abd19b2a35 llvm::sys::RunSignalHandlers() (clang+0x611ca35)
 #2 0x000055abd192df26 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007ffb7224d2d0 (/usr/lib/libc.so.6+0x3e2d0)
 #4 0x00007ffb722a7a2c (/usr/lib/libc.so.6+0x98a2c)
 #5 0x00007ffb7224d1a0 raise (/usr/lib/libc.so.6+0x3e1a0)
 #6 0x00007ffb722345fe abort (/usr/lib/libc.so.6+0x255fe)
 #7 0x00007ffb72235697 (/usr/lib/libc.so.6+0x26697)
 #8 0x00007ffb722450b2 __assert_fail (/usr/lib/libc.so.6+0x360b2)
 #9 0x000055abd0589069 (clang+0x4cf3069)
#10 0x000055abd0f86ffe llvm::ScheduleDAGMILive::schedule() (clang+0x56f0ffe)
#11 0x000055abd0f7ec2a llvm::impl_detail::MachineSchedulerBase::scheduleRegions(llvm::ScheduleDAGInstrs&, bool) (clang+0x56e8c2a)
#12 0x000055abd0f7e609 llvm::impl_detail::MachineSchedulerImpl::run(llvm::MachineFunction&, llvm::TargetMachine const&, llvm::impl_detail::MachineSchedulerImpl::RequiredAnalyses const&) (clang+0x56e8609)
#13 0x000055abd0f94b9b (anonymous namespace)::MachineSchedulerLegacy::runOnMachineFunction(llvm::MachineFunction&) MachineScheduler.cpp:0:0
#14 0x000055abd0ed7e93 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (clang+0x5641e93)
#15 0x000055abd1471898 llvm::FPPassManager::runOnFunction(llvm::Function&) (clang+0x5bdb898)
#16 0x000055abd1478fb2 llvm::FPPassManager::runOnModule(llvm::Module&) (clang+0x5be2fb2)
#17 0x000055abd1472280 llvm::legacy::PassManagerImpl::run(llvm::Module&) (clang+0x5bdc280)
#18 0x000055abd22b5038 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (clang+0x6a1f038)
#19 0x000055abd22c9a94 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (clang+0x6a33a94)
#20 0x000055abd3851169 clang::ParseAST(clang::Sema&, bool, bool) (clang+0x7fbb169)
#21 0x000055abd27cfed6 clang::FrontendAction::Execute() (clang+0x6f39ed6)
#22 0x000055abd27350ad clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (clang+0x6e9f0ad)
#23 0x000055abd28acbe2 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (clang+0x7016be2)
#24 0x000055abcf73135b cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (clang+0x3e9b35b)
#25 0x000055abcf72cef5 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>) driver.cpp:0:0
#26 0x000055abcf72f4cd int llvm::function_ref<int (llvm::SmallVectorImpl<char const*>&)>::callback_fn<clang_main(int, char**, llvm::ToolContext const&)::$_0>(long, llvm::SmallVectorImpl<char const*>&) driver.cpp:0:0
#27 0x000055abd259de69 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::$_0>(long) Job.cpp:0:0
#28 0x000055abd192dc7e llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (clang+0x6097c7e)
#29 0x000055abd259d6a3 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (clang+0x6d076a3)
#30 0x000055abd255d53c clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (clang+0x6cc753c)
#31 0x000055abd255d757 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (clang+0x6cc7757)
#32 0x000055abd257b258 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (clang+0x6ce5258)
#33 0x000055abcf72c6ee clang_main(int, char**, llvm::ToolContext const&) (clang+0x3e966ee)
#34 0x000055abcf73cfbd main (clang+0x3ea6fbd)
#35 0x00007ffb722366c1 (/usr/lib/libc.so.6+0x276c1)
#36 0x00007ffb722367f9 __libc_start_main (/usr/lib/libc.so.6+0x277f9)
#37 0x000055abcf72a8a5 _start (clang+0x3e948a5)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
ClangBuiltLinux clang version 23.0.0git (https://github.com/llvm/llvm-project.git 56a4315ee05a0cd3e803b5daf7332be4d4afac3c)
...
```

`llvm-reduce` takes that down to:

```llvm
target datalayout = "E-S64-m:e-i1:8:16-i8:8:16-i64:64-f128:64-v128:64-a:8:16-n32:64"
target triple = "s390x-unknown-linux-gnu"

define i1 @dfltcc_xpnd(ptr %0) #0 {
entry:
  %1 = tail call { ptr, i64, ptr, i64, i32 } asm sideeffect "", "=r,=r,=r,={r5},=r,r,r,0,1,2,{r5}"(i32 0, ptr null, ptr null, i64 0, ptr null, i64 0)
  %tobool.not.i = icmp eq ptr %0, null
  ret i1 %tobool.not.i
}

