llvm / llvm/llvm-project

[X86] Crash: Cannot lower EFLAGS copy when original copy def does not dominate all uses.

Open
#223,282 2 comments 0 reactions 1 assignee Claimed by @fzou1 View on GitHub
backend:X86 confirmed crash-on-valid generated by fuzzer regression:23
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

👋 Hey,

I've been running llvm's Isel fuzzer with some modifications and it discovered a crash that I think is not reported by the main OSS Fuzz bots. ([Godbolt](https://godbolt.org/z/s58j5zxqd))

This appears to have been a known issue since the code was included in [D49220](https://reviews.llvm.org/D49220). At least there appear to have been some comments to this effect.

I've attempted to minimize this, and it's probably possible to narrow down the llc flags.

I'm not sure who to tag on these types of issues; the original author, and the reviewers? @chandlerc, @topperc , @echristo

### Output

```
❯ llc -mtriple=x86_64-unknown-linux-gnu -mcpu=diamondrapids -o /dev/null ./reduced.ll

LLVM ERROR: Cannot lower EFLAGS copy when original copy def does not dominate all uses.
Stack dump:
0. Program arguments: ./build/isel-coverage/bin/llc -mtriple=x86_64-unknown-linux-gnu -mcpu=diamondrapids -o /dev/null ./reduced.ll
1. Running pass 'Function Pass Manager' on module './reduced.ll'.
2. Running pass 'X86 EFLAGS copy lowering' on function '@f'
...
#7 0x00000001005e9c58 (anonymous namespace)::X86FlagsCopyLoweringImpl::runOnMachineFunction(llvm::MachineFunction&) (/Users/afonsobordado/git/llvm-project/build/isel-coverage/bin/llc+0x1003b5c58)
#8 0x00000001005ea77c (anonymous namespace)::X86FlagsCopyLoweringLegacy::runOnMachineFunction(llvm::MachineFunction&) (/Users/afonsobordado/git/llvm-project/build/isel-coverage/bin/llc+0x1003b677c)
...

```

### LLVM IR

```llvm
define i1 @f(float %LGV, i64 %LGV1, i1 %C3, i16 %LGV10) {
BB:
%C34 = icmp ule i64 %LGV1, 0
store i1 %C34, ptr null, align 1
br label %BB1

BB1: ; preds = %BB1, %BB
%C21 = icmp ne i16 0, %LGV10
%C = fcmp ole float 0.000000e+00, %LGV
%B6 = and i1 %C21, %C
%B10 = or i1 %C3, %C34
store i1 %B10, ptr null, align 1
br i1 %B6, label %BB1, label %BB2

BB2: ; preds = %BB1
%C31 = icmp sgt i1 false, %B6
ret i1 %C31
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.