Skip to content

[SPIRV][HLSL] Crash in SPIRVInstructionSelector::loadHandleBeforePosition #134749

New issue
New issue
Closed as not planned
Bug
Closed as not planned
[SPIRV][HLSL] Crash in SPIRVInstructionSelector::loadHandleBeforePosition#134749
Bug
Labels
HLSLHLSL Language Supportbackend:SPIR-VcrashPrefer [crash-on-valid] or [crash-on-invalid]
@farzonl

Description

@farzonl
farzonl
opened on Apr 7, 2025

The cast to GIntrinsic is wrong
auto *HandleDef = cast<GIntrinsic>(getVRegDef(*MRI, HandleReg));

getVRegDef(*MRI, HandleReg) returns
%41:iid(s64) = G_LOAD %40:pid(p0) :: (load (s64) from %ir.14)

we are expecting this to be Intrinsic::spv_resource_handlefrombinding

Diffing the SPIRV and DirectX targets shows we are in fact missing two TypeBuffers that would have used the resource_handlefrombinding intrinsic

Image

HLSL source

https://hlsl.godbolt.org/z/a3KK9cxKa

// FLAGS: -T cs_6_0  -E main -spirv -fspv-target-env=vulkan1.3

#if defined(__spirv__) || defined(__SPIRV__)
#define REGISTER(Idx, Space)
#else
#define REGISTER(Idx, Space) : register(Idx, Space)
#endif

RWBuffer<float4> In REGISTER(u0, space0);
RWBuffer<float4> Out REGISTER(u1, space4);

[numthreads(1,1,1)]
void main(uint GI : SV_GroupIndex) {
  Out[GI] = In[GI] * In[GI];
}

LLVM IR

https://hlsl.godbolt.org/z/3cx68n68W

define void @main() local_unnamed_addr #0 {
  %1 = tail call i32 @llvm.spv.flattened.thread.id.in.group()
  %2 = tail call noundef nonnull align 16 dereferenceable(16) ptr @llvm.spv.resource.getpointer.p0.tspirv.Image_f32_5_2_0_0_2_0t(target("spirv.Image", float, 5, 2, 0, 0, 2, 0) poison, i32 %1), !dbg !58
  %3 = load <4 x float>, ptr %2, align 16, !dbg !60
  %4 = fmul reassoc nnan ninf nsz arcp afn <4 x float> %3, %3, !dbg !66
  %5 = tail call noundef nonnull align 16 dereferenceable(16) ptr @llvm.spv.resource.getpointer.p0.tspirv.Image_f32_5_2_0_0_2_0t(target("spirv.Image", float, 5, 2, 0, 0, 2, 0) poison, i32 %1), !dbg !67
  store <4 x float> %4, ptr %5, align 16, !dbg !69
  ret void
}

SPIRV MIR

Crash is on the second to last instruction
G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.store), %37:vfid(<2 x s64>), %43:pid(p0), 2, 16 :: (store (s64), align 16)

