[AMDGPU] LLVM ERROR: failed to annotate CFG

[XChy]

Reproducer: https://godbolt.org/z/Wf8PYW84E
Testcase:

target datalayout = "e-m:e-p:64:64-p1:64:64-p2:32:32-p3:32:32-p4:64:64-p5:32:32-p6:32:32-p7:160:256:256:32-p8:128:128:128:48-p9:192:256:256:32-i64:64-v16:16-v24:32-v32:32-v48:64-v96:128-v192:256-v256:256-v512:512-v1024:1024-v2048:2048-n32:64-S32-A5-G1-ni:7:8:9"
target triple = "amdgcn-amd-amdhsa"

define void @func_19(i32 %BS_COND_8.0.BS_COND_8.0.BS_COND_8.0.BS_COND_8.0.) {
entry:
  br label %BS_LABEL_3

BS_LABEL_3:                                       ; preds = %BS_LABEL_0, %BS_LABEL_3, %entry
  callbr void asm sideeffect "", "!i"()
          to label %BS_LABEL_0 [label %BS_LABEL_3]

BS_LABEL_0:                                       ; preds = %BS_LABEL_0, %BS_LABEL_3
  switch i32 %BS_COND_8.0.BS_COND_8.0.BS_COND_8.0.BS_COND_8.0., label %sw.epilog [
    i32 0, label %BS_LABEL_0
    i32 1, label %BS_LABEL_3
  ]

sw.epilog:                                        ; preds = %BS_LABEL_0
  ret void
}

Dump:

LLVM ERROR: failed to annotate CFG
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/llc -o /app/output.s -x86-asm-syntax=intel -O1 <source>
1.	Running pass 'Function Pass Manager' on module '<source>'.
2.	Running pass 'SI annotate control flow' on function '@func_19'
 #0 0x0000000004207428 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x4207428)
 #1 0x00000000042042d4 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007964ca642520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00007964ca6969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x00007964ca642476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x00007964ca6287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x00000000007c07f3 llvm::json::operator==(llvm::json::Value const&, llvm::json::Value const&) (.cold) JSON.cpp:0:0
 #7 0x000000000414d631 (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x414d631)
 #8 0x0000000000fb7ccd (anonymous namespace)::SIAnnotateControlFlow::run() SIAnnotateControlFlow.cpp:0:0
 #9 0x0000000000fb8381 SIAnnotateControlFlowLegacy::runOnFunction(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0xfb8381)
#10 0x00000000037408e6 llvm::FPPassManager::runOnFunction(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x37408e6)
#11 0x0000000003740c91 llvm::FPPassManager::runOnModule(llvm::Module&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x3740c91)
#12 0x00000000037414ff llvm::legacy::PassManagerImpl::run(llvm::Module&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x37414ff)
#13 0x00000000008fd1f4 compileModule(char**, llvm::LLVMContext&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) llc.cpp:0:0
#14 0x00000000007c73d9 main (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x7c73d9)
#15 0x00007964ca629d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#16 0x00007964ca629e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#17 0x00000000008f23f5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x8f23f5)
Program terminated with signal: SIGSEGV
Compiler returned: 139

[llvmbot]

@llvm/issue-subscribers-backend-amdgpu

Author: Hongyu Chen (XChy)

Reproducer: https://godbolt.org/z/Wf8PYW84E Testcase: ```llvm target datalayout = "e-m:e-p:64:64-p1:64:64-p2:32:32-p3:32:32-p4:64:64-p5:32:32-p6:32:32-p7:160:256:256:32-p8:128:128:128:48-p9:192:256:256:32-i64:64-v16:16-v24:32-v32:32-v48:64-v96:128-v192:256-v256:256-v512:512-v1024:1024-v2048:2048-n32:64-S32-A5-G1-ni:7:8:9" target triple = "amdgcn-amd-amdhsa"

define void @func_19(i32 %BS_COND_8.0.BS_COND_8.0.BS_COND_8.0.BS_COND_8.0.) {
entry:
br label %BS_LABEL_3

BS_LABEL_3: ; preds = %BS_LABEL_0, %BS_LABEL_3, %entry
callbr void asm sideeffect "", "!i"()
to label %BS_LABEL_0 [label %BS_LABEL_3]

BS_LABEL_0: ; preds = %BS_LABEL_0, %BS_LABEL_3
switch i32 %BS_COND_8.0.BS_COND_8.0.BS_COND_8.0.BS_COND_8.0., label %sw.epilog [
i32 0, label %BS_LABEL_0
i32 1, label %BS_LABEL_3
]

sw.epilog: ; preds = %BS_LABEL_0
ret void
}

Dump:

LLVM ERROR: failed to annotate CFG
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/llc -o /app/output.s -x86-asm-syntax=intel -O1 <source>

1. Running pass 'Function Pass Manager' on module '<source>'.
2. Running pass 'SI annotate control flow' on function '@func_19'
   #0 0x0000000004207428 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x4207428)
   #1 0x00000000042042d4 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
   #2 0x00007964ca642520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
   #3 0x00007964ca6969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
   #4 0x00007964ca642476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
   #5 0x00007964ca6287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
   #6 0x00000000007c07f3 llvm::json::operator==(llvm::json::Value const&, llvm::json::Value const&) (.cold) JSON.cpp:0:0
   #7 0x000000000414d631 (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x414d631)
   #8 0x0000000000fb7ccd (anonymous namespace)::SIAnnotateControlFlow::run() SIAnnotateControlFlow.cpp:0:0
   #9 0x0000000000fb8381 SIAnnotateControlFlowLegacy::runOnFunction(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0xfb8381)
   #10 0x00000000037408e6 llvm::FPPassManager::runOnFunction(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x37408e6)
   #11 0x0000000003740c91 llvm::FPPassManager::runOnModule(llvm::Module&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x3740c91)
   #12 0x00000000037414ff llvm::legacy::PassManagerImpl::run(llvm::Module&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x37414ff)
   #13 0x00000000008fd1f4 compileModule(char**, llvm::LLVMContext&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) llc.cpp:0:0
   #14 0x00000000007c73d9 main (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x7c73d9)
   #15 0x00007964ca629d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
   #16 0x00007964ca629e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
   #17 0x00000000008f23f5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x8f23f5)
   Program terminated with signal: SIGSEGV
   Compiler returned: 139

</details>

[ro-i]

Thanks for reporting! It's not really a bug, it's just not yet supported. See #152161 (comment). I already enabled callbr for AMDGPU for a lot of use cases, but not yet for more complex structurizations as would be required for your reproducer. As I mentioned in the linked comment, this is planned as a follow-up PR. (Since I merged my other callbr PRs recently, I already started working on this, but due to other projects, it's going to take a little time.)

[XChy]

Thanks. Is the complicated/irreducible CFG with multi-target terminators, such as switch/callbr, currently unsupported in AMDGPU? I am running a fuzzer on various backends. If that's the case, I could disable generating such a program and stop reporting this kind of bug.

[ro-i]

Hm, callbr blocks with their direct target blocks are currently not structurized*. Parent regions should be and child regions, too. I'm not sure how well switch is handled. (@arsenm?)

*Which does not necessarily imply crashing. Even with the same region structure, your reproducer can happen to work: if you would, for example, introduce label foo, the switch would be handled and there would be no crash:

target datalayout = "e-m:e-p:64:64-p1:64:64-p2:32:32-p3:32:32-p4:64:64-p5:32:32-p6:32:32-p7:160:256:256:32-p8:128:128:128:48-p9:192:256:256:32-i64:64-v16:16-v24:32-v32:32-v48:64-v96:128-v192:256-v256:256-v512:512-v1024:1024-v2048:2048-n32:64-S32-A5-G1-ni:7:8:9"
target triple = "amdgcn-amd-amdhsa"

define void @func_19(i32 %BS_COND_8.0.BS_COND_8.0.BS_COND_8.0.BS_COND_8.0., i1 %c) {
entry:
  br label %BS_LABEL_3

BS_LABEL_3:                                       ; preds = %BS_LABEL_0, %BS_LABEL_3, %entry
  callbr void asm sideeffect "", "!i"()
          to label %BS_LABEL_0 [label %BS_LABEL_3]

BS_LABEL_0:                                       ; preds = %BS_LABEL_0, %BS_LABEL_3
  br i1 %c, label %foo, label %sw.epilog

foo:
  switch i32 %BS_COND_8.0.BS_COND_8.0.BS_COND_8.0.BS_COND_8.0., label %sw.epilog [
    i32 0, label %BS_LABEL_0
    i32 1, label %BS_LABEL_3
  ]

sw.epilog:                                        ; preds = %BS_LABEL_0
  ret void
}

[arsenm]

Switch is handled by requiring LowerSwitch to run first (although it would be nicer if the structurizer directly handled it), particularly in the new pass manager

[ro-i]

although it would be nicer if the structurizer directly handled it

I'm thinking about a way to maybe be even able to handle stuff like callbr and switch together, although code sharing would probably stay limited since switch is transformed to like a binary tree while callbr would be more like a linear search ig