Skip to content

[RISC-V] Assertion `MO.getParent()->getParent() == Src.getParent()' failed. #110931

@patrick-rivos

Description

@patrick-rivos

Testcase:

int a;
char b = 48;
long c[256];
int main() {
  for (long d = 163 - 161; d < b - 33; d += 2)
    a = ({
      __typeof__(0) e = ({
        __typeof__(0) f = ({ c[6]; });
        long e = c[d] ? c[d * 6] : 1;
        f > e;
      });
      a > e ? a : e;
    });
}

/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/clang -I/scratch/tc-testing/compiler-fuzz-ci/csmith-build/include -fsigned-char -fno-strict-aliasing -fwrapv -march=rv64gcv -flto -O3 -fuse-ld=lld -mrvv-vector-bits=zvl red.c -o rv64gcv.out

Reduced LLVM IR:

target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"

define i32 @main() {
for.body.preheader:
  %0 = tail call i32 @llvm.vector.reduce.smax.nxv2i32(<vscale x 2 x i32> zeroinitializer)
  store i32 %0, ptr null, align 4
  ret i32 0
}

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare i32 @llvm.vector.reduce.smax.nxv2i32(<vscale x 2 x i32>) #0

attributes #0 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }

Command/backtrace:

> /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc rv64gcv.out.0.4.opt.ll
llc: /scratch/tc-testing/tc-compiler-fuzz-trunk/llvm/llvm/lib/Target/RISCV/RISCVVectorPeephole.cpp:548: bool {anonymous}::RISCVVectorPeephole::ensureDominates(const llvm::MachineOperand&, llvm::MachineInstr&) const: Assertion `MO.getParent()->getParent() == Src.getParent()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc rv64gcv.out.0.4.opt.ll
1.      Running pass 'Function Pass Manager' on module 'rv64gcv.out.0.4.opt.ll'.
2.      Running pass 'RISC-V Vector Peephole Optimization' on function '@main'
 #0 0x000057ef368b32b0 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1ed92b0)
 #1 0x000057ef368b06bf llvm::sys::RunSignalHandlers() (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x1ed66bf)
 #2 0x000057ef368b0815 SignalHandler(int) Signals.cpp:0:0
 #3 0x00007f6439042520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007f64390969fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x00007f64390969fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x00007f64390969fc pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x00007f6439042476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x00007f64390287f3 abort ./stdlib/abort.c:81:7
 #9 0x00007f643902871b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x00007f6439039e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x000057ef3511546b (anonymous namespace)::RISCVVectorPeephole::ensureDominates(llvm::MachineOperand const&, llvm::MachineInstr&) const (.isra.0) RISCVVectorPeephole.cpp:0:0
#12 0x000057ef35115ae0 (anonymous namespace)::RISCVVectorPeephole::convertSameMaskVMergeToVMv(llvm::MachineInstr&) RISCVVectorPeephole.cpp:0:0
#13 0x000057ef35116898 (anonymous namespace)::RISCVVectorPeephole::runOnMachineFunction(llvm::MachineFunction&) RISCVVectorPeephole.cpp:0:0
#14 0x000057ef357a2217 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#15 0x000057ef35dced47 llvm::FPPassManager::runOnFunction(llvm::Function&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x13f4d47)
#16 0x000057ef35dcf199 llvm::FPPassManager::runOnModule(llvm::Module&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x13f5199)
#17 0x000057ef35dcfb51 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x13f5b51)
#18 0x000057ef35094ab6 compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0
#19 0x000057ef34fd8b06 main (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x5feb06)
#20 0x00007f6439029d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#21 0x00007f6439029e40 call_init ./csu/../csu/libc-start.c:128:20
#22 0x00007f6439029e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#23 0x000057ef3508b555 _start (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc+0x6b1555)
zsh: IOT instruction (core dumped)  /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc

Found via fuzzer

Metadata

Metadata

Assignees

No one assigned

    Labels

    backend:RISC-VcrashPrefer [crash-on-valid] or [crash-on-invalid]

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions