llvm / llvm/llvm-project

[MIPS] "Wrong operand type!" expanding a half vector shufflevector with +msa

Open
#223,618 1 comment 0 reactions 0 assignees View on GitHub
backend:MIPS confirmed crash-on-valid regression:23
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

`llc` asserts on any `shufflevector` of a `half` vector once MSA is enabled.

```llvm
define <8 x half> @f(<8 x half> %a) {
%s = shufflevector <8 x half> %a, <8 x half> poison, <8 x i32> zeroinitializer
ret <8 x half> %s
}
```

```
$ llc -mtriple=mips64-linux-gnu -mcpu=mips64r5 -mattr=+msa
llc: llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp:1254: void llvm::SelectionDAG::verifyNode(llvm::SDNode*) const: Assertion `(Op.getValueType() == EltVT || (EltVT.isInteger() && Op.getValueType().isInteger() && EltVT.bitsLE(Op.getValueType()))) && "Wrong operand type!"' failed.
...
2. Running pass 'MIPS DAG->DAG Pattern Instruction Selection' on function '@f'
#14 llvm::SelectionDAG::verifyNode(llvm::SDNode*) const
#15 llvm::SelectionDAG::InsertNode(llvm::SDNode*)
#16 llvm::SelectionDAG::getNode(unsigned int, llvm::SDLoc const&, llvm::EVT, llvm::ArrayRef, llvm::SDNodeFlags)
#17 (anonymous namespace)::SelectionDAGLegalize::ExpandNode(llvm::SDNode*)
#18 (anonymous namespace)::SelectionDAGLegalize::LegalizeOp(llvm::SDNode*)
```

The mask does not matter, a reverse or a single swap fails the same way. So does `<4 x half>`, and 32 bit with `-mcpu=mips32r5 -mattr=+msa,+fp64`.

The VECTOR_SHUFFLE expansion in LegalizeDAG only expects the element type to shrink:

```cpp
if (!TLI.isTypeLegal(EltVT)) {
EVT NewEltVT = TLI.getTypeToTransformTo(*DAG.getContext(), EltVT);
...
if (NewEltVT.bitsLT(EltVT)) {
// rewrites VT and the mask
}
EltVT = NewEltVT;
}
```

`f16` is soft promoted, so `getTypeToTransformTo` returns `f32`, `NewEltVT.bitsLT(EltVT)` is false and `VT` stays `v8f16`, but `EltVT` is overwritten with `f32` anyway. The loop right below then builds `f32` `EXTRACT_VECTOR_ELT`s and feeds them to a `v8f16` `BUILD_VECTOR`, which is what trips the assertion.

Reproduced at 90f36e05255e. Related to #202808.

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with the shown llc command, then inspect the VECTOR_SHUFFLE expansion in LegalizeDAG and the type checks in llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp. Trace how getTypeToTransformTo changes EltVT for f16, and verify the fix across the half-vector sizes and MIPS configurations described; done means llc no longer asserts and the shuffle is expanded with matching operand types.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.