[Aarch64][Codegen] fatal error: Invalid size request on a scalable vector

[jeanPerier]

This was observed when compiling a Fortran application for I cannot share the source with flang from top of the tree on neoverse-v1. Below is a .ll reproducer that crashes codegen/llc when optimized by opt with -O2 -mcpu=neoverse-v1 (also tested to crash with neoverse-v2, neoverse-v3, neoverse-v3ae, neoverse-n1, neoverse-n2, neoverse-n3ae).

In all these cases, it seems llc chokes on a call <vscale x 2 x double> @llvm.sin.nxv2f64(<vscale x 2 x double>) generated by LLVM optimizer.

Reproducer: https://godbolt.org/z/8ajK6W8Wo

target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128-Fn32"
target triple = "aarch64-unknown-linux-gnu"

define void @repro_(ptr %0, i32 %1, i1 %2, i64 %3) {
  br label %5

5:                                                ; preds = %6, %4
  br label %6

6:                                                ; preds = %13, %5
  %7 = phi i64 [ %16, %13 ], [ %3, %5 ]
  %8 = icmp sgt i64 %7, 0
  br i1 %8, label %9, label %5

9:                                                ; preds = %6
  br i1 %2, label %10, label %13

10:                                               ; preds = %9
  %11 = srem i32 1, %1
  %12 = uitofp i32 %11 to double
  br label %13

13:                                               ; preds = %10, %9
  %.4 = phi double [ %12, %10 ], [ 0.000000e+00, %9 ]
  %14 = call double @llvm.sin.f64(double %.4)
  %.unpack = load double, ptr %0, align 8
  %15 = fadd double %.unpack, %14
  store double %15, ptr %0, align 8
  %16 = add i64 %7, -1
  br label %6
}

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare double @llvm.sin.f64(double) #0

attributes #0 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }

clang -c -O2 -mcpu=neoverse-v2 reduced.ll crashes with:

fatal error: error in backend: Invalid size request on a scalable vector.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: clang -c -O2 -mcpu=neoverse-v2 reduced.ll
1.	Code generation
2.	Running pass 'Function Pass Manager' on module 'reduced.ll'.
3.	Running pass 'AArch64 Instruction Selection' on function '@repro_'
 #0 0x00000000042220b0 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) 
 #1 0x000000000421ff70 llvm::sys::RunSignalHandlers()
 #2 0x00000000042202d0 llvm::sys::CleanupOnSignal(unsigned long)
 #3 0x000000000417d090 llvm::CrashRecoveryContext::HandleExit(int) 
 #4 0x00000000042196ec llvm::sys::Process::Exit(int, bool) 
 #5 0x0000000002d36d0c LLVMErrorHandler(void*, char const*, bool) cc1_main.cpp:0:0
 #6 0x0000000004185560 llvm::report_fatal_error(llvm::Twine const&, bool) 
 #7 0x00000000041856b0 llvm::reportFatalInternalError(char const*) 
 #8 0x00000000041cf77c 
 #9 0x0000000002d5acec llvm::EVT::getVectorNumElements() const NVPTXISelLowering.cpp:0:0
#10 0x0000000005f15d7c llvm::SelectionDAG::UnrollVectorOp(llvm::SDNode*, unsigned int) 
#11 0x0000000006022198 (anonymous namespace)::VectorLegalizer::LegalizeOp(llvm::SDValue) LegalizeVectorOps.cpp:0:0
#12 0x00000000060299ac llvm::SelectionDAG::LegalizeVectors()
#13 0x0000000005f3e88c llvm::SelectionDAGISel::CodeGenAndEmitDAG()
#14 0x0000000005f41dc8 llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&)
#15 0x0000000005f42ec0 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&)
#16 0x0000000005f34fec llvm::SelectionDAGISelLegacy::runOnMachineFunction(llvm::MachineFunction&)
#17 0x0000000003629ee8 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#18 0x0000000003c8b6b0 llvm::FPPassManager::runOnFunction(llvm::Function&)
#19 0x0000000003c8b970 llvm::FPPassManager::runOnModule(llvm::Module&)
#20 0x0000000003c8c204 llvm::legacy::PassManagerImpl::run(llvm::Module&)
#21 0x0000000004a494c0 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*)
#22 0x0000000004b4045c clang::CodeGenAction::ExecuteAction() 
#23 0x0000000005062aec clang::FrontendAction::Execute() 
#24 0x0000000004ff7190 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) 
#25 0x000000000514de34 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) 
#26 0x0000000002d393ac cc1_main(llvm::ArrayRef<char const*>, char const*, void*)
#27 0x0000000002d3109c ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#28 0x0000000004e31ab8 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#29 0x000000000417cfa8 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>)
#30 0x0000000004e32090 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#31 0x0000000004df9134 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const
#32 0x0000000004df9d9c clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const
#33 0x0000000004e01424 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&)
#34 0x0000000002d359e8 clang_main(int, char**, llvm::ToolContext const&) 
#35 0x0000000002d45620 main 

