LLVM 21.1.0 - ICE on eigen's basicstuff.cpp

[peter-joo]

This is the ICE made by:
https://github.com/llvm/llvm-project/releases/download/llvmorg-21.1.0/LLVM-21.1.0-Linux-X64.tar.xz

as:

clang++ -DEIGEN_CHOLMOD_SUPPORT -DEIGEN_DONT_VECTORIZE=1 -DEIGEN_KLU_SUPPORT -DEIGEN_SPQR_SUPPORT -DEIGEN_SUPERLU_SUPPORT -DEIGEN_UMFPACK_SUPPORT -I$HOME/eigen_src -I/usr/include/suitesparse -I/usr/include/superlu -I$HOME/eigen_boost_install/include -std=c++03 -pedantic -Wall -Wextra -Wundef -Wcast-align -Wchar-subscripts -Wnon-virtual-dtor -Wunused-local-typedefs -Wpointer-arith -Wwrite-strings -Wformat-security -Wshorten-64-to-32 -Wenum-conversion -Wc++11-extensions -Wdouble-promotion -Wshadow -Wno-psabi -Wno-variadic-macros -Wno-long-long -fno-check-new -msse2 -msse3 -mssse3 -msse4.1 -msse4.2 -mavx -mfma -mavx2 -mfma -mavx512f -mfma -mavx512dq -mf16c -O3 -DNDEBUG  -DEIGEN_TEST_MAX_SIZE=320  -DEIGEN_TEST_PART_ALL=1 -MD -MT test/CMakeFiles/basicstuff.dir/basicstuff.cpp.o -MF test/CMakeFiles/basicstuff.dir/basicstuff.cpp.o.d -o test/CMakeFiles/basicstuff.dir/basicstuff.cpp.o -c $HOME/eigen_src/test/basicstuff.cpp
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.  Program arguments: clang++ -DEIGEN_CHOLMOD_SUPPORT -DEIGEN_DONT_VECTORIZE=1 -DEIGEN_KLU_SUPPORT -DEIGEN_SPQR_SUPPORT -DEIGEN_SUPERLU_SUPPORT -DEIGEN_UMFPACK_SUPPORT -I$HOME/eigen_src -I/usr/include/suitesparse -I/usr/include/superlu -I$HOME/eigen_boost_install/include -std=c++03 -pedantic -Wall -Wextra -Wundef -Wcast-align -Wchar-subscripts -Wnon-virtual-dtor -Wunused-local-typedefs -Wpointer-arith -Wwrite-strings -Wformat-security -Wshorten-64-to-32 -Wenum-conversion -Wc++11-extensions -Wdouble-promotion -Wshadow -Wno-psabi -Wno-variadic-macros -Wno-long-long -fno-check-new -msse2 -msse3 -mssse3 -msse4.1 -msse4.2 -mavx -mfma -mavx2 -mfma -mavx512f -mfma -mavx512dq -mf16c -O3 -DNDEBUG -DEIGEN_TEST_MAX_SIZE=320 -DEIGEN_TEST_PART_ALL=1 -MD -MT test/CMakeFiles/basicstuff.dir/basicstuff.cpp.o -MF test/CMakeFiles/basicstuff.dir/basicstuff.cpp.o.d -o test/CMakeFiles/basicstuff.dir/basicstuff.cpp.o -c $HOME/eigen_src/test/basicstuff.cpp -std=c++23 -stdlib=libstdc++
1.  <eof> parser at end of file
2.  Code generation
3.  Running pass 'Function Pass Manager' on module '$HOME/eigen_src/test/basicstuff.cpp'.
4.  Running pass 'X86 DAG->DAG Instruction Selection' on function '@_ZN12casting_testIbN5Eigen8bfloat16EE3runEv'
 #0 0x00005621b4a324a8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (clang+++0x34e14a8)
 #1 0x00005621b4a31325 llvm::sys::RunSignalHandlers() (clang+++0x34e0325)
 #2 0x00005621b4991369 (clang+++0x3440369)
 #3 0x00007f03ba43e540 (/usr/lib/libc.so.6+0x3e540)
 #4 0x00005621b68aa1f0 llvm::SelectionDAG::RemoveNodeFromCSEMaps(llvm::SDNode*) (clang+++0x53591f0)
 #5 0x00005621b6726ef0 (clang+++0x51d5ef0)
 #6 0x00005621b6727ac1 llvm::SelectionDAG::Combine(llvm::CombineLevel, llvm::BatchAAResults*, llvm::CodeGenOptLevel) (clang+++0x51d6ac1)
 #7 0x00005621b6910db0 llvm::SelectionDAGISel::CodeGenAndEmitDAG() (clang+++0x53bfdb0)
 #8 0x00005621b6910307 llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (clang+++0x53bf307)
 #9 0x00005621b690d012 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (clang+++0x53bc012)
#10 0x00005621b39ff697 (clang+++0x24ae697)
#11 0x00005621b690a184 llvm::SelectionDAGISelLegacy::runOnMachineFunction(llvm::MachineFunction&) (clang+++0x53b9184)
#12 0x00005621b3f1c213 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (clang+++0x29cb213)
#13 0x00005621b44ccb95 llvm::FPPassManager::runOnFunction(llvm::Function&) (clang+++0x2f7bb95)
#14 0x00005621b44d7bbc llvm::FPPassManager::runOnModule(llvm::Module&) (clang+++0x2f86bbc)
#15 0x00005621b44d07f8 llvm::legacy::PassManagerImpl::run(llvm::Module&) (clang+++0x2f7f7f8)
#16 0x00005621b5163e1c clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::__1::unique_ptr<llvm::raw_pwrite_stream, std::__1::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (clang+++0x3c12e1c)
#17 0x00005621b5179525 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (clang+++0x3c28525)
#18 0x00005621b705390e clang::ParseAST(clang::Sema&, bool, bool) (clang+++0x5b0290e)
#19 0x00005621b578191d clang::FrontendAction::Execute() (clang+++0x423091d)
#20 0x00005621b56e4270 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (clang+++0x4193270)
#21 0x00005621b584d0db clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (clang+++0x42fc0db)
#22 0x00005621b3700fba cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (clang+++0x21affba)
#23 0x00005621b366fe17 (clang+++0x211ee17)
#24 0x00005621b5520e89 (clang+++0x3fcfe89)
#25 0x00005621b4991548 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (clang+++0x3440548)
#26 0x00005621b5520d44 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::__1::optional<llvm::StringRef>>, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>*, bool*) const (clang+++0x3fcfd44)
#27 0x00005621b54c522a clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (clang+++0x3f7422a)
#28 0x00005621b54c548e clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::__1::pair<int, clang::driver::Command const*>>&, bool) const (clang+++0x3f7448e)
#29 0x00005621b551334e clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::__1::pair<int, clang::driver::Command const*>>&) (clang+++0x3fc234e)
#30 0x00005621b366ec5c clang_main(int, char**, llvm::ToolContext const&) (clang+++0x211dc5c)
#31 0x00005621b370def5 main (clang+++0x21bcef5)
#32 0x00007f03ba427675 (/usr/lib/libc.so.6+0x27675)
#33 0x00007f03ba427729 __libc_start_main (/usr/lib/libc.so.6+0x27729)
#34 0x00005621b365e325 _start (clang+++0x210d325)
clang++: error: clang frontend command failed with exit code 139 (use -v to see invocation)
[joo.peter@gmail.com] clang version 21.1.0
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
clang++: note: diagnostic msg:
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang++: note: diagnostic msg: /tmp/basicstuff-780242.cpp
clang++: note: diagnostic msg: /tmp/basicstuff-780242.sh
clang++: note: diagnostic msg:

********************
ninja: build stopped: subcommand failed.

I have attached the required basicstuff-780242.cpp and basicstuff-780242.sh files.

basicstuff-780242.sh

basicstuff-780242.cpp

[abhishek-kaushik22]

I was using assertions build and I don't hit the same error, instead I see an infinite loop. This is a regression from LLVM 20.1 and is present in the 21.1 release https://godbolt.org/z/r6cb4Y7E5.
Here's a small reproducer (I'm not sure if all the attributes are needed but I see it passes when using -mcpu=x86-64-v4):

define <16 x i16> @foo(<16 x i32> %a, <16 x i32> %b) #0 {
    %icmp = icmp ugt <16 x i32> %a, %b
    %sext = sext <16 x i1> %icmp to <16 x i16>
    %and = and <16 x i16> %sext, splat (i16 16256)
    ret <16 x i16> %and
}

attributes #0 = {"target-features"="+64bit-mode,-32bit-mode,-16bit-mode,+sse2,+avx,+avx2,+avx512dq,+avx512f,+cmov,+crc32,+cx8,+evex512,+f16c,+fma,+fxsr,+mmx,+popcnt,+sse,+sse2,+sse3,+sse4.1,+sse4.2,+ssse3,+x87,+xsave"}

I guess this is coming from b3d280b, which converts the and to a vselect with one of the operand being all zeros. And then the generic vselect combineVSelectWithAllOnesOrZeros turns it back to a and.

Legalized selection DAG: %bb.0 'foo:'
SelectionDAG has 17 nodes:
  t0: ch,glue = EntryToken
          t2: v16i32,ch = CopyFromReg t0, Register:v16i32 %0
          t4: v16i32,ch = CopyFromReg t0, Register:v16i32 %1
        t6: v16i1 = setcc t2, t4, setugt:ch
      t7: v16i16 = sign_extend t6
        t26: i64 = X86ISD::Wrapper TargetConstantPool:i64<<16 x i16> splat (i16 16256)> 0
      t24: v16i16,ch = load<(load (s256) from constant-pool)> t0, t26, undef:i64
    t10: v16i16 = and t7, t24
  t13: ch,glue = CopyToReg t0, Register:v16i16 $ymm0, t10
  t14: ch = X86ISD::RET_GLUE t13, TargetConstant:i32<0>, Register:v16i16 $ymm0, t13:1

Combining: t10: v16i16 = and t7, t24
Creating constant: t27: i32 = Constant<0>
Creating new node: t28: v8i32 = BUILD_VECTOR Constant:i32<0>, Constant:i32<0>, Constant:i32<0>, Constant:i32<0>, Constant:i32<0>, Constant:i32<0>, Constant:i32<0>, Constant:i32<0>
Creating new node: t29: v16i16 = bitcast t28
Creating new node: t30: v16i16 = vselect t6, t24, t29
 ... into: t30: v16i16 = vselect t6, t24, t29

Combining: t30: v16i16 = vselect t6, t24, t29
Creating new node: t32: v16i16 = sign_extend t6
Creating new node: t33: v16i16 = vselect t32, t24, t29
 ... into: t33: v16i16 = vselect t32, t24, t29

Legalizing: t33: v16i16 = vselect t32, t24, t29
Trying custom legalization
Creating new node: t34: v32i8 = bitcast t32
Creating new node: t35: v32i8 = bitcast t24
Creating new node: t36: v32i8 = bitcast t28
Creating new node: t37: v32i8 = vselect t34, t35, t36
Creating new node: t38: v16i16 = bitcast t37
Successfully custom legalized node
 ... replacing: t33: v16i16 = vselect t32, t24, t29
     with:      t38: v16i16 = bitcast t37

Combining: t37: v32i8 = vselect t34, t35, t36
Creating new node: t44: v32i8 = freeze t35
Creating new node: t45: v32i8 = and t34, t44
 ... into: t45: v32i8 = and t34, t44

@RKSimon any suggestions on how to fix this or are the attributes used incorrect?

[peter-joo]

"instead I see an infinite loop."

Sorry, I forgot to mention that the ICE occurred after 3–4 hours of execution. The system was Arch Linux, running on a 16-core Intel Xeon E-2288G 3.70 GHz CPU.

"abhishek-kaushik22 added hang and removed crash"
So it’s a crash, and you may want to relabel it as such.

[abhishek-kaushik22]

@peter-joo Sorry about the relabeling, after the infinite-loop is addressed, I'll try with the full reproducer and see if I can reproduce the crash, but for now it seems the crash just isn't reproducible.