bb.1.entry:
  %2:type(s64) = OpTypeFunction %1:type(s64)
  %44:type(s64) = OpTypeFloat 32
  %45:type(s64) = OpTypeVector %44:type(s64), 4
  %46:type(s64) = OpTypePointer 7, %45:type(s64)
  %47:type(s64) = OpTypeInt 32, 0
  %48:type(s64) = OpTypeImage %44:type(s64), 5, 2, 0, 0, 2, 0
  %49:type(s64) = OpTypePointer 7, %48:type(s64)
  %50:type(s64) = OpTypeStruct %48:type(s64)
  %51:type(s64) = OpTypePointer 7, %50:type(s64)
  %53:type(s64) = OpTypePointer 7, %47:type(s64)
  %54:type(s64) = OpTypePointer 7, %51:type(s64)
  %1:type(s64) = OpTypeVoid
  %0:iid(s64) = OpFunction %1:type(s64), 2, %2:type(s64)
  OpName %0:iid(s64), 1852399981, 0
  OpEntryPoint 5, %0:iid(s64), 1852399981, 0
  %55:iid(s64) = G_CONSTANT i32 0
  %15:iid(s64) = ASSIGN_TYPE %55:iid(s64), %47:type(s64)
  %16:pid(p0) = G_GLOBAL_VALUE @_ZL2In
  %19:pid(p0) = G_GLOBAL_VALUE @_ZL3Out
  %3:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.alloca), 8
  OpName %3:pid(p0), 1936287860, 1684300078, 862531186, 26926
  %4:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.alloca), 8
  OpName %4:pid(p0), 1936287860, 1684300078, 828976754, 26926
  %5:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.alloca), 8
  OpName %5:pid(p0), 1936287860, 1684300078, 778645106, 6893161
  %6:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.alloca), 8
  OpName %6:pid(p0), 1936287860, 1684300078, 778645106, 105
  %7:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.alloca), 8
  OpName %7:pid(p0), 1936287860, 1684300078, 879308402, 0
  %8:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.alloca), 4
  OpName %8:pid(p0), 1701080649, 1684090488, 1764651620, 53
  %9:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.alloca), 8
  OpName %9:pid(p0), 1936287860, 1684300078, 828976754, 0
  %10:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.alloca), 4
  OpName %10:pid(p0), 1701080649, 1684090488, 1764651620, 50
  %11:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.alloca), 8
  OpName %11:pid(p0), 1936287860, 1684300078, 6893170
  %12:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.alloca), 4
  OpName %12:pid(p0), 1701080649, 1684090488, 1764651620, 0
  %13:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.alloca), 4
  OpName %13:pid(p0), 1630423367, 779248740, 105
  %14:iid(s64) = COPY %15:iid(s64)
  OpName %14:iid(s64), 845636978, 544040301, 1869376609, 1881170275, 1953393007, 0
  G_STORE %16:pid(p0), %6:pid(p0) :: (store (p0) into %ir.this.addr.i.i)
  %17:pid(p0) = G_LOAD %6:pid(p0) :: (load (p0) from %ir.this.addr.i.i)
  OpName %17:pid(p0), 1936287860, 778645041, 105
  G_STORE %17:pid(p0), %3:pid(p0) :: (store (p0) into %ir.this.addr.i3.i)
  %18:pid(p0) = G_LOAD %3:pid(p0) :: (load (p0) from %ir.this.addr.i3.i)
  OpName %18:pid(p0), 1936287860, 879308337, 26926
  G_STORE %19:pid(p0), %5:pid(p0) :: (store (p0) into %ir.this.addr.i.i.i)
  %20:pid(p0) = G_LOAD %5:pid(p0) :: (load (p0) from %ir.this.addr.i.i.i)
  OpName %20:pid(p0), 1936287860, 778645041, 6893161
  G_STORE %20:pid(p0), %4:pid(p0) :: (store (p0) into %ir.this.addr.i1.i)
