[AMDGPU] Initialize FrameOffsetReg for amdgpu_cs_chain functions

Functions with the amdgpu_cs_chain calling convention were not
initializing FrameOffsetReg, leaving it as FP_REG.
This caused machine code verification failures
as SCRATCH_STORE_DWORD_SADDR instructions require the saddr
operand to be in the SReg_32_XEXEC_HI register class.

This LLVM defect was identified via the AMD Fuzzing project.

Author: jofrn

llvm/lib/Target/AMDGPU/SIMachineFunctionInfo.cpp

@@ -98,6 +98,7 @@ SIMachineFunctionInfo::SIMachineFunctionInfo(const Function &F,
     // set one up. For now, we can use s32 to match what amdgpu_gfx functions
     // would use if called, but this can be revisited.
     // FIXME: Only reserve this if we actually need it.
+    FrameOffsetReg = AMDGPU::SGPR33;
     StackPtrOffsetReg = AMDGPU::SGPR32;
 
     ScratchRSrcReg = AMDGPU::SGPR48_SGPR49_SGPR50_SGPR51;

llvm/test/CodeGen/AMDGPU/amdgpu-cs-chain-frame-pointer.ll

@@ -0,0 +1,64 @@
+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py UTC_ARGS: --version 5
+; RUN: llc -global-isel=1 -mtriple=amdgcn -mcpu=gfx942 -O0 -verify-machineinstrs < %s | FileCheck %s
+
+define amdgpu_cs_chain void @indirect(ptr %callee) {
+; CHECK-LABEL: indirect:
+; CHECK:       ; %bb.0:
+; CHECK-NEXT:    s_waitcnt vmcnt(0) expcnt(0) lgkmcnt(0)
+; CHECK-NEXT:    s_mov_b32 s32, 16
+; CHECK-NEXT:    s_xor_saveexec_b64 s[0:1], -1
+; CHECK-NEXT:    scratch_store_dword off, v40, off ; 4-byte Folded Spill
+; CHECK-NEXT:    scratch_store_dword off, v41, off offset:4 ; 4-byte Folded Spill
+; CHECK-NEXT:    s_mov_b64 exec, s[0:1]
+; CHECK-NEXT:    ; implicit-def: $sgpr6_sgpr7
+; CHECK-NEXT:    ; implicit-def: $sgpr10_sgpr11
+; CHECK-NEXT:    ; implicit-def: $sgpr0
+; CHECK-NEXT:    s_mov_b32 s1, 0
+; CHECK-NEXT:    ; implicit-def: $vgpr40 : SGPR spill to VGPR lane
+; CHECK-NEXT:    v_writelane_b32 v40, s1, 0
+; CHECK-NEXT:    v_mov_b32_e32 v0, s1
+; CHECK-NEXT:    v_mov_b32_e32 v1, s1
+; CHECK-NEXT:    s_mov_b64 s[4:5], s[6:7]
+; CHECK-NEXT:    s_mov_b64 s[8:9], 36
+; CHECK-NEXT:    s_mov_b32 s12, s0
+; CHECK-NEXT:    s_mov_b32 s13, s0
+; CHECK-NEXT:    s_mov_b32 s14, s0
+; CHECK-NEXT:    s_mov_b32 s15, s0
+; CHECK-NEXT:    v_mov_b32_e32 v31, s0
+; CHECK-NEXT:    s_getpc_b64 s[0:1]
+; CHECK-NEXT:    s_add_u32 s0, s0, indirect@gotpcrel32@lo+4
+; CHECK-NEXT:    s_addc_u32 s1, s1, indirect@gotpcrel32@hi+12
+; CHECK-NEXT:    s_load_dwordx2 s[0:1], s[0:1], 0x0
+; CHECK-NEXT:    s_waitcnt lgkmcnt(0)
+; CHECK-NEXT:    s_swappc_b64 s[30:31], s[0:1]
+; CHECK-NEXT:    v_readlane_b32 s3, v40, 0
+; CHECK-NEXT:    s_nop 1
+; CHECK-NEXT:    v_mov_b32_e32 v0, s3
+; CHECK-NEXT:    s_nop 0
+; CHECK-NEXT:    v_readfirstlane_b32 s0, v0
+; CHECK-NEXT:    v_mov_b32_e32 v0, s3
+; CHECK-NEXT:    s_nop 0
+; CHECK-NEXT:    v_readfirstlane_b32 s1, v0
+; CHECK-NEXT:    v_mov_b32_e32 v0, s3
+; CHECK-NEXT:    s_nop 0
+; CHECK-NEXT:    v_readfirstlane_b32 s2, v0
+; CHECK-NEXT:    v_mov_b32_e32 v8, s3
+; CHECK-NEXT:    s_mov_b32 s4, 0
+; CHECK-NEXT:    v_mov_b32_e32 v9, s4
+; CHECK-NEXT:    v_mov_b32_e32 v10, s3
+; CHECK-NEXT:    v_mov_b32_e32 v11, s3
+; CHECK-NEXT:    s_mov_b64 s[4:5], 0
+; CHECK-NEXT:    v_readlane_b32 s3, v41, 0
+; CHECK-NEXT:    s_xor_saveexec_b64 s[6:7], -1
+; CHECK-NEXT:    scratch_load_dword v40, off, s33 ; 4-byte Folded Reload
+; CHECK-NEXT:    scratch_load_dword v41, off, s33 offset:4 ; 4-byte Folded Reload
+; CHECK-NEXT:    s_mov_b64 exec, s[6:7]
+; CHECK-NEXT:    s_mov_b32 s33, s3
+; CHECK-NEXT:    s_mov_b64 exec, 0
+; CHECK-NEXT:    s_setpc_b64 s[4:5]
+  call void @indirect(ptr null)
+  call void (ptr, i64, <3 x i32>, { i32, ptr addrspace(5), i32, i32 }, i32, ...) @llvm.amdgcn.cs.chain.p0.i64.v3i32.sl_i32p5i32i32s(ptr null, i64 0, <3 x i32> inreg zeroinitializer, { i32, ptr addrspace(5), i32, i32 } zeroinitializer, i32 0)
+  unreachable
+}
+
+declare void @llvm.amdgcn.cs.chain.p0.i64.v3i32.sl_i32p5i32i32s(ptr, i64, <3 x i32>, { i32, ptr addrspace(5), i32, i32 }, i32 immarg, ...)