clang: error: clang frontend command failed with exit code 70 (use -v to see invocation)
clang version 21.0.0git (https://github.com/llvm/llvm-project d4c7d0be1f5235555393313bb1f8e46c97f76766)
Target: aarch64-unknown-linux-gnu
Thread model: posix
Build config: +assertions

To see the crash with llc only, you can also do: opt -O2 -mcpu=neoverse-v2 reduced.ll -S -o - | llc

[llvmbot]

@llvm/issue-subscribers-backend-aarch64

Author: None (jeanPerier)

This was observed when compiling a Fortran application for I cannot share the source with flang from top of the tree on neoverse-v1. Below is a .ll reproducer that crashes codegen/llc when optimized by opt with `-O2 -mcpu=neoverse-v1` (also tested to crash with `neoverse-v2`, `neoverse-v3`, `neoverse-v3ae`, `neoverse-n1`, `neoverse-n2`, `neoverse-n3ae`).

In all these cases, it seems llc chokes on a call &lt;vscale x 2 x double&gt; @<!-- -->llvm.sin.nxv2f64(&lt;vscale x 2 x double&gt;) generated by LLVM optimizer.

Reproducer:

target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128-Fn32"
target triple = "aarch64-unknown-linux-gnu"

define void @<!-- -->repro_(ptr %0, i32 %1, i1 %2, i64 %3) {
  br label %5

5:                                                ; preds = %6, %4
  br label %6

6:                                                ; preds = %13, %5
  %7 = phi i64 [ %16, %13 ], [ %3, %5 ]
  %8 = icmp sgt i64 %7, 0
  br i1 %8, label %9, label %5

9:                                                ; preds = %6
  br i1 %2, label %10, label %13

10:                                               ; preds = %9
  %11 = srem i32 1, %1
  %12 = uitofp i32 %11 to double
  br label %13

13:                                               ; preds = %10, %9
  %.4 = phi double [ %12, %10 ], [ 0.000000e+00, %9 ]
  %14 = call double @<!-- -->llvm.sin.f64(double %.4)
  %.unpack = load double, ptr %0, align 8
  %15 = fadd double %.unpack, %14
  store double %15, ptr %0, align 8
  %16 = add i64 %7, -1
  br label %6
}

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare double @<!-- -->llvm.sin.f64(double) #<!-- -->0

attributes #<!-- -->0 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }

clang -c -O2 -mcpu=neoverse-v2 reduced.ll crashes with:

