`RegAllocFast::runOnMachineFunction` misses a virtual register

[cuviper]

Given this input: reduced.ll.txt

In a build without assertions, llc -O0 crashes:

$ llc -O0 reduced.ll
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: llc -O0 reduced.ll
1.      Running pass 'Function Pass Manager' on module 'reduced.ll'.
2.      Running pass 'Prologue/Epilogue Insertion & Frame Finalization' on function '@"_ZN55_$LT$std..io..stdio..Stdin$u20$as$u20$std..io..Read$GT$11read_to_end17haba70a09681d41d3E"'
 #0 0x0000000001cf0804 PrintStackTraceSignalHandler(void*) Signals.cpp:0:0
 #1 0x0000000001cee00b SignalHandler(int) Signals.cpp:0:0
 #2 0x00007fa8d0a40b50 __restore_rt (/lib64/libc.so.6+0x3cb50)
 #3 0x000000000064c4b0 scavengeVReg(llvm::MachineRegisterInfo&, llvm::RegScavenger&, llvm::Register, bool) (.cold) RegisterScavenging.cpp:0:0
 #4 0x00000000011e7660 scavengeFrameVirtualRegsInBlock(llvm::MachineRegisterInfo&, llvm::RegScavenger&, llvm::MachineBasicBlock&) RegisterScavenging.cpp:0:0
 #5 0x00000000011e77a8 llvm::scavengeFrameVirtualRegs(llvm::MachineFunction&, llvm::RegScavenger&) (/home/jistone/llvm-project/build-ndebug/bin/llc+0x11e77a8)
 #6 0x00000000011636ee (anonymous namespace)::PEI::runOnMachineFunction(llvm::MachineFunction&) PrologEpilogInserter.cpp:0:0
 #7 0x00000000010320d1 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
 #8 0x00000000014c92b0 llvm::FPPassManager::runOnFunction(llvm::Function&) (/home/jistone/llvm-project/build-ndebug/bin/llc+0x14c92b0)
 #9 0x00000000014c93dc llvm::FPPassManager::runOnModule(llvm::Module&) (/home/jistone/llvm-project/build-ndebug/bin/llc+0x14c93dc)
#10 0x00000000014c9d08 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/home/jistone/llvm-project/build-ndebug/bin/llc+0x14c9d08)
#11 0x00000000006e6f17 compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0
#12 0x000000000065f742 main (/home/jistone/llvm-project/build-ndebug/bin/llc+0x65f742)
#13 0x00007fa8d0a2b510 __libc_start_call_main (/lib64/libc.so.6+0x27510)
#14 0x00007fa8d0a2b5c9 __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x275c9)
#15 0x00000000006df235 _start (/home/jistone/llvm-project/build-ndebug/bin/llc+0x6df235)
Segmentation fault (core dumped)

With assertions, this fails earlier in MachineRegisterInfo::clearVirtRegs:

$ llc -O0 reduced.ll
Remaining virtual register operands
UNREACHABLE executed at /home/jistone/llvm-project/llvm/lib/CodeGen/MachineRegisterInfo.cpp:207!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: llc -O0 ../build-ndebug/reduced.ll
1.      Running pass 'Function Pass Manager' on module '../build-ndebug/reduced.ll'.
2.      Running pass 'Fast Register Allocator' on function '@"_ZN55_$LT$std..io..stdio..Stdin$u20$as$u20$std..io..Read$GT$11read_to_end17haba70a09681d41d3E"'
 #0 0x0000000001f5adb4 PrintStackTraceSignalHandler(void*) Signals.cpp:0:0
 #1 0x0000000001f584eb SignalHandler(int) Signals.cpp:0:0
 #2 0x00007efcfe780b50 __restore_rt (/lib64/libc.so.6+0x3cb50)
 #3 0x00007efcfe7d0e7c __pthread_kill_implementation (/lib64/libc.so.6+0x8ce7c)
 #4 0x00007efcfe780aa6 gsignal (/lib64/libc.so.6+0x3caa6)
 #5 0x00007efcfe76a7fc abort (/lib64/libc.so.6+0x267fc)
 #6 0x0000000001eb7b8a (/home/jistone/llvm-project/build/bin/llc+0x1eb7b8a)
 #7 0x00000000011ba332 llvm::MachineRegisterInfo::clearVirtRegs() (/home/jistone/llvm-project/build/bin/llc+0x11ba332)
 #8 0x00000000012cca4c (anonymous namespace)::RegAllocFast::runOnMachineFunction(llvm::MachineFunction&) RegAllocFast.cpp:0:0
 #9 0x000000000112883b llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#10 0x0000000001665c50 llvm::FPPassManager::runOnFunction(llvm::Function&) (/home/jistone/llvm-project/build/bin/llc+0x1665c50)
#11 0x0000000001665d91 llvm::FPPassManager::runOnModule(llvm::Module&) (/home/jistone/llvm-project/build/bin/llc+0x1665d91)
#12 0x0000000001666657 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/home/jistone/llvm-project/build/bin/llc+0x1666657)
#13 0x0000000000657a66 main (/home/jistone/llvm-project/build/bin/llc+0x657a66)
#14 0x00007efcfe76b510 __libc_start_call_main (/lib64/libc.so.6+0x27510)
#15 0x00007efcfe76b5c9 __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x275c9)
#16 0x00000000006d7995 _start (/home/jistone/llvm-project/build/bin/llc+0x6d7995)
Aborted (core dumped)

The input file is a reduction from a Rust build with LTO -- optimized+debuginfo code from the standard library merged with unoptimized code from the test case. After reduction, only one std function remains. It compiles fine with llc -O1 or higher, or with llc -O0 --optimize-regalloc.

xref: https://bugzilla.redhat.com/show_bug.cgi?id=2142648

[cuviper]

In case the reduction lost anything meaningful, here's the full original input: rustc_demangle-legacy.bc.gz

[cuviper]

I found that RegAllocFast::allocateBasicBlock is walking instructions in reverse, but while it does that, RegAllocFast::spill may insert new debug instructions after the current point. If those still have unresolved virt regs, they'll blow up when RegAllocFast::runOnMachineFunction calls clearVirtRegs.

I tried inserting handleDebugValue calls for the new DVs, and that does fix both my reduced and full test cases:

--- a/llvm/lib/CodeGen/RegAllocFast.cpp
+++ b/llvm/lib/CodeGen/RegAllocFast.cpp
@@ -453,8 +453,8 @@ void RegAllocFast::spill(MachineBasicBlock::iterator Before, Register VirtReg,
     MachineInstr *NewDV = buildDbgValueForSpill(
         *MBB, Before, *MISpilledOperands.first, FI, MISpilledOperands.second);
     assert(NewDV->getParent() == MBB && "dangling parent pointer");
-    (void)NewDV;
     LLVM_DEBUG(dbgs() << "Inserting debug info due to spill:\n" << *NewDV);
+    handleDebugValue(*NewDV);

     if (LiveOut) {
       // We need to insert a DBG_VALUE at the end of the block if the spill slot
@@ -464,6 +464,7 @@ void RegAllocFast::spill(MachineBasicBlock::iterator Before, Register VirtReg,
       MachineInstr *ClonedDV = MBB->getParent()->CloneMachineInstr(NewDV);
       MBB->insert(FirstTerm, ClonedDV);
       LLVM_DEBUG(dbgs() << "Cloning debug info due to live out spill\n");
+      handleDebugValue(*ClonedDV);
     }

     // Rewrite unassigned dbg_values to use the stack slot.

I'm not sure if that's generally correct though...

[cuviper]

Submitted https://reviews.llvm.org/D139590

[llvmbot]

@llvm/issue-subscribers-debuginfo