New flang regression: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed

[scamp-nvidia]

We do extensive testing on the latest build of upstream flang every night and we got several failures last night across multiple architectures with the above listed error. In at least one instance, I'm able to reproduce the failure very straightforwardly on a genoa system with the following test code:

test.f

      SUBROUTINE STEP_CALC
      IMPLICIT DOUBLE PRECISION(A-H,O-Z)
      INTEGER J
      PARAMETER (NMAX=16384)
C     Minimal COMMON blocks with generic names
      COMMON /BLK_POS/  ARR_A(3,-2:NMAX), ARR_B(3,-2:NMAX,5)
      COMMON /BLK_CNT/  NITEMS
      COMMON /BLK_ACC/  ARR_C(3,3)
      DIMENSION MAT_M(3,3)
      EQUIVALENCE (ARR_A(1,-2), MAT_M(1,1))
      DO 100 J = 1, NITEMS
         TMP1 = MAT_M(1,1)*ARR_B(1,J,1) + MAT_M(1,2)*ARR_B(2,J,1)
     &        + MAT_M(1,3)*ARR_B(3,J,1)
         TMP2 = MAT_M(2,1)*ARR_B(1,J,1) + MAT_M(2,2)*ARR_B(2,J,1)
     &        + MAT_M(2,3)*ARR_B(3,J,1)
         TMP3 = MAT_M(3,1)*ARR_B(1,J,1) + MAT_M(3,2)*ARR_B(2,J,1)
     &        + MAT_M(3,3)*ARR_B(3,J,1)

         ARR_C(1,1) = ARR_C(1,1) + TMP1*ARR_B(1,J,1)
         ARR_C(2,1) = ARR_C(2,1) + TMP2*ARR_B(1,J,1)
         ARR_C(3,1) = ARR_C(3,1) + TMP3*ARR_B(1,J,1)

         ARR_C(1,2) = ARR_C(1,2) + TMP1*ARR_B(2,J,1)
         ARR_C(2,2) = ARR_C(2,2) + TMP2*ARR_B(2,J,1)
         ARR_C(3,2) = ARR_C(3,2) + TMP3*ARR_B(2,J,1)

         ARR_C(1,3) = ARR_C(1,3) + TMP1*ARR_B(3,J,1)
         ARR_C(2,3) = ARR_C(2,3) + TMP2*ARR_B(3,J,1)
         ARR_C(3,3) = ARR_C(3,3) + TMP3*ARR_B(3,J,1)
100   CONTINUE
      RETURN
      END

Compiling this with a recent build of upstream flang:

[user ~]$ flang -O2  -c test.f -march=znver4
flang: /proj/build/llvm/Linux_x86_64/llvm/include/llvm/Support/Casting.h:578: decltype(auto) llvm::cast(From*) [with To = llvm::Instruction; From = llvm::Value]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: flang -fc1 -triple x86_64-unknown-linux-gnu -emit-obj -fcolor-diagnostics -mrelocation-model pic -pic-level 2 -pic-is-pie -target-cpu znver4 -floop-interchange -vectorize-loops -vectorize-slp -resource-dir /proj/llvm/Linux_x86_64/llvm/lib/clang/22 -mframe-pointer=none -O2 -o test.o -x f95 test.f
1.      Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion,loop-interchange),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O2>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "FIRModule"
2.      Running pass "slp-vectorizer" on function "step_calc_"
 #0 0x0000000004e8f8e8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) 
 #1 0x0000000004e8c784 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007f5a1b03e730 __restore_rt (/lib64/libc.so.6+0x3e730)
 #3 0x00007f5a1b08b52c __pthread_kill_implementation (/lib64/libc.so.6+0x8b52c)
 #4 0x00007f5a1b03e686 gsignal (/lib64/libc.so.6+0x3e686)
 #5 0x00007f5a1b028833 abort (/lib64/libc.so.6+0x28833)
 #6 0x00007f5a1b02875b _nl_load_domain.cold (/lib64/libc.so.6+0x2875b)
 #7 0x00007f5a1b0373c6 (/lib64/libc.so.6+0x373c6)
 #8 0x0000000007acf80a
 #9 0x00000000086311e3 canConvertToFMA(llvm::ArrayRef<llvm::Value*>, (anonymous namespace)::InstructionsState const&, llvm::DominatorTree&, llvm::DataLayout const&, llvm::TargetTransformInfo&, llvm::TargetLibraryInfo const&) SLPVectorizer.cpp:0:0
#10 0x0000000008665b0b llvm::slpvectorizer::BoUpSLP::transformNodes() 
#11 0x000000000868b8c0 llvm::SLPVectorizerPass::vectorizeStoreChain(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP&, unsigned int, unsigned int, unsigned int&) 
#12 0x000000000868d64d llvm::SLPVectorizerPass::vectorizeStores(llvm::ArrayRef<llvm::StoreInst*>, llvm::slpvectorizer::BoUpSLP&, llvm::DenseSet<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, llvm::DenseMapInfo<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, void>>&)::'lambda'(std::map<long, unsigned int, std::less<long>, std::allocator<std::pair<long const, unsigned int>>> const&)::operator()(std::map<long, unsigned int, std::less<long>, std::allocator<std::pair<long const, unsigned int>>> const&) const SLPVectorizer.cpp:0:0
#13 0x000000000868f400 llvm::SLPVectorizerPass::vectorizeStores(llvm::ArrayRef<llvm::StoreInst*>, llvm::slpvectorizer::BoUpSLP&, llvm::DenseSet<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, llvm::DenseMapInfo<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, void>>&) 
#14 0x000000000868fc77 llvm::SLPVectorizerPass::vectorizeStoreChains(llvm::slpvectorizer::BoUpSLP&) 
#15 0x0000000008690a05 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (.part.0) SLPVectorizer.cpp:0:0
#16 0x000000000869150b llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) 
#17 0x000000000749308e llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) PassBuilder.cpp:0:0
#18 0x000000000aadae21 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) 
#19 0x00000000047ef91e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) NVPTXTargetMachine.cpp:0:0
#20 0x000000000aadb2f4 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) 
#21 0x00000000047ef8de llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) NVPTXTargetMachine.cpp:0:0
#22 0x000000000aad8f51 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&)
#23 0x0000000004ef2656 Fortran::frontend::CodeGenAction::runOptimizationPipeline(llvm::raw_pwrite_stream&) 
#24 0x0000000004ef5688 Fortran::frontend::CodeGenAction::executeAction() 
#25 0x0000000004ed68ed Fortran::frontend::FrontendAction::execute() 
#26 0x0000000004eb30cb Fortran::frontend::CompilerInstance::executeAction(Fortran::frontend::FrontendAction&) 
#27 0x0000000004edf8a7 Fortran::frontend::executeCompilerInvocation(Fortran::frontend::CompilerInstance*) 
#28 0x00000000047adbbb fc1_main(llvm::ArrayRef<char const*>, char const*) 
#29 0x00000000047ad240 main
#30 0x00007f5a1b0295d0 __libc_start_call_main (/lib64/libc.so.6+0x295d0)
#31 0x00007f5a1b029680 __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x29680)
#32 0x00000000047ab96e _start 
flang-22: error: unable to execute command: Aborted (core dumped)
flang-22: error: flang frontend command failed due to signal (use -v to see invocation)
flang version 22.0.0git (https://github.com/llvm/llvm-project a82ca1b5603a4ed9598b784f703d908f32e970b8)
Target: x86_64-unknown-linux-gnu
Thread model: posix

Note that if I drop O2 to O1, it compiles. And if I drop the "march" flag, it compiles. Also note that we saw this kind of wide spread - across ARM and x86, on multiple platforms. But it definitely has an architecture dependence - the above test doesn't fail on hsw7 with the appropriate march flag.

Note that I believe the regression got introduced somewhere between 44fbeb3 and d9f9064. Because of the type complaint - I'm immediately suspicious of dbfc3ed, but if I'm reading the backtrace right, it could be in the SLP vectorizor, which would possibly point to 0bcf45e.

[gregbedwell]

In case it helps, I've just been reducing a new clang crash which looks related and bisects to #149102:

https://godbolt.org/z/rMe3bb7oq

target triple = "x86_64-unknown-unknown"

