unhandled opcode in isAArch64FrameOffsetLegal

[TatyanaDoubts]

To reproduce run llc with the test below:

; ModuleID = 'reduced.ll'
source_filename = "/nfs/build-cache/zvm-dev-4830/jdk21/aarch64/fastdebug/lib/server/boilerplate.ll"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128-Fn32-ni:1-p2:32:8:8:32-ni:2"
target triple = "aarch64-none-linux-gnu"

; Function Attrs: uwtable
define noundef i32 @widget(i1 %arg) #0 gc "statepoint-example" {
bb:
  %icmp = icmp eq ptr addrspace(1) null, null
  br i1 %arg, label %bb1, label %bb2

bb1:                                              ; preds = %bb
  %call = call token (i64, i32, ptr, i32, i32, ...) @llvm.experimental.gc.statepoint.p0(i64 0, i32 0, ptr nonnull elementtype(i32 (ptr addrspace(1), ptr addrspace(1), double)) null, i32 3, i32 0, ptr addrspace(1) nonnull null, ptr addrspace(1) nonnull null, double 0.000000e+00, i32 0, i32 0) #5 [ "deopt"([71 x i32] zeroinitializer, i32 0, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, i64 0, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, i32 0, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, float 0.000000e+00, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, i32 0, i64 0, ptr addrspace(1) null, ptr addrspace(1) null), "gc-live"(ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, <2 x ptr addrspace(1)> zeroinitializer, <2 x ptr addrspace(1)> zeroinitializer, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, <2 x ptr addrspace(1)> zeroinitializer, ptr addrspace(1) null) ]
  br label %bb5

bb2:                                              ; preds = %bb
  %call3 = call token (i64, i32, ptr, i32, i32, ...) @llvm.experimental.gc.statepoint.p0(i64 0, i32 0, ptr nonnull elementtype(i32 (ptr addrspace(1), ptr addrspace(1), double)) null, i32 3, i32 0, ptr addrspace(1) nonnull null, ptr addrspace(1) nonnull null, double 0.000000e+00, i32 0, i32 0) #6 [ "deopt"([73 x i32] zeroinitializer, i32 0, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, i64 0, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, i32 0, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, float 0.000000e+00, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, i32 0, i64 0, ptr addrspace(1) null, ptr addrspace(1) null), "gc-live"(ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, <2 x ptr addrspace(1)> zeroinitializer, <2 x ptr addrspace(1)> zeroinitializer, <2 x ptr addrspace(1)> zeroinitializer, ptr addrspace(1) null, <2 x ptr addrspace(1)> zeroinitializer, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, <2 x ptr addrspace(1)> zeroinitializer, ptr addrspace(1) null) ]
  %call4 = call coldcc <2 x ptr addrspace(1)> @llvm.experimental.gc.relocate.v2p1(token %call3, i32 0, i32 24) ; (null, zeroinitializer)
  %shufflevector = shufflevector <2 x ptr addrspace(1)> zeroinitializer, <2 x ptr addrspace(1)> %call4, <2 x i32> <i32 0, i32 3>
  br label %bb5

bb5:                                              ; preds = %bb2, %bb1
  %phi = phi <2 x ptr addrspace(1)> [ zeroinitializer, %bb1 ], [ %shufflevector, %bb2 ]
  %extractelement = extractelement <2 x ptr addrspace(1)> %phi, i64 0
  %call6 = call token (i64, i32, ptr, i32, i32, ...) @llvm.experimental.gc.statepoint.p0(i64 0, i32 0, ptr nonnull elementtype(void (i32)) null, i32 1, i32 0, i32 0, i32 0, i32 0) #7 [ "deopt"([73 x i32] zeroinitializer, i32 0, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, i64 0, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, i32 0, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, float 0.000000e+00, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, ptr addrspace(1) null, i32 0, i64 0, ptr addrspace(1) %extractelement, ptr addrspace(1) null), "gc-live"() ]
  unreachable
}

Reproducer: https://godbolt.org/z/YG7cW3shP

Stack dump:

unhandled opcode in isAArch64FrameOffsetLegal
UNREACHABLE executed at /root/llvm-project/llvm/lib/Target/AArch64/AArch64InstrInfo.cpp:6286!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/llc -o /app/output.s -x86-asm-syntax=intel <source>
1.	Running pass 'Function Pass Manager' on module '<source>'.
2.	Running pass 'Prologue/Epilogue Insertion & Frame Finalization' on function '@widget'
 #0 0x0000000003f00ab8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x3f00ab8)
 #1 0x0000000003efe444 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x0000747fc7442520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x0000747fc74969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x0000747fc7442476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x0000747fc74287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x0000000003e4adda (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x3e4adda)
 #7 0x0000000000ac2080 llvm::isAArch64FrameOffsetLegal(llvm::MachineInstr const&, llvm::StackOffset&, bool*, unsigned int*, long*) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0xac2080)
 #8 0x0000000000c7f000 llvm::AArch64FrameLowering::determineCalleeSaves(llvm::MachineFunction&, llvm::BitVector&, llvm::RegScavenger*) const (.part.0) AArch64FrameLowering.cpp:0:0
 #9 0x0000000002ffeb86 (anonymous namespace)::PEIImpl::run(llvm::MachineFunction&) (.constprop.0) PrologEpilogInserter.cpp:0:0
#10 0x0000000003001a7b (anonymous namespace)::PEILegacy::runOnMachineFunction(llvm::MachineFunction&) PrologEpilogInserter.cpp:0:0
#11 0x0000000002e4955a llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#12 0x00000000034759cf llvm::FPPassManager::runOnFunction(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x34759cf)
#13 0x0000000003475d81 llvm::FPPassManager::runOnModule(llvm::Module&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x3475d81)
#14 0x0000000003476621 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x3476621)
#15 0x00000000008c3548 compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0
#16 0x00000000007a160e main (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x7a160e)
#17 0x0000747fc7429d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#18 0x0000747fc7429e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#19 0x00000000008b9c25 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x8b9c25)
Program terminated with signal: SIGSEGV
Compiler returned: 139

[llvmbot]

@llvm/issue-subscribers-backend-aarch64

Author: None (TatyanaDoubts)

To reproduce run llc with the test below:

reduced-stripped.ll.zip

Reproducer: https://godbolt.org/z/h4jxj6sW4

Stack dump:

unhandled opcode in isAArch64FrameOffsetLegal
UNREACHABLE executed at /root/llvm-project/llvm/lib/Target/AArch64/AArch64InstrInfo.cpp:6286!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/llc -o /app/output.s -x86-asm-syntax=intel <source>
1.	Running pass 'Function Pass Manager' on module '<source>'.
2.	Running pass 'Prologue/Epilogue Insertion &amp; Frame Finalization' on function '@<!-- -->widget'
 #<!-- -->0 0x0000000003f00ab8 llvm::sys::PrintStackTrace(llvm::raw_ostream&amp;, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x3f00ab8)
 #<!-- -->1 0x0000000003efe444 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #<!-- -->2 0x0000747fc7442520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #<!-- -->3 0x0000747fc74969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #<!-- -->4 0x0000747fc7442476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #<!-- -->5 0x0000747fc74287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #<!-- -->6 0x0000000003e4adda (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x3e4adda)
 #<!-- -->7 0x0000000000ac2080 llvm::isAArch64FrameOffsetLegal(llvm::MachineInstr const&amp;, llvm::StackOffset&amp;, bool*, unsigned int*, long*) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0xac2080)
 #<!-- -->8 0x0000000000c7f000 llvm::AArch64FrameLowering::determineCalleeSaves(llvm::MachineFunction&amp;, llvm::BitVector&amp;, llvm::RegScavenger*) const (.part.0) AArch64FrameLowering.cpp:0:0
 #<!-- -->9 0x0000000002ffeb86 (anonymous namespace)::PEIImpl::run(llvm::MachineFunction&amp;) (.constprop.0) PrologEpilogInserter.cpp:0:0
#<!-- -->10 0x0000000003001a7b (anonymous namespace)::PEILegacy::runOnMachineFunction(llvm::MachineFunction&amp;) PrologEpilogInserter.cpp:0:0
#<!-- -->11 0x0000000002e4955a llvm::MachineFunctionPass::runOnFunction(llvm::Function&amp;) (.part.0) MachineFunctionPass.cpp:0:0
#<!-- -->12 0x00000000034759cf llvm::FPPassManager::runOnFunction(llvm::Function&amp;) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x34759cf)
#<!-- -->13 0x0000000003475d81 llvm::FPPassManager::runOnModule(llvm::Module&amp;) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x3475d81)
#<!-- -->14 0x0000000003476621 llvm::legacy::PassManagerImpl::run(llvm::Module&amp;) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x3476621)
#<!-- -->15 0x00000000008c3548 compileModule(char**, llvm::LLVMContext&amp;) llc.cpp:0:0
#<!-- -->16 0x00000000007a160e main (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x7a160e)
#<!-- -->17 0x0000747fc7429d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#<!-- -->18 0x0000747fc7429e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#<!-- -->19 0x00000000008b9c25 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x8b9c25)
Program terminated with signal: SIGSEGV
Compiler returned: 139

[MacDue]

It looks like a disjoint ORR has been emitted rather than an ADD, which is missing handling in a few places.

[TatyanaDoubts]

Cleaned up reproducer: https://godbolt.org/z/YG7cW3shP

[MacDue]

I think the fix could be simply to handle a disjoint ORR like an ADD:

diff --git a/llvm/lib/Target/AArch64/AArch64FrameLowering.cpp b/llvm/lib/Target/AArch64/AArch64FrameLowering.cpp
index c22dbb9bf006..8b41cdb80424 100644
--- a/llvm/lib/Target/AArch64/AArch64FrameLowering.cpp
+++ b/llvm/lib/Target/AArch64/AArch64FrameLowering.cpp
@@ -401,8 +401,9 @@ static unsigned estimateRSStackSizeLimit(MachineFunction &MF) {
   for (MachineBasicBlock &MBB : MF) {
     for (MachineInstr &MI : MBB) {
       if (MI.isDebugInstr() || MI.isPseudo() ||
-          MI.getOpcode() == AArch64::ADDXri ||
-          MI.getOpcode() == AArch64::ADDSXri)
+          llvm::is_contained(
+              {AArch64::ADDXri, AArch64::ADDSXri, AArch64::ORRXri},
+              MI.getOpcode()))
         continue;
 
       for (const MachineOperand &MO : MI.operands()) {
diff --git a/llvm/lib/Target/AArch64/AArch64InstrInfo.cpp b/llvm/lib/Target/AArch64/AArch64InstrInfo.cpp
index d1e0d37e33e4..a0dd3d7c050a 100644
--- a/llvm/lib/Target/AArch64/AArch64InstrInfo.cpp
+++ b/llvm/lib/Target/AArch64/AArch64InstrInfo.cpp
@@ -6343,7 +6343,8 @@ bool llvm::rewriteAArch64FrameIndex(MachineInstr &MI, unsigned FrameRegIdx,
   unsigned Opcode = MI.getOpcode();
   unsigned ImmIdx = FrameRegIdx + 1;
 
-  if (Opcode == AArch64::ADDSXri || Opcode == AArch64::ADDXri) {
+  if (Opcode == AArch64::ADDSXri || Opcode == AArch64::ADDXri ||
+      (Opcode == AArch64::ORRXri && MI.getFlag(MachineInstr::Disjoint))) {
     Offset += StackOffset::getFixed(MI.getOperand(ImmIdx).getImm());
     emitFrameOffset(*MI.getParent(), MI, MI.getDebugLoc(),
                     MI.getOperand(0).getReg(), FrameReg, Offset, TII,

[efriedma-quic]

I'd prefer we not do that... flags like "disjoint" are supposed to be droppable. We just shouldn't generate an ORR with a frame index operand.

[MacDue]

Hmmm. I tried that:

diff --git a/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp b/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
index aba3c0f80a02..5fdc9add33d8 100644
--- a/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
+++ b/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
@@ -3015,7 +3015,7 @@ SDValue DAGCombiner::visitADD(SDNode *N) {
 
   // fold (a+b) -> (a|b) iff a and b share no bits.
   if ((!LegalOperations || TLI.isOperationLegal(ISD::OR, VT)) &&
-      DAG.haveNoCommonBitsSet(N0, N1))
+      !isa<FrameIndexSDNode>(N0) && DAG.haveNoCommonBitsSet(N0, N1))
     return DAG.getNode(ISD::OR, DL, VT, N0, N1, SDNodeFlags::Disjoint);
 
   // Fold (add (vscale * C0), (vscale * C1)) to (vscale * (C0 + C1)).

It does change quite a lot tests (possibly more, I don't build all targets). I've not checked if there's any regressions or just churn here:

  LLVM :: CodeGen/AArch64/Atomics/aarch64-atomic-load-rcpc_immo.ll
  LLVM :: CodeGen/AArch64/aarch64-bit-gen.ll
  LLVM :: CodeGen/AArch64/aarch64-scalarize-vec-load-ext.ll
  LLVM :: CodeGen/AArch64/arm64-extract-insert-varidx.ll
  LLVM :: CodeGen/AArch64/arm64-indexed-vector-ldst.ll
  LLVM :: CodeGen/AArch64/arm64-neon-copy.ll
  LLVM :: CodeGen/AArch64/arm64-nvcast.ll
  LLVM :: CodeGen/AArch64/arm64-stp.ll
  LLVM :: CodeGen/AArch64/bitcast.ll
  LLVM :: CodeGen/AArch64/build-vector-to-extract-subvec-crash.ll
  LLVM :: CodeGen/AArch64/extract-vector-cmp.ll
  LLVM :: CodeGen/AArch64/extract-vector-elt.ll
  LLVM :: CodeGen/AArch64/fixed-point-conv-vec-pat.ll
  LLVM :: CodeGen/AArch64/icmp.ll
  LLVM :: CodeGen/AArch64/insertextract.ll
  LLVM :: CodeGen/AArch64/named-vector-shuffles-sve.ll
  LLVM :: CodeGen/AArch64/pr58350.ll
  LLVM :: CodeGen/AArch64/pr86717.ll
  LLVM :: CodeGen/AArch64/preserve_nonecc_varargs_darwin.ll
  LLVM :: CodeGen/AArch64/stack-hazard.ll
  LLVM :: CodeGen/AArch64/sve-streaming-mode-fixed-length-permute-rev.ll
  LLVM :: CodeGen/AArch64/swifterror.ll
  LLVM :: CodeGen/AArch64/vec-combine-compare-to-bitmask.ll
  LLVM :: CodeGen/AArch64/vector-compress.ll
  LLVM :: CodeGen/AArch64/vector-extract-last-active.ll
  LLVM :: CodeGen/ARM/alloc-no-stack-realign.ll
  LLVM :: CodeGen/ARM/combine-vmovdrr.ll
  LLVM :: CodeGen/ARM/fp16-promote.ll
  LLVM :: CodeGen/ARM/neon-copy.ll
  LLVM :: CodeGen/ARM/pr42638-VMOVRRDCombine.ll
  LLVM :: CodeGen/ARM/swifterror.ll
  LLVM :: CodeGen/RISCV/rvv/fixed-vectors-extract.ll
  LLVM :: CodeGen/RISCV/vararg.ll
  LLVM :: CodeGen/X86/var-permute-512.ll
  LLVM :: CodeGen/X86/win64_vararg.ll
  LLVM :: CodeGen/X86/x86-64-ms_abi-vararg.ll

[efriedma-quic]

This is a statepoint-specific issue. Normally, we don't generate ORR with a frameindex operand. But the Statepoint code uses TargetFrameIndex, which tricks the lowering code into doing weird things with it. We shouldn't be using TargetFrameIndex as an operand to a target-independent node like a load or an add.