[18 regression] Assertion `!NodePtr->isKnownSentinel()' failed at -O3 with aarch64 targets

[berolinux]

Building the attached test case (extracted from mesa 24.0.0-rc3) with clang 18-rc1 at -O3 for aarch64 targets fails.
Non-aarch64 targets are ok, aarch64 targets are ok at -O2 and lower.

$ clang -target aarch64-linux-gnu -O3 -c testcase.c
testcase.c:23:9: warning: comparison between pointer and integer ('int' and 'struct (unnamed struct at testcase.c:6:1) *') [-Wpointer-integer-compare]
   23 |   if (l == &j)
      |       ~ ^  ~~
testcase.c:31:4: warning: passing arguments to 'f' without a prototype is deprecated in all versions of C and is not supported in C23 [-Wdeprecated-non-prototype]
   31 |   f(k, aq);
      |    ^
clang: /builddir/build/BUILD/llvm-project-release-18.x/llvm/include/llvm/ADT/ilist_iterator.h:138: reference llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::MachineInstr, true, true, void, false>, false, false>::operator*() const [OptionsT = llvm::ilist_detail::node_options<llvm::MachineInstr, true, true, void, false>, IsReverse = false, IsConst = false]: Assertion `!NodePtr->isKnownSentinel()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: clang -target aarch64-linux-gnu -O3 -c testcase.c
1.      <eof> parser at end of file
2.      Code generation
3.      Running pass 'Function Pass Manager' on module 'testcase.c'.
4.      Running pass 'AArch64 load / store optimization pass' on function '@o'
 #0 0x00007f341c779806 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib64/libLLVM-18.so+0x4579806)
 #1 0x00007f341c77847a llvm::sys::RunSignalHandlers() (/usr/lib64/libLLVM-18.so+0x457847a)
 #2 0x00007f341c69106e (/usr/lib64/libLLVM-18.so+0x449106e)
 #3 0x00007f3417c55700 (/usr/lib64/libc.so.6+0x3d700)
 #4 0x00007f3417ca49cc (/usr/lib64/libc.so.6+0x8c9cc)
 #5 0x00007f3417c55652 gsignal (/usr/lib64/libc.so.6+0x3d652)
 #6 0x00007f3417c3e4ad abort (/usr/lib64/libc.so.6+0x264ad)
 #7 0x00007f3417c3e3d5 (/usr/lib64/libc.so.6+0x263d5)
 #8 0x00007f3417c4e042 (/usr/lib64/libc.so.6+0x36042)
 #9 0x00007f341cb8c7c3 (/usr/lib64/libLLVM-18.so+0x498c7c3)
#10 0x00007f341f48b01a (/usr/lib64/libLLVM-18.so+0x728b01a)
#11 0x00007f341f4879b3 (/usr/lib64/libLLVM-18.so+0x72879b3)
#12 0x00007f341cdd4dc1 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (/usr/lib64/libLLVM-18.so+0x4bd4dc1)
#13 0x00007f341ca1efe3 llvm::FPPassManager::runOnFunction(llvm::Function&) (/usr/lib64/libLLVM-18.so+0x481efe3)
#14 0x00007f341ca2b1c4 llvm::FPPassManager::runOnModule(llvm::Module&) (/usr/lib64/libLLVM-18.so+0x482b1c4)
#15 0x00007f341ca23db3 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/usr/lib64/libLLVM-18.so+0x4823db3)
#16 0x00007f3424baf21b clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/usr/lib64/libclang-cpp.so.18+0x2daf21b)
#17 0x00007f34250466c7 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/usr/lib64/libclang-cpp.so.18+0x32466c7)
#18 0x00007f34236428c6 clang::ParseAST(clang::Sema&, bool, bool) (/usr/lib64/libclang-cpp.so.18+0x18428c6)
#19 0x00007f3425bb2f5b clang::FrontendAction::Execute() (/usr/lib64/libclang-cpp.so.18+0x3db2f5b)
#20 0x00007f3425b149e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/usr/lib64/libclang-cpp.so.18+0x3d149e9)
#21 0x00007f3425c33328 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/usr/lib64/libclang-cpp.so.18+0x3e33328)
#22 0x00005574a76a9fa0 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/usr/bin/clang-18+0x16fa0)
#23 0x00005574a76a5df0 (/usr/bin/clang-18+0x12df0)
#24 0x00007f34256fa74b (/usr/lib64/libclang-cpp.so.18+0x38fa74b)
#25 0x00007f341c6912e3 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/usr/lib64/libLLVM-18.so+0x44912e3)
#26 0x00007f34256fa633 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (/usr/lib64/libclang-cpp.so.18+0x38fa633)
#27 0x00007f34256b3cac clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/usr/lib64/libclang-cpp.so.18+0x38b3cac)
#28 0x00007f34256b41ae clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/usr/lib64/libclang-cpp.so.18+0x38b41ae)
#29 0x00007f34256f5ccf clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/usr/lib64/libclang-cpp.so.18+0x38f5ccf)
#30 0x00005574a76a5366 clang_main(int, char**, llvm::ToolContext const&) (/usr/bin/clang-18+0x12366)
#31 0x00005574a76b5186 main (/usr/bin/clang-18+0x22186)
#32 0x00007f3417c3fc0a (/usr/lib64/libc.so.6+0x27c0a)
#33 0x00007f3417c3fcc5 __libc_start_main (/usr/lib64/libc.so.6+0x27cc5)
#34 0x00005574a76a1f01 _start (/usr/bin/clang-18+0xef01)
clang: error: clang frontend command failed with exit code 134 (use -v to see invocation)

