llvm / llvm/llvm-project

[SPIR-V] Backend crashes on IR that stores a vector of pointers (`isValidElementType` assertion)

Open
#217,948 0 comments 0 reactions 0 assignees View on GitHub
backend:SPIR-V confirmed crash-on-valid regression:21
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

An application is failing to compile with clang when targeting SPIR-V. From pulling out the .bc of the compile line, and running `llvm-reduce` to get a minimal IR, it looks like the issue is from the SPIR-V backend crashing on IR that stores a vector of pointers.

The original IR comes from a HIP application compiled with chipStar at -O2 (CHIP-SPV/chipStar#1454, reported there first in case it was
chipStar-specific). The application code has a struct with several pointer members, and it looks like the optimizer turns copies of it into a vector of pointers in the IR. The reproducer below is from rerunning the failing compile with `--save-temps` to get the .bc and then running `llvm-reduce` on the .bc, resulting in `bug.ll`.

This was tested with a stock unpatched LLVM at the `llvmorg-23.1.0-rc3` tag (commit 7196f931f), built with `-DCMAKE_BUILD_TYPE=Release -DLLVM_ENABLE_ASSERTIONS=On -DLLVM_TARGETS_TO_BUILD=host DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=SPIRV`.

## Reproducer

```llvm
target triple = "spirv64"

define spir_kernel void @k(ptr addrspace(1) %src, ptr addrspace(1) %dst) {
entry:
%v = load <4 x ptr addrspace(4)>, ptr addrspace(1) %src, align 8
store <4 x ptr addrspace(4)> %v, ptr addrspace(1) %dst, align 8
ret void
}
```

## Compiling

``` bash
llc -mtriple=spirv64 bug.ll -o /dev/null
```

## Running

The fail looks like:
``` bash
> llc -mtriple=spirv64 bug.ll -o /dev/null
llc: /lus/flare/projects/Aurora_deployment/bertoni/projects/p02.chipStar/test_LLVM/llvm-project/llvm/lib/IR/Type.cpp:869: static llvm::FixedVectorType* llvm::FixedVectorType::get(llvm::Type*, unsigned int): Assertion `isValidElemen\
tType(ElementType) && "Element type of a VectorType must " "be an integer, floating point, " "pointer type, or a valid target " "extension type."' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: llc -mtriple=spirv64 bug.ll -o /dev/null
1. Running pass 'SPIRV emit intrinsics' on module 'bug.ll'.
#0 0x00000000026a5d9a llvm::sys::PrintStackTrace(llvm::raw_ostream&, int)
#1 0x00000000026a28f8 llvm::sys::RunSignalHandlers()
#2 0x00000000026a2a4b SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f30882168c0 __restore_rt (/lib64/libpthread.so.0+0x168c0)
#4 0x00007f308792fc6b raise (/lib64/libc.so.6+0x4ac6b)
#5 0x00007f3087931305 abort (/lib64/libc.so.6+0x4c305)
#6 0x00007f3087927c6a __assert_fail_base (/lib64/libc.so.6+0x42c6a)
#7 0x00007f3087927cf2 (/lib64/libc.so.6+0x42cf2)
#8 0x0000000001aaf4aa llvm::FixedVectorType::get(llvm::Type*, unsigned int)
#9 0x000000000092546d (anonymous namespace)::SPIRVEmitIntrinsics::deduceNestedTypeHelper(llvm::User*, llvm::Type*, llvm::SmallPtrSetImpl&, bool) SPIRVEmitIntrinsics.cpp:0:0
#10 0x000000000092e161 (anonymous namespace)::SPIRVEmitIntrinsics::insertPtrCastOrAssignTypeInstr(llvm::Instruction*, llvm::IRBuilder&) SPIRVEmitIntrinsics.cpp:0:0
#11 0x0000000000932305 (anonymous namespace)::SPIRVEmitIntrinsics::runOnFunction(llvm::Function&) SPIRVEmitIntrinsics.cpp:0:0
#12 0x0000000000934a15 (anonymous namespace)::SPIRVEmitIntrinsics::runOnModule(llvm::Module&) SPIRVEmitIntrinsics.cpp:0:0
#13 0x0000000001a2f992 (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) LegacyPassManager.cpp:0:0
#14 0x0000000001a300ac llvm::legacy::PassManagerImpl::run(llvm::Module&)
#15 0x0000000000842288 compileModule(char**, llvm::SmallVectorImpl&, llvm::LLVMContext&, std::__cxx11::basic_string, std::allocator>&) llc.cpp:0:0
#16 0x000000000079bf6d main
#17 0x00007f308791a24d __libc_start_main (/lib64/libc.so.6+0x3524d)
#18 0x000000000083640a _start
Aborted (core dumped)
```

- We expect this to compile cleanly, as the code is valid IR, based on `llvm-as` and `opt -passes=verify` accepting it, and `llc -mtriple=x86_64-unknown-linux-gnu` compiles the IR cleanly.

- Note that the store is what triggers it. A load of `<4 x ptr addrspace(4)>` alone fails cleanly with `error: ... Vector of pointers requires SPV_INTEL_masked_gather_scatter extension`, but the store path hits the assertion before reaching that diagnostic. Adding `--spirv-ext=all` doesn't avoid the crash either.

Thanks!

Contributor guide

Open the contributing guide

Research direction

Start with the SPIRVEmitIntrinsics pass named in the stack dump and reproduce the crash using bug.ll with `llc -mtriple=spirv64`. Compare the vector-of-pointers store path with the clean load diagnostic and existing SPIR-V handling. Done means valid IR no longer hits the `isValidElementType` assertion and produces the expected compilation result or diagnostic.

Written by the indexing model from the issue text.

Assessment

Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.