fatal error: error in backend: Invalid size request on a scalable vector.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: clang -c -O2 -mcpu=neoverse-v2 reduced.ll
1.	Code generation
2.	Running pass 'Function Pass Manager' on module 'reduced.ll'.
3.	Running pass 'AArch64 Instruction Selection' on function '@<!-- -->repro_'
 #<!-- -->0 0x00000000042220b0 llvm::sys::PrintStackTrace(llvm::raw_ostream&amp;, int) 
 #<!-- -->1 0x000000000421ff70 llvm::sys::RunSignalHandlers()
 #<!-- -->2 0x00000000042202d0 llvm::sys::CleanupOnSignal(unsigned long)
 #<!-- -->3 0x000000000417d090 llvm::CrashRecoveryContext::HandleExit(int) 
 #<!-- -->4 0x00000000042196ec llvm::sys::Process::Exit(int, bool) 
 #<!-- -->5 0x0000000002d36d0c LLVMErrorHandler(void*, char const*, bool) cc1_main.cpp:0:0
 #<!-- -->6 0x0000000004185560 llvm::report_fatal_error(llvm::Twine const&amp;, bool) 
 #<!-- -->7 0x00000000041856b0 llvm::reportFatalInternalError(char const*) 
 #<!-- -->8 0x00000000041cf77c 
 #<!-- -->9 0x0000000002d5acec llvm::EVT::getVectorNumElements() const NVPTXISelLowering.cpp:0:0
#<!-- -->10 0x0000000005f15d7c llvm::SelectionDAG::UnrollVectorOp(llvm::SDNode*, unsigned int) 
#<!-- -->11 0x0000000006022198 (anonymous namespace)::VectorLegalizer::LegalizeOp(llvm::SDValue) LegalizeVectorOps.cpp:0:0
#<!-- -->12 0x00000000060299ac llvm::SelectionDAG::LegalizeVectors()
#<!-- -->13 0x0000000005f3e88c llvm::SelectionDAGISel::CodeGenAndEmitDAG()
#<!-- -->14 0x0000000005f41dc8 llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&amp;)
#<!-- -->15 0x0000000005f42ec0 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&amp;)
#<!-- -->16 0x0000000005f34fec llvm::SelectionDAGISelLegacy::runOnMachineFunction(llvm::MachineFunction&amp;)
#<!-- -->17 0x0000000003629ee8 llvm::MachineFunctionPass::runOnFunction(llvm::Function&amp;) (.part.0) MachineFunctionPass.cpp:0:0
#<!-- -->18 0x0000000003c8b6b0 llvm::FPPassManager::runOnFunction(llvm::Function&amp;)
#<!-- -->19 0x0000000003c8b970 llvm::FPPassManager::runOnModule(llvm::Module&amp;)
#<!-- -->20 0x0000000003c8c204 llvm::legacy::PassManagerImpl::run(llvm::Module&amp;)
#<!-- -->21 0x0000000004a494c0 clang::emitBackendOutput(clang::CompilerInstance&amp;, clang::CodeGenOptions&amp;, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr&lt;llvm::vfs::FileSystem&gt;, std::unique_ptr&lt;llvm::raw_pwrite_stream, std::default_delete&lt;llvm::raw_pwrite_stream&gt;&gt;, clang::BackendConsumer*)
#<!-- -->22 0x0000000004b4045c clang::CodeGenAction::ExecuteAction() 
#<!-- -->23 0x0000000005062aec clang::FrontendAction::Execute() 
#<!-- -->24 0x0000000004ff7190 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&amp;) 
#<!-- -->25 0x000000000514de34 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) 
#<!-- -->26 0x0000000002d393ac cc1_main(llvm::ArrayRef&lt;char const*&gt;, char const*, void*)
#<!-- -->27 0x0000000002d3109c ExecuteCC1Tool(llvm::SmallVectorImpl&lt;char const*&gt;&amp;, llvm::ToolContext const&amp;) driver.cpp:0:0
#<!-- -->28 0x0000000004e31ab8 void llvm::function_ref&lt;void ()&gt;::callback_fn&lt;clang::driver::CC1Command::Execute(llvm::ArrayRef&lt;std::optional&lt;llvm::StringRef&gt;&gt;, std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt;&gt;*, bool*) const::'lambda'()&gt;(long) Job.cpp:0:0
#<!-- -->29 0x000000000417cfa8 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref&lt;void ()&gt;)
#<!-- -->30 0x0000000004e32090 clang::driver::CC1Command::Execute(llvm::ArrayRef&lt;std::optional&lt;llvm::StringRef&gt;&gt;, std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt;&gt;*, bool*) const (.part.0) Job.cpp:0:0
#<!-- -->31 0x0000000004df9134 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&amp;, clang::driver::Command const*&amp;, bool) const
#<!-- -->32 0x0000000004df9d9c clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&amp;, llvm::SmallVectorImpl&lt;std::pair&lt;int, clang::driver::Command const*&gt;&gt;&amp;, bool) const
#<!-- -->33 0x0000000004e01424 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&amp;, llvm::SmallVectorImpl&lt;std::pair&lt;int, clang::driver::Command const*&gt;&gt;&amp;)
#<!-- -->34 0x0000000002d359e8 clang_main(int, char**, llvm::ToolContext const&amp;) 
#<!-- -->35 0x0000000002d45620 main 