attributes #0 = { "tune-cpu"="z196" }
```

```
$ llc -o /dev/null reduced.ll
llc: llvm/lib/Target/SystemZ/SystemZMachineScheduler.cpp:80: bool llvm::SystemZPreRASchedStrategy::definesCmp0Src(const MachineInstr *, bool) const: Assertion `!isPhysRegDef(MO0) && "Did not expect physreg def!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.      Program arguments: llc -o /dev/null reduced.ll
1.      Running pass 'Function Pass Manager' on module 'reduced.ll'.
2.      Running pass 'Machine Instruction Scheduler' on function '@dfltcc_xpnd'
 #0 0x000056016accd578 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (llc+0x60a3578)
 #1 0x000056016acca4f5 llvm::sys::RunSignalHandlers() (llc+0x60a04f5)
 #2 0x000056016acce351 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x00007f74c3e202d0 (/usr/lib/libc.so.6+0x3e2d0)
 #4 0x00007f74c3e7aa2c (/usr/lib/libc.so.6+0x98a2c)
 #5 0x00007f74c3e201a0 raise (/usr/lib/libc.so.6+0x3e1a0)
 #6 0x00007f74c3e075fe abort (/usr/lib/libc.so.6+0x255fe)
 #7 0x00007f74c3e08697 (/usr/lib/libc.so.6+0x26697)
 #8 0x00007f74c3e180b2 __assert_fail (/usr/lib/libc.so.6+0x360b2)
 #9 0x0000560168e2f359 (llc+0x4205359)
#10 0x0000560169a31b7e llvm::ScheduleDAGMILive::schedule() (llc+0x4e07b7e)
#11 0x0000560169a296ca llvm::impl_detail::MachineSchedulerBase::scheduleRegions(llvm::ScheduleDAGInstrs&, bool) (llc+0x4dff6ca)
#12 0x0000560169a290a9 llvm::impl_detail::MachineSchedulerImpl::run(llvm::MachineFunction&, llvm::TargetMachine const&, llvm::impl_detail::MachineSchedulerImpl::RequiredAnalyses const&) (llc+0x4dff0a9)
#13 0x0000560169a3f97b (anonymous namespace)::MachineSchedulerLegacy::runOnMachineFunction(llvm::MachineFunction&) MachineScheduler.cpp:0:0
#14 0x000056016995b3f3 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (llc+0x4d313f3)
#15 0x0000560169eefe88 llvm::FPPassManager::runOnFunction(llvm::Function&) (llc+0x52c5e88)
#16 0x0000560169ef77b2 llvm::FPPassManager::runOnModule(llvm::Module&) (llc+0x52cd7b2)
#17 0x0000560169ef0900 llvm::legacy::PassManagerImpl::run(llvm::Module&) (llc+0x52c6900)
#18 0x00005601680b3916 compileModule(char**, llvm::SmallVectorImpl<llvm::PassPlugin>&, llvm::LLVMContext&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) llc.cpp:0:0
#19 0x00005601680b0de3 main (llc+0x3486de3)
#20 0x00007f74c3e096c1 (/usr/lib/libc.so.6+0x276c1)
#21 0x00007f74c3e097f9 __libc_start_main (/usr/lib/libc.so.6+0x277f9)
#22 0x00005601680ac8a5 _start (llc+0x34828a5)
```

```
# bad: [a89c152320b12022efa481180a1b863d3f25c483] [mlir][spirv] Add OpOuterProduct operation (#185959)
# good: [24bf26c057553c58e576a7cb7df89a22d2fe6961] [HLSL] Add support for groupshared args (#181886)
git bisect start 'a89c152320b12022efa481180a1b863d3f25c483' '24bf26c057553c58e576a7cb7df89a22d2fe6961'
# bad: [e55bb9ebdd73595de605f660393b5649d506e4c0] [InstCombine][profcheck] Set unknown branch weights when folding booleans (#185769)
git bisect bad e55bb9ebdd73595de605f660393b5649d506e4c0
# bad: [1b2b5efe69c82379f3cbf638c4174cf2898e3441] [lldb][test] PlatformDarwinTest.cpp: add full error message to expected assertion
git bisect bad 1b2b5efe69c82379f3cbf638c4174cf2898e3441
# good: [19a5a3536e7ac32153f845921af33fcf9c05ccce] [SPIR-V] Add overload of getConstraintType for inline asm lowering (#185422)
git bisect good 19a5a3536e7ac32153f845921af33fcf9c05ccce
# good: [aca06396f9dfe26555acf4960ffeb23d8108f614] [ORC] Flush streams in WaitingOnGraphOpStreamRecorder record ops.
git bisect good aca06396f9dfe26555acf4960ffeb23d8108f614
# good: [94f50edff80d0c0c928b71945c8e0362bc9e8c65] [CIR][AArch64] Add lowering for remaining `vabd_*` builtins (#185478)
git bisect good 94f50edff80d0c0c928b71945c8e0362bc9e8c65
# good: [f0c7f0f8d4bdac7b1127946a7959b7f4217bfed9] [lldb][PlatformDarwin][NFC] Use formatv-style format string in Locate ExecutableScriptingResourcesFromDSYM warning message (#185640)
git bisect good f0c7f0f8d4bdac7b1127946a7959b7f4217bfed9
# good: [2133002b8f38c071b41c0c99a5de299f0f2aa640] [AMDGPU] Poison invalid globals after emitting error in LowerBufferFatPointers pass (#184662)
git bisect good 2133002b8f38c071b41c0c99a5de299f0f2aa640
# bad: [2a37eb840427d722f259801ebd0dc8b4e5cab261] [Clang] Restrict AMDGCN image built-ins (#180949)
git bisect bad 2a37eb840427d722f259801ebd0dc8b4e5cab261
# bad: [56a4315ee05a0cd3e803b5daf7332be4d4afac3c] [SystemZ] Add a SystemZ specific pre-RA scheduling strategy. (#135076)
git bisect bad 56a4315ee05a0cd3e803b5daf7332be4d4afac3c
# first bad commit: [56a4315ee05a0cd3e803b5daf7332be4d4afac3c] [SystemZ] Add a SystemZ specific pre-RA scheduling strategy. (#135076)
```

https://github.com/llvm/llvm-project/pull/135076