[AArch64][GISel] llc crashed at -O1/O2/O3: Assertion `(ResTy.getElementType() == Op0Ty.getElementType()) && "Different vector element types"' failed.

[XChy]

Reproducer: https://godbolt.org/z/ofx97TYjG
Testcase:

target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128-Fn32"
target triple = "aarch64-unknown-linux-musl"

define <2 x i8> @backsmith_pure_3() {
entry:
  %0 = zext <2 x i1> zeroinitializer to <2 x i32>
  %.neg44 = shl <2 x i32> splat (i32 1), %0
  %.neg45 = trunc <2 x i32> %.neg44 to <2 x i8>
  ret <2 x i8> %.neg45
}

llc output:

llc: /root/llvm-project/llvm/lib/CodeGen/GlobalISel/MachineIRBuilder.cpp:265: llvm::MachineInstrBuilder llvm::MachineIRBuilder::buildPadVectorWithUndefElements(const llvm::DstOp&, const llvm::SrcOp&): Assertion `(ResTy.getElementType() == Op0Ty.getElementType()) && "Different vector element types"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/llc -o /app/output.s -x86-asm-syntax=intel -O1 -global-isel <source>
1.	Running pass 'Function Pass Manager' on module '<source>'.
2.	Running pass 'Legalizer' on function '@backsmith_pure_3'
 #0 0x00000000041bbfc8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x41bbfc8)
 #1 0x00000000041b8e74 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x000071d488c42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x000071d488c969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x000071d488c42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x000071d488c287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x000071d488c2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x000071d488c39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x00000000048a04e7 llvm::MachineIRBuilder::buildPadVectorWithUndefElements(llvm::DstOp const&, llvm::SrcOp const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x48a04e7)
 #9 0x0000000004835a00 llvm::LegalizerHelper::moreElementsVectorSrc(llvm::MachineInstr&, llvm::LLT, unsigned int) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x4835a00)
#10 0x000000000486a214 llvm::LegalizerHelper::moreElementsVector(llvm::MachineInstr&, unsigned int, llvm::LLT) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x486a214)
#11 0x000000000482bfbb llvm::Legalizer::legalizeMachineFunction(llvm::MachineFunction&, llvm::LegalizerInfo const&, llvm::ArrayRef<llvm::GISelChangeObserver*>, llvm::LostDebugLocObserver&, llvm::MachineIRBuilder&, llvm::GISelValueTracking*) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x482bfbb)
#12 0x000000000482e38e llvm::Legalizer::runOnMachineFunction(llvm::MachineFunction&) (.part.0) Legalizer.cpp:0:0
#13 0x000000000309b2d9 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#14 0x00000000036e8ff6 llvm::FPPassManager::runOnFunction(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x36e8ff6)
#15 0x00000000036e93a1 llvm::FPPassManager::runOnModule(llvm::Module&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x36e93a1)
#16 0x00000000036e9c0f llvm::legacy::PassManagerImpl::run(llvm::Module&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x36e9c0f)
#17 0x00000000008fb51f compileModule(char**, llvm::LLVMContext&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) llc.cpp:0:0
#18 0x00000000007c85e9 main (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x7c85e9)
#19 0x000071d488c29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#20 0x000071d488c29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#21 0x00000000008f07b5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x8f07b5)
Program terminated with signal: SIGSEGV
Compiler returned: 139

[llvmbot]

@llvm/issue-subscribers-backend-aarch64

Author: Hongyu Chen (XChy)

Reproducer: https://godbolt.org/z/ofx97TYjG Testcase: ```llvm target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128-Fn32" target triple = "aarch64-unknown-linux-musl"

define <2 x i8> @backsmith_pure_3() {
entry:
%0 = zext <2 x i1> zeroinitializer to <2 x i32>
%.neg44 = shl <2 x i32> splat (i32 1), %0
%.neg45 = trunc <2 x i32> %.neg44 to <2 x i8>
ret <2 x i8> %.neg45
}

llc output:

llc: /root/llvm-project/llvm/lib/CodeGen/GlobalISel/MachineIRBuilder.cpp:265: llvm::MachineInstrBuilder llvm::MachineIRBuilder::buildPadVectorWithUndefElements(const llvm::DstOp&, const llvm::SrcOp&): Assertion `(ResTy.getElementType() == Op0Ty.getElementType()) && "Different vector element types"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/llc -o /app/output.s -x86-asm-syntax=intel -O1 -global-isel <source>