define void @widget() #0 {
bb:
  %fmul = fmul float 0.000000e+00, 0.000000e+00
  %fadd = fadd contract float %fmul, 0.000000e+00
  %fptosi = fptosi float %fadd to i32
  %sitofp = sitofp i32 %fptosi to float
  %fmul1 = fmul float 0.000000e+00, 0.000000e+00
  %fadd2 = fadd contract float %fmul1, 0.000000e+00
  %fptosi3 = fptosi float %fadd2 to i32
  %sitofp4 = sitofp i32 %fptosi3 to float
  %fmul5 = fmul float 0.000000e+00, 0.000000e+00
  %fadd6 = fadd contract float %fmul5, 0.000000e+00
  %fptosi7 = fptosi float %fadd6 to i32
  %sitofp8 = sitofp i32 %fptosi7 to float
  %getelementptr = getelementptr i8, ptr null, i64 4
  %fmul9 = fmul float 0.000000e+00, %sitofp4
  store float %fmul9, ptr %getelementptr, align 4
  %getelementptr10 = getelementptr i8, ptr null, i64 8
  %fmul11 = fmul float 0.000000e+00, %sitofp8
  store float %fmul11, ptr %getelementptr10, align 8
  %getelementptr12 = getelementptr i8, ptr null, i64 12
  %fmul13 = fmul float 0.000000e+00, %sitofp
  store float %fmul13, ptr %getelementptr12, align 4
  %getelementptr14 = getelementptr i8, ptr null, i64 16
  %fmul15 = fmul float 0.000000e+00, %sitofp4
  store float %fmul15, ptr %getelementptr14, align 8
  %getelementptr16 = getelementptr i8, ptr null, i64 20
  %fmul17 = fmul float 0.000000e+00, %sitofp8
  store float %fmul17, ptr %getelementptr16, align 4
  %getelementptr18 = getelementptr i8, ptr null, i64 24
  %fmul19 = fmul float 0.000000e+00, %sitofp
  store float %fmul19, ptr %getelementptr18, align 8
  %getelementptr20 = getelementptr i8, ptr null, i64 28
  %fmul21 = fmul float 0.000000e+00, %sitofp4
  store float %fmul21, ptr %getelementptr20, align 4
  %fmul22 = fmul float 0.000000e+00, %sitofp8
  store float %fmul22, ptr null, align 8
  ret void
}

attributes #0 = { "target-cpu"="znver2" }

opt: /root/llvm-project/llvm/include/llvm/Support/Casting.h:578: decltype(auto) llvm::cast(From*) [with To = llvm::Instruction; From = llvm::Value]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=slp-vectorizer <source>
1.	Running pass "function(slp-vectorizer)" on module "<source>"
2.	Running pass "slp-vectorizer" on function "widget"
 #0 0x000000000569bee8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x569bee8)
 #1 0x0000000005698d94 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007a3e8c242520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00007a3e8c2969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x00007a3e8c242476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x00007a3e8c2287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x00007a3e8c22871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x00007a3e8c239e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x0000000000ba97ba (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xba97ba)
 #9 0x000000000357cde3 canConvertToFMA(llvm::ArrayRef<llvm::Value*>, (anonymous namespace)::InstructionsState const&, llvm::DominatorTree&, llvm::DataLayout const&, llvm::TargetTransformInfo&, llvm::TargetLibraryInfo const&) SLPVectorizer.cpp:0:0
#10 0x00000000035b18b3 llvm::slpvectorizer::BoUpSLP::transformNodes() (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35b18b3)
#11 0x00000000035d76c0 llvm::SLPVectorizerPass::vectorizeStoreChain(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP&, unsigned int, unsigned int, unsigned int&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35d76c0)
#12 0x00000000035d941d llvm::SLPVectorizerPass::vectorizeStores(llvm::ArrayRef<llvm::StoreInst*>, llvm::slpvectorizer::BoUpSLP&, llvm::DenseSet<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, llvm::DenseMapInfo<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, void>>&)::'lambda'(std::map<long, unsigned int, std::less<long>, std::allocator<std::pair<long const, unsigned int>>> const&)::operator()(std::map<long, unsigned int, std::less<long>, std::allocator<std::pair<long const, unsigned int>>> const&) const SLPVectorizer.cpp:0:0
#13 0x00000000035db2c0 llvm::SLPVectorizerPass::vectorizeStores(llvm::ArrayRef<llvm::StoreInst*>, llvm::slpvectorizer::BoUpSLP&, llvm::DenseSet<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, llvm::DenseMapInfo<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, void>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35db2c0)
#14 0x00000000035dbbc9 llvm::SLPVectorizerPass::vectorizeStoreChains(llvm::slpvectorizer::BoUpSLP&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35dbbc9)
#15 0x00000000035dc8d5 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (.part.0) SLPVectorizer.cpp:0:0
#16 0x00000000035dd42b llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35dd42b)
#17 0x0000000002dd7eee llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2dd7eee)
#18 0x000000000548cc81 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x548cc81)
#19 0x0000000000ec75ae llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xec75ae)
#20 0x000000000548d154 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x548d154)
#21 0x000000000096a2de llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x96a2de)
#22 0x000000000548adb1 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x548adb1)
#23 0x000000000097458a llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x97458a)
#24 0x0000000000968647 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x968647)
#25 0x00007a3e8c229d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#26 0x00007a3e8c229e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#27 0x000000000095f725 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x95f725)
Program terminated with signal: SIGSEGV
Compiler returned: 139