[SDAG] Crash on attempted promotion of any_extend_vector_inreg operand #161013
Description
Compiling the following IR snippet for AArch64 causes a crash during type legalization in the SelectionDAG:
https://godbolt.org/z/beWjca84s
define <16 x i4> @RocketSystem_eval(<2 x i4> %0) {
.thread3218:
%1 = shufflevector <2 x i4> %0, <2 x i4> zeroinitializer, <16 x i32> <i32 poison, i32 poison, i32 poison, i32 poison, i32 1, i32 poison, i32 poison, i32 poison, i32 poison, i32 poison, i32 poison, i32 poison, i32 poison, i32 poison, i32 poison, i32 poison>
ret <16 x i4> %1
}
PromoteIntegerOperand Op #0: t16: v4i16 = any_extend_vector_inreg t7
LLVM ERROR: Do not know how to promote this operator's operand!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: /Users/leon/devel/circt/llvm/build/bin/llc ./reduced.ll
1. Running pass 'Function Pass Manager' on module './reduced.ll'.
2. Running pass 'AArch64 Instruction Selection' on function '@RocketSystem_eval'
#0 0x00000001062c6b1c llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/Users/leon/devel/circt/llvm/build/bin/llc+0x10134eb1c)
#1 0x00000001062c4a68 llvm::sys::RunSignalHandlers() (/Users/leon/devel/circt/llvm/build/bin/llc+0x10134ca68)
#2 0x00000001062c75c4 SignalHandler(int, __siginfo*, void*) (/Users/leon/devel/circt/llvm/build/bin/llc+0x10134f5c4)
#3 0x000000019f9f2744 (/usr/lib/system/libsystem_platform.dylib+0x1804d6744)
#4 0x000000019f9e8888 (/usr/lib/system/libsystem_pthread.dylib+0x1804cc888)
#5 0x000000019f8ee808 (/usr/lib/system/libsystem_c.dylib+0x1803d2808)
#6 0x0000000106239168 llvm::report_fatal_error(llvm::Twine const&, bool) (/Users/leon/devel/circt/llvm/build/bin/llc+0x1012c1168)
#7 0x0000000106238fb4 llvm::report_fatal_error(llvm::Twine const&, bool) (/Users/leon/devel/circt/llvm/build/bin/llc+0x1012c0fb4)
#8 0x000000010607d748 llvm::DAGTypeLegalizer::PromoteIntOp_ANY_EXTEND(llvm::SDNode*) (/Users/leon/devel/circt/llvm/build/bin/llc+0x101105748)
#9 0x0000000106095ee0 llvm::DAGTypeLegalizer::run() (/Users/leon/devel/circt/llvm/build/bin/llc+0x10111dee0)
#10 0x00000001060999ec llvm::SelectionDAG::LegalizeTypes() (/Users/leon/devel/circt/llvm/build/bin/llc+0x1011219ec)
#11 0x000000010618fc9c llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/Users/leon/devel/circt/llvm/build/bin/llc+0x101217c9c)
#12 0x000000010618f2d4 llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (/Users/leon/devel/circt/llvm/build/bin/llc+0x1012172d4)
#13 0x000000010618cd94 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (/Users/leon/devel/circt/llvm/build/bin/llc+0x101214d94)
#14 0x000000010618b46c llvm::SelectionDAGISelLegacy::runOnMachineFunction(llvm::MachineFunction&) (/Users/leon/devel/circt/llvm/build/bin/llc+0x10121346c)
#15 0x0000000105796094 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (/Users/leon/devel/circt/llvm/build/bin/llc+0x10081e094)
#16 0x0000000105b7e590 llvm::FPPassManager::runOnFunction(llvm::Function&) (/Users/leon/devel/circt/llvm/build/bin/llc+0x100c06590)
#17 0x0000000105b838a0 llvm::FPPassManager::runOnModule(llvm::Module&) (/Users/leon/devel/circt/llvm/build/bin/llc+0x100c0b8a0)
#18 0x0000000105b7ead4 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/Users/leon/devel/circt/llvm/build/bin/llc+0x100c06ad4)
#19 0x0000000104f7bd7c main (/Users/leon/devel/circt/llvm/build/bin/llc+0x100003d7c)
#20 0x000000019f629d54
[1] 12074 abort /Users/leon/devel/circt/llvm/build/bin/llc ./reduced.ll
I ran into this when using "arcilator", a MLIR/LLVM based hardware simulator part of the CIRCT project. It frequently creates LLVM IR with unusual integer types. As can be seen in the debug log, the vector_shuffle operation is replaced by a any_extend_vector_inreg with a v16i4 operand. This then fails during type legalization since there is no integer operand promotion function for ISD::ANY_EXTEND_VECTOR_INREG.
I'm unfamiliar with the SelectionDAG lowering process. My only successful attempt at fixing this so far is to prevent combineShuffleToAnyExtendVectorInreg from applying to an operation with an illegal operand type. But this feels pretty heavy handed to me.