testcase.c
https://godbolt.org/z/4dvqxc1rr

$ cat testcase.c
enum { a };
struct c {
  char d[0];
};
enum { e = 8 };
struct {
  int b[16385];
  char ah[4];
  struct c ak;
} f(), j;
typedef union {
  struct {
    int g;
  };
  int h;
} i;
i k;
int l, m;
unsigned n();
void o() {
  unsigned aq = n();
  k.h = 0;
  if (l == &j)
    aq = j.ak.d[aq];
  else {
    if (m == a)
      aq = j.ah[aq];
    if (m)
      k.g = e;
  }
  f(k, aq);
}

[llvmbot]

@llvm/issue-subscribers-backend-aarch64

Author: Bernhard Rosenkraenzer (berolinux)

Building the attached test case (extracted from mesa 24.0.0-rc3) with clang 18-rc1 at `-O3` for aarch64 targets fails. Non-aarch64 targets are ok, aarch64 targets are ok at -O2 and lower.

$ clang -target aarch64-linux-gnu -O3 -c testcase.c
testcase.c:23:9: warning: comparison between pointer and integer ('int' and 'struct (unnamed struct at testcase.c:6:1) *') [-Wpointer-integer-compare]
   23 |   if (l == &j)
      |       ~ ^  ~~
testcase.c:31:4: warning: passing arguments to 'f' without a prototype is deprecated in all versions of C and is not supported in C23 [-Wdeprecated-non-prototype]
   31 |   f(k, aq);
      |    ^
clang: /builddir/build/BUILD/llvm-project-release-18.x/llvm/include/llvm/ADT/ilist_iterator.h:138: reference llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::MachineInstr, true, true, void, false>, false, false>::operator*() const [OptionsT = llvm::ilist_detail::node_options<llvm::MachineInstr, true, true, void, false>, IsReverse = false, IsConst = false]: Assertion `!NodePtr->isKnownSentinel()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: clang -target aarch64-linux-gnu -O3 -c testcase.c
1.      <eof> parser at end of file
2.      Code generation
3.      Running pass 'Function Pass Manager' on module 'testcase.c'.
4.      Running pass 'AArch64 load / store optimization pass' on function '@<!-- -->o'
 #<!-- -->0 0x00007f341c779806 llvm::sys::PrintStackTrace(llvm::raw_ostream&amp;, int) (/usr/lib64/libLLVM-18.so+0x4579806)
 #<!-- -->1 0x00007f341c77847a llvm::sys::RunSignalHandlers() (/usr/lib64/libLLVM-18.so+0x457847a)
 #<!-- -->2 0x00007f341c69106e (/usr/lib64/libLLVM-18.so+0x449106e)
 #<!-- -->3 0x00007f3417c55700 (/usr/lib64/libc.so.6+0x3d700)
 #<!-- -->4 0x00007f3417ca49cc (/usr/lib64/libc.so.6+0x8c9cc)
 #<!-- -->5 0x00007f3417c55652 gsignal (/usr/lib64/libc.so.6+0x3d652)
 #<!-- -->6 0x00007f3417c3e4ad abort (/usr/lib64/libc.so.6+0x264ad)
 #<!-- -->7 0x00007f3417c3e3d5 (/usr/lib64/libc.so.6+0x263d5)
 #<!-- -->8 0x00007f3417c4e042 (/usr/lib64/libc.so.6+0x36042)
 #<!-- -->9 0x00007f341cb8c7c3 (/usr/lib64/libLLVM-18.so+0x498c7c3)
#<!-- -->10 0x00007f341f48b01a (/usr/lib64/libLLVM-18.so+0x728b01a)
#<!-- -->11 0x00007f341f4879b3 (/usr/lib64/libLLVM-18.so+0x72879b3)
#<!-- -->12 0x00007f341cdd4dc1 llvm::MachineFunctionPass::runOnFunction(llvm::Function&amp;) (/usr/lib64/libLLVM-18.so+0x4bd4dc1)
#<!-- -->13 0x00007f341ca1efe3 llvm::FPPassManager::runOnFunction(llvm::Function&amp;) (/usr/lib64/libLLVM-18.so+0x481efe3)
#<!-- -->14 0x00007f341ca2b1c4 llvm::FPPassManager::runOnModule(llvm::Module&amp;) (/usr/lib64/libLLVM-18.so+0x482b1c4)
#<!-- -->15 0x00007f341ca23db3 llvm::legacy::PassManagerImpl::run(llvm::Module&amp;) (/usr/lib64/libLLVM-18.so+0x4823db3)
#<!-- -->16 0x00007f3424baf21b clang::EmitBackendOutput(clang::DiagnosticsEngine&amp;, clang::HeaderSearchOptions const&amp;, clang::CodeGenOptions const&amp;, clang::TargetOptions const&amp;, clang::LangOptions const&amp;, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr&lt;llvm::vfs::FileSystem&gt;, std::unique_ptr&lt;llvm::raw_pwrite_stream, std::default_delete&lt;llvm::raw_pwrite_stream&gt;&gt;, clang::BackendConsumer*) (/usr/lib64/libclang-cpp.so.18+0x2daf21b)