1. Running pass 'Function Pass Manager' on module '<source>'.
2. Running pass 'Legalizer' on function '@backsmith_pure_3'
   #0 0x00000000041bbfc8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x41bbfc8)
   #1 0x00000000041b8e74 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
   #2 0x000071d488c42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
   #3 0x000071d488c969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
   #4 0x000071d488c42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
   #5 0x000071d488c287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
   #6 0x000071d488c2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
   #7 0x000071d488c39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
   #8 0x00000000048a04e7 llvm::MachineIRBuilder::buildPadVectorWithUndefElements(llvm::DstOp const&, llvm::SrcOp const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x48a04e7)
   #9 0x0000000004835a00 llvm::LegalizerHelper::moreElementsVectorSrc(llvm::MachineInstr&, llvm::LLT, unsigned int) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x4835a00)
   #10 0x000000000486a214 llvm::LegalizerHelper::moreElementsVector(llvm::MachineInstr&, unsigned int, llvm::LLT) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x486a214)
   #11 0x000000000482bfbb llvm::Legalizer::legalizeMachineFunction(llvm::MachineFunction&, llvm::LegalizerInfo const&, llvm::ArrayRef<llvm::GISelChangeObserver*>, llvm::LostDebugLocObserver&, llvm::MachineIRBuilder&, llvm::GISelValueTracking*) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x482bfbb)
   #12 0x000000000482e38e llvm::Legalizer::runOnMachineFunction(llvm::MachineFunction&) (.part.0) Legalizer.cpp:0:0
   #13 0x000000000309b2d9 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
   #14 0x00000000036e8ff6 llvm::FPPassManager::runOnFunction(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x36e8ff6)
   #15 0x00000000036e93a1 llvm::FPPassManager::runOnModule(llvm::Module&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x36e93a1)
   #16 0x00000000036e9c0f llvm::legacy::PassManagerImpl::run(llvm::Module&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x36e9c0f)
   #17 0x00000000008fb51f compileModule(char**, llvm::LLVMContext&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) llc.cpp:0:0
   #18 0x00000000007c85e9 main (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x7c85e9)
   #19 0x000071d488c29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
   #20 0x000071d488c29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
   #21 0x00000000008f07b5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x8f07b5)
   Program terminated with signal: SIGSEGV
   Compiler returned: 139

</details>

[Rajveer100]

Different behaviors as we go back to earlier versions:

LLVM ERROR: unable to legalize instruction: %18:_(<8 x s8>) = G_BUILD_VECTOR %15:_(s32), %16:_(s32), %17:_(s32), %17:_(s32), %17:_(s32), %17:_(s32), %17:_(s32), %17:_(s32) (in function: backsmith_pure_3)

LLVM ERROR: unable to legalize instruction: %38:_(s8), %39:_(s8) = G_UNMERGE_VALUES %28:_(<2 x s8>) (in function: backsmith_pure_3)

LLVM ERROR: unable to legalize instruction: %33:_(<2 x s16>) = G_ANYEXT %28:_(<2 x s8>) (in function: backsmith_pure_3)

/opt/compiler-explorer/clang-17.0.1/bin/llc: error: /opt/compiler-explorer/clang-17.0.1/bin/llc: <source>:7:27: error: expected value token
  %.neg44 = shl <2 x i32> splat (i32 1), %0
                          ^

[XChy]

Yep, and it's not an aarch64-specific problem: https://godbolt.org/z/bjM7Tso1q, though my unreducer reproducer just crashed AArch64 clang.

[cofibrant]

I'd be happy to look into this from tomorrow if no-one else is

[cofibrant]

I believe I've understood what's causing the crash, but I'm not sure how to proceed. Tagging @davemgreen, @arsenm and @aemerson in the hope they have a better idea. Here's what I've understood:

After translating to MIR we obtain the following:

bb.1.entry:
  %1:_(s1) = G_CONSTANT i1 false
  %0:_(<2 x s1>) = G_BUILD_VECTOR %1:_(s1), %1:_(s1)
  %4:_(s32) = G_CONSTANT i32 1
  %3:_(<2 x s32>) = G_BUILD_VECTOR %4:_(s