clang-17 llvm::MachineFunctionPass::runOnFunction crash on invalid input

[arndb]

I came across this internal error while debugging a problem in my project:

0.	Program arguments: /usr/lib/llvm-17/bin/clang -cc1 -triple x86_64-unknown-linux-gnu -emit-obj -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name delay.c -function-alignment 4 -falign-loops=1 -mrelocation-model static -fno-delete-null-pointer-checks -fwarn-stack-size=2048 -mframe-pointer=none -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -mcmodel=kernel -target-cpu nocona -target-feature -sse -target-feature -mmx -target-feature -sse2 -target-feature -3dnow -target-feature -avx -target-feature -x87 -disable-red-zone -mskip-rax-setup -debugger-tuning=gdb -fcoverage-compilation-dir=/home/arnd/arm-soc/build/tmp86 -nostdsysteminc -nobuiltininc -D __KERNEL__ -D KBUILD_EXTRA_WARN1 -D KCONFIG_SEED=0x1110D234 -D CC_USING_NOP_MCOUNT -D CC_USING_FENTRY -D KCONFIG_SEED=0x1110D234 -D KBUILD_MODFILE=\"arch/x86/lib/delay\" -D KBUILD_BASENAME=\"delay\" -D KBUILD_MODNAME=\"delay\" -D __KBUILD_MODNAME=kmod_delay -fmacro-prefix-map=/home/arnd/arm-soc/= -Os -Werror=unknown-warning-option -Werror=ignored-optimization-argument -Werror=option-ignored -Werror=unused-command-line-argument -Wundef -Werror -Wno-sign-compare -Wall -Wundef -Werror=strict-prototypes -Wno-trigraphs -Werror=implicit-function-declaration -Werror=implicit-int -Werror=return-type -Wframe-larger-than=2048 -Wno-gnu -Wno-unused-but-set-variable -Wno-unused-const-variable -Wdeclaration-after-statement -Wvla -Wno-pointer-sign -Wcast-function-type -Werror=date-time -Werror=incompatible-pointer-types -Wextra -Wunused -Wno-unused-parameter -Wold-style-definition -Wmissing-include-dirs -Wmissing-prototypes -Wmissing-format-attribute -Wmissing-prototypes -Wno-missing-field-initializers -Wno-type-limits -Wno-unused-but-set-variable -Wno-unused-but-set-parameter -Wno-unused-const-variable -Wno-void-pointer-to-enum-cast -Wno-address-of-packed-member -Wno-frame-address -Wno-format-security -Wno-format -Wno-initializer-overrides -Wno-sign-compare -Wimplicit-fallthrough -Werror -std=gnu11 -fdebug-compilation-dir=/home/arnd/arm-soc/build/tmp86 -ferror-limit 19 -fzero-call-used-regs=used-gpr -fwrapv -fstrict-flex-arrays=3 -stack-protector 1 -mstack-alignment=8 -fcf-protection=none -fno-signed-char -fwchar-type=short -fno-signed-wchar -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -faddrsig -x c delay-aca5b8.c
1.	<eof> parser at end of file
2.	Code generation
3.	Running pass 'Function Pass Manager' on module 'delay-aca5b8.c'.
4.	Running pass 'Prologue/Epilogue Insertion & Frame Finalization' on function '@__delay'
 #0 0x0000ffff6da81568 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xcb1568)
 #1 0x0000ffff6da7f830 llvm::sys::RunSignalHandlers() (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xcaf830)
 #2 0x0000ffff6da81c4c (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xcb1c4c)
 #3 0x0000ffff776e07fc (linux-vdso.so.1+0x7fc)
 #4 0x0000ffff6defdc60 (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0x112dc60)
 #5 0x0000ffff6ddf7d2c llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0x1027d2c)
 #6 0x0000ffff6dbb8b2c llvm::FPPassManager::runOnFunction(llvm::Function&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xde8b2c)
 #7 0x0000ffff6dbbe1ec llvm::FPPassManager::runOnModule(llvm::Module&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xdee1ec)
 #8 0x0000ffff6dbb90a0 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xde90a0)
 #9 0x0000ffff75678160 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x1918160)
#10 0x0000ffff75955690 (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x1bf5690)
#11 0x0000ffff747617d8 clang::ParseAST(clang::Sema&, bool, bool) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0xa017d8)
#12 0x0000ffff7628b990 clang::FrontendAction::Execute() (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x252b990)
#13 0x0000ffff7621d7b4 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x24bd7b4)
#14 0x0000ffff7630163c clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x25a163c)
#15 0x0000aaab83df29d4 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/usr/lib/llvm-17/bin/clang+0x129d4)
#16 0x0000aaab83df0000 (/usr/lib/llvm-17/bin/clang+0x10000)
#17 0x0000aaab83def084 clang_main(int, char**, llvm::ToolContext const&) (/usr/lib/llvm-17/bin/clang+0xf084)
#18 0x0000aaab83dfb028 main (/usr/lib/llvm-17/bin/clang+0x1b028)
#19 0x0000ffff6c8e7780 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#20 0x0000ffff6c8e7858 call_init ./csu/../csu/libc-start.c:128:20
#21 0x0000ffff6c8e7858 __libc_start_main ./csu/../csu/libc-start.c:368:5
#22 0x0000aaab83deccb0 _start (/usr/lib/llvm-17/bin/clang+0xccb0)