#<!-- -->17 0x00007f34250466c7 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&amp;) (/usr/lib64/libclang-cpp.so.18+0x32466c7)
#<!-- -->18 0x00007f34236428c6 clang::ParseAST(clang::Sema&amp;, bool, bool) (/usr/lib64/libclang-cpp.so.18+0x18428c6)
#<!-- -->19 0x00007f3425bb2f5b clang::FrontendAction::Execute() (/usr/lib64/libclang-cpp.so.18+0x3db2f5b)
#<!-- -->20 0x00007f3425b149e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&amp;) (/usr/lib64/libclang-cpp.so.18+0x3d149e9)
#<!-- -->21 0x00007f3425c33328 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/usr/lib64/libclang-cpp.so.18+0x3e33328)
#<!-- -->22 0x00005574a76a9fa0 cc1_main(llvm::ArrayRef&lt;char const*&gt;, char const*, void*) (/usr/bin/clang-18+0x16fa0)
#<!-- -->23 0x00005574a76a5df0 (/usr/bin/clang-18+0x12df0)
#<!-- -->24 0x00007f34256fa74b (/usr/lib64/libclang-cpp.so.18+0x38fa74b)
#<!-- -->25 0x00007f341c6912e3 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref&lt;void ()&gt;) (/usr/lib64/libLLVM-18.so+0x44912e3)
#<!-- -->26 0x00007f34256fa633 clang::driver::CC1Command::Execute(llvm::ArrayRef&lt;std::optional&lt;llvm::StringRef&gt;&gt;, std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt;&gt;*, bool*) const (/usr/lib64/libclang-cpp.so.18+0x38fa633)
#<!-- -->27 0x00007f34256b3cac clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&amp;, clang::driver::Command const*&amp;, bool) const (/usr/lib64/libclang-cpp.so.18+0x38b3cac)
#<!-- -->28 0x00007f34256b41ae clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&amp;, llvm::SmallVectorImpl&lt;std::pair&lt;int, clang::driver::Command const*&gt;&gt;&amp;, bool) const (/usr/lib64/libclang-cpp.so.18+0x38b41ae)
#<!-- -->29 0x00007f34256f5ccf clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&amp;, llvm::SmallVectorImpl&lt;std::pair&lt;int, clang::driver::Command const*&gt;&gt;&amp;) (/usr/lib64/libclang-cpp.so.18+0x38f5ccf)
#<!-- -->30 0x00005574a76a5366 clang_main(int, char**, llvm::ToolContext const&amp;) (/usr/bin/clang-18+0x12366)
#<!-- -->31 0x00005574a76b5186 main (/usr/bin/clang-18+0x22186)
#<!-- -->32 0x00007f3417c3fc0a (/usr/lib64/libc.so.6+0x27c0a)
#<!-- -->33 0x00007f3417c3fcc5 __libc_start_main (/usr/lib64/libc.so.6+0x27cc5)
#<!-- -->34 0x00005574a76a1f01 _start (/usr/bin/clang-18+0xef01)
clang: error: clang frontend command failed with exit code 134 (use -v to see invocation)

testcase.c

$ cat testcase.c
enum { a };
struct c {
  char d[0];
};
enum { e = 8 };
struct {
  int b[16385];
  char ah[4];
  struct c ak;
} f(), j;
typedef union {
  struct {
    int g;
  };
  int h;
} i;
i k;
int l, m;
unsigned n();
void o() {
  unsigned aq = n();
  k.h = 0;
  if (l == &j)
    aq = j.ak.d[aq];
  else {
    if (m == a)
      aq = j.ah[aq];
    if (m)
      k.g = e;
  }
  f(k, aq);
}

[berolinux]

(Slightly) further reduced test case:

struct {
  int a1[16385];
  char a2[1];
  char a3[1];
} a(), b;
typedef union {
  struct {
    int c1;
  };
  int c2;
} c;
c d;
int e;
unsigned f();
void g() {
  unsigned aq = f();
  d.c2 = 0;
  if (e == &b)
    aq = b.a2[aq];
  else {
    if (e == 0)
      aq = b.a3[aq];
    if (e)
      d.c1 = 1;
  }
  a(d, aq);
}

testcase.c

[davemgreen]

I reverted #75343 in 915c3d9, which should hopefully fix this.

[davemgreen]

/cherry-pick 915c3d9