clang: error: clang frontend command failed with exit code 70 (use -v to see invocation)
clang version 21.0.0git (https://github.com/llvm/llvm-project d4c7d0be1f5235555393313bb1f8e46c97f76766)
Target: aarch64-unknown-linux-gnu
Thread model: posix
Build config: +assertions

To see the crash with llc only, you can also do: opt -O2 -mcpu=neoverse-v2 reduced.ll -S -o - | llc

[davemgreen]

It should have an invalid cost, preventing vectorization. I think this might be a loop-vectorizer issue. The vplan looks like

VPlan 'Initial VPlan for VF={vscale x 2},UF>=1' {
Live-in vp<%0> = VF * UF
Live-in vp<%1> = vector-trip-count
Live-in ir<%3> = original trip-count

ir-bb<.lr.ph>:
  IR   %.promoted = load double, ptr %0, align 8
Successor(s): scalar.ph, vector.ph

vector.ph:
  vp<%2> = DERIVED-IV ir<%3> + vp<%1> * ir<-1>
  EMIT vp<%3> = reduction-start-vector ir<%.promoted>, ir<-0.000000e+00>, ir<1>
  EMIT vp<%4> = select ir<%2>, ir<%1>, ir<1>
  WIDEN ir<%11> = srem ir<1>, vp<%4>
  WIDEN-CAST ir<%12> = uitofp nneg ir<%11> to double
  BLEND ir<%.4> = ir<0.000000e+00> ir<%12>/ir<%2>
  WIDEN-INTRINSIC ir<%14> = call llvm.sin(ir<%.4>)
Successor(s): vector loop

<x1> vector loop: {
  vector.body:
    EMIT vp<%5> = CANONICAL-INDUCTION ir<0>, vp<%index.next>
    WIDEN-REDUCTION-PHI ir<%8> = phi vp<%3>, ir<%15>
    REDUCE ir<%15> = ir<%8> +  reduce.fadd (ir<%14>)
    EMIT vp<%index.next> = add nuw vp<%5>, vp<%0>
    EMIT branch-on-count vp<%index.next>, vp<%1>
  No successors
}
Successor(s): middle.block

middle.block:
  EMIT vp<%7> = compute-reduction-result ir<%8>, ir<%15>
  EMIT vp<%8> = extract-last-element vp<%7>
  EMIT vp<%cmp.n> = icmp eq ir<%3>, vp<%1>
  EMIT branch-on-cond vp<%cmp.n>
Successor(s): ir-bb<..loopexit_crit_edge>, scalar.ph

ir-bb<..loopexit_crit_edge>:
  IR   %.lcssa = phi double [ %15, %13 ] (extra operand: vp<%8> from middle.block)
  IR   store double %.lcssa, ptr %0, align 8
No successors

scalar.ph:
  EMIT-SCALAR vp<%bc.merge.rdx> = phi [ vp<%7>, middle.block ], [ ir<%.promoted>, ir-bb<.lr.ph> ]
  EMIT-SCALAR vp<%bc.resume.val> = phi [ vp<%2>, middle.block ], [ ir<%3>, ir-bb<.lr.ph> ]
Successor(s): ir-bb<>

ir-bb<>:
  IR   %8 = phi double [ %.promoted, %.lr.ph ], [ %15, %13 ] (extra operand: vp<%bc.merge.rdx> from scalar.ph)
  IR   %9 = phi i64 [ %3, %.lr.ph ], [ %16, %13 ] (extra operand: vp<%bc.resume.val> from scalar.ph)
No successors
}

So the sin is hoisted (?), but the instruction should be given an invalid cost LV: Found an estimated cost of Invalid for VF vscale x 2 For instruction: %14 = tail call double @llvm.sin.f64(double %.4). It is not included though, so the VF vscale x 2 is chosen. (It feels like some of those values could be scalar anyway and the splat done later).