[arndb]

reproducer:
delay-aca5b8.c.txt
delay-aca5b8.sh.txt

[arndb]

It looks like I can now reproduce the issue with correct source code as well, this is a reduced test case:

$ cat delay-5d0288.c
void (*delay_fn)(int);
void __delay(void) { delay_fn(1); }

$ clang-17 -c --target=x86_64-unknown-linux-gnu -O2 -x c delay-5d0288.c -fzero-call-used-regs=used-gpr
1.	<eof> parser at end of file
2.	Code generation
3.	Running pass 'Function Pass Manager' on module 'delay-5d0288.c'.
4.	Running pass 'Prologue/Epilogue Insertion & Frame Finalization' on function '@__delay'
 #0 0x0000ffff8d7f1b68 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xcb1b68)
 #1 0x0000ffff8d7efe30 llvm::sys::RunSignalHandlers() (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xcafe30)
 #2 0x0000ffff8d7482b8 (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xc082b8)
 #3 0x0000ffff974507fc (linux-vdso.so.1+0x7fc)
 #4 0x0000ffff8dc6eebc (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0x112eebc)
 #5 0x0000ffff8db68db8 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0x1028db8)
 #6 0x0000ffff8d929810 llvm::FPPassManager::runOnFunction(llvm::Function&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xde9810)
 #7 0x0000ffff8d92eed0 llvm::FPPassManager::runOnModule(llvm::Module&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xdeeed0)
 #8 0x0000ffff8d929d84 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xde9d84)
 #9 0x0000ffff953e9ef4 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream> >) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x1919ef4)
#10 0x0000ffff956ccc64 (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x1bfcc64)
#11 0x0000ffff944d2b6c clang::ParseAST(clang::Sema&, bool, bool) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0xa02b6c)
#12 0x0000ffff96002478 clang::FrontendAction::Execute() (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x2532478)
#13 0x0000ffff95f9417c clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x24c417c)
#14 0x0000ffff96078144 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x25a8144)
#15 0x0000aaaade4f29d4 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/usr/lib/llvm-17/bin/clang+0x129d4)
#16 0x0000aaaade4f0000 (/usr/lib/llvm-17/bin/clang+0x10000)
#17 0x0000ffff95cb8838 (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x21e8838)
#18 0x0000ffff8d74802c llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xc0802c)
#19 0x0000ffff95cb7ff0 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, bool*) const (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x21e7ff0)
#20 0x0000ffff95c87eec clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x21b7eec)
#21 0x0000ffff95c880f4 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*> >&, bool) const (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x21b80f4)
#22 0x0000ffff95c9f77c clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*> >&) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x21cf77c)
#23 0x0000aaaade4ef700 clang_main(int, char**, llvm::ToolContext const&) (/usr/lib/llvm-17/bin/clang+0xf700)
#24 0x0000aaaade4fb028 main (/usr/lib/llvm-17/bin/clang+0x1b028)
#25 0x0000ffff8c657780 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#26 0x0000ffff8c657858 call_init ./csu/../csu/libc-start.c:128:20
#27 0x0000ffff8c657858 __libc_start_main ./csu/../csu/libc-start.c:368:5
#28 0x0000aaaade4eccb0 _start (/usr/lib/llvm-17/bin/clang+0xccb0)
clang-17: error: clang frontend command failed with exit code 139 (use -v to see invocation)
Debian clang version 17.0.0 (++20230624112259+eaaacc3c651e-1~exp1~20230624112316.43)

[MaskRay]

Fixed in main branch by [PEI] Don't zero out noreg operands.

/cherry-pick f800c1f