  %21:pid(p0) = G_LOAD %4:pid(p0) :: (load (p0) from %ir.this.addr.i1.i)
  OpName %21:pid(p0), 1936287860, 845753905, 26926
  %22:iid(s64) = G_INTRINSIC intrinsic(@llvm.spv.flattened.thread.id.in.group)
  G_STORE %22:iid(s64), %13:pid(p0) :: (store (s32) into %ir.GI.addr.i)
  %23:iid(s64) = G_LOAD %13:pid(p0) :: (load (s32) from %ir.GI.addr.i)
  G_STORE %16:pid(p0), %7:pid(p0) :: (store (p0) into %ir.this.addr.i4)
  G_STORE %23:iid(s64), %8:pid(p0) :: (store (s32) into %ir.Index.addr.i5)
  %24:pid(p0) = G_LOAD %7:pid(p0) :: (load (p0) from %ir.this.addr.i4)
  OpName %24:pid(p0), 1936287860, 912862769, 0
  %25:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.gep), 0, %24:pid(p0), %15:iid(s64), %15:iid(s64)
  %26:iid(s64) = G_LOAD %25:pid(p0) :: (load (s64) from %ir.2)
  %27:iid(s64) = G_LOAD %8:pid(p0) :: (load (s32) from %ir.Index.addr.i5)
  %28:pid(p0) = G_INTRINSIC intrinsic(@llvm.spv.resource.getpointer), %26:iid(s64), %27:iid(s64)
  %29:vfid(<2 x s64>) = G_LOAD %28:pid(p0) :: (dereferenceable load (<4 x s32>) from %ir.5)
  %30:iid(s64) = G_LOAD %13:pid(p0) :: (load (s32) from %ir.GI.addr.i)
  G_STORE %16:pid(p0), %9:pid(p0) :: (store (p0) into %ir.this.addr.i1)
  G_STORE %30:iid(s64), %10:pid(p0) :: (store (s32) into %ir.Index.addr.i2)
  %31:pid(p0) = G_LOAD %9:pid(p0) :: (load (p0) from %ir.this.addr.i1)
  OpName %31:pid(p0), 1936287860, 862531121, 0
  %32:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.gep), 0, %31:pid(p0), %15:iid(s64), %15:iid(s64)
  %33:iid(s64) = G_LOAD %32:pid(p0) :: (load (s64) from %ir.8)
  %34:iid(s64) = G_LOAD %10:pid(p0) :: (load (s32) from %ir.Index.addr.i2)
  %35:pid(p0) = G_INTRINSIC intrinsic(@llvm.spv.resource.getpointer), %33:iid(s64), %34:iid(s64)
  %36:vfid(<2 x s64>) = G_LOAD %35:pid(p0) :: (dereferenceable load (<4 x s32>) from %ir.11)
  %52:vfid(<2 x s64>) = nnan ninf nsz arcp afn reassoc G_FMUL %29:vfid, %36:vfid
  %37:vfid(<2 x s64>) = nnan ninf nsz arcp afn reassoc ASSIGN_TYPE %52:vfid(<2 x s64>), %45:type(s64)
  OpName %37:vfid(<2 x s64>), 778859885, 105
  %38:iid(s64) = G_LOAD %13:pid(p0) :: (load (s32) from %ir.GI.addr.i)
  G_STORE %19:pid(p0), %11:pid(p0) :: (store (p0) into %ir.this.addr.i)
  G_STORE %38:iid(s64), %12:pid(p0) :: (store (s32) into %ir.Index.addr.i)
  %39:pid(p0) = G_LOAD %11:pid(p0) :: (load (p0) from %ir.this.addr.i)
  OpName %39:pid(p0), 1936287860, 6893105
  OpName %50:type(s64), 1935764579, 1818766963, 976907379, 1967282002, 1919247974, 0
  %40:pid(p0) = G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.gep), 0, %39:pid(p0), %15:iid(s64), %15:iid(s64)
  %41:iid(s64) = G_LOAD %40:pid(p0) :: (load (s64) from %ir.14)
  OpName %48:type(s64), 1919512691, 1833512566, 6645601
  %42:iid(s64) = G_LOAD %12:pid(p0) :: (load (s32) from %ir.Index.addr.i)
  %43:pid(p0) = G_INTRINSIC intrinsic(@llvm.spv.resource.getpointer), %41:iid(s64), %42:iid(s64)
  G_INTRINSIC_W_SIDE_EFFECTS intrinsic(@llvm.spv.store), %37:vfid(<2 x s64>), %43:pid(p0), 2, 16 :: (store (s64), align 16)
  OpReturn

