[X86] Crash: Cannot lower EFLAGS copy when original copy def does not dominate all uses.
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
👋 Hey,
I've been running llvm's Isel fuzzer with some modifications and it discovered a crash that I think is not reported by the main OSS Fuzz bots. ([Godbolt](https://godbolt.org/z/s58j5zxqd))
This appears to have been a known issue since the code was included in [D49220](https://reviews.llvm.org/D49220). At least there appear to have been some comments to this effect.
I've attempted to minimize this, and it's probably possible to narrow down the llc flags.
I'm not sure who to tag on these types of issues; the original author, and the reviewers? @chandlerc, @topperc , @echristo
### Output
```
❯ llc -mtriple=x86_64-unknown-linux-gnu -mcpu=diamondrapids -o /dev/null ./reduced.ll
LLVM ERROR: Cannot lower EFLAGS copy when original copy def does not dominate all uses.
Stack dump:
0. Program arguments: ./build/isel-coverage/bin/llc -mtriple=x86_64-unknown-linux-gnu -mcpu=diamondrapids -o /dev/null ./reduced.ll
1. Running pass 'Function Pass Manager' on module './reduced.ll'.
2. Running pass 'X86 EFLAGS copy lowering' on function '@f'
...
#7 0x00000001005e9c58 (anonymous namespace)::X86FlagsCopyLoweringImpl::runOnMachineFunction(llvm::MachineFunction&) (/Users/afonsobordado/git/llvm-project/build/isel-coverage/bin/llc+0x1003b5c58)
#8 0x00000001005ea77c (anonymous namespace)::X86FlagsCopyLoweringLegacy::runOnMachineFunction(llvm::MachineFunction&) (/Users/afonsobordado/git/llvm-project/build/isel-coverage/bin/llc+0x1003b677c)
...
```
### LLVM IR
```llvm
define i1 @f(float %LGV, i64 %LGV1, i1 %C3, i16 %LGV10) {
BB:
%C34 = icmp ule i64 %LGV1, 0
store i1 %C34, ptr null, align 1
br label %BB1
BB1: ; preds = %BB1, %BB
%C21 = icmp ne i16 0, %LGV10
%C = fcmp ole float 0.000000e+00, %LGV
%B6 = and i1 %C21, %C
%B10 = or i1 %C3, %C34
store i1 %B10, ptr null, align 1
br i1 %B6, label %BB1, label %BB2
BB2: ; preds = %BB1
%C31 = icmp sgt i1 false, %B6
ret i1 %C31
}
```
Contributor guide
Assessment
This issue has not been assessed yet.