Crash Dump

https://hlsl.godbolt.org/z/T1s7fK83q

Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-trunk/bin/clang --driver-mode=dxc -Zi -Qembed_debug -Fc /app/output.s -fcolor-diagnostics -fno-crash-diagnostics -T cs_6_0 -E main -spirv -fspv-target-env=vulkan1.3 <source>
1.	<eof> parser at end of file
2.	Code generation
3.	Running pass 'Function Pass Manager' on module '<source>'.
4.	Running pass 'InstructionSelect' on function '@main'
 #0 0x0000000003b9cae8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3b9cae8)
 #1 0x0000000003b9ac2c llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3b9ac2c)
 #2 0x0000000003aeb558 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007c72b7a42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00000000022e820f llvm::foldImm(llvm::MachineOperand const&, llvm::MachineRegisterInfo const*) (/opt/compiler-explorer/clang-trunk/bin/clang+0x22e820f)
 #5 0x000000000232d23b (anonymous namespace)::SPIRVInstructionSelector::loadHandleBeforePosition(llvm::Register&, llvm::MachineInstr const*, llvm::GIntrinsic&, llvm::MachineInstr&) const (.isra.0) SPIRVInstructionSelector.cpp:0:0
 #6 0x000000000232f007 (anonymous namespace)::SPIRVInstructionSelector::selectStore(llvm::MachineInstr&) const SPIRVInstructionSelector.cpp:0:0
 #7 0x000000000233e363 (anonymous namespace)::SPIRVInstructionSelector::selectIntrinsic(llvm::Register, llvm::MachineInstr const*, llvm::MachineInstr&) const SPIRVInstructionSelector.cpp:0:0
 #8 0x0000000002340f69 (anonymous namespace)::SPIRVInstructionSelector::spvSelect(llvm::Register, llvm::MachineInstr const*, llvm::MachineInstr&) const SPIRVInstructionSelector.cpp:0:0
 #9 0x00000000023444e9 (anonymous namespace)::SPIRVInstructionSelector::select(llvm::MachineInstr&) SPIRVInstructionSelector.cpp:0:0
#10 0x0000000004c051eb llvm::InstructionSelect::selectMachineFunction(llvm::MachineFunction&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x4c051eb)
#11 0x0000000004c06875 llvm::InstructionSelect::runOnMachineFunction(llvm::MachineFunction&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x4c06875)
#12 0x0000000002f98778 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#13 0x000000000350a432 llvm::FPPassManager::runOnFunction(llvm::Function&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x350a432)
#14 0x000000000350a6c1 llvm::FPPassManager::runOnModule(llvm::Module&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x350a6c1)
#15 0x000000000350c029 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x350c029)
#16 0x0000000003e464ad clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3e464ad)
#17 0x00000000044d26c5 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x44d26c5)
#18 0x00000000060e8dec clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+0x60e8dec)
#19 0x00000000044d2d9d clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-trunk/bin/clang+0x44d2d9d)
#20 0x00000000047ddc21 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-trunk/bin/clang+0x47ddc21)
#21 0x000000000475c38b clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x475c38b)
#22 0x00000000048cdfd3 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-trunk/bin/clang+0x48cdfd3)
#23 0x0000000000d75af1 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-trunk/bin/clang+0xd75af1)
#24 0x0000000000d6e2ed ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#25 0x0000000004544a49 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#26 0x0000000003aeb973 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3aeb973)
#27 0x0000000004544c69 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#28 0x000000000450834d clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-trunk/bin/clang+0x450834d)
#29 0x0000000004509311 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-trunk/bin/clang+0x4509311)
#30 0x000000000451365c clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x451365c)
#31 0x0000000000d728c1 clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-trunk/bin/clang+0xd728c1)
#32 0x0000000000c325d4 main (/opt/compiler-explorer/clang-trunk/bin/clang+0xc325d4)
#33 0x00007c72b7a29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#34 0x00007c72b7a29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#35 0x0000000000d6dd85 _start (/opt/compiler-explorer/clang-trunk/bin/clang+0xd6dd85)
clang: error: clang frontend command failed with exit code 139 (use -v to see invocation)

Metadata

Metadata

Assignees

No one assigned

    Labels

    HLSLHLSL Language Supportbackend:SPIR-VcrashPrefer [crash-on-valid] or [crash-on-invalid]

    Type

    Bug

    Projects

    HLSL Support

    Status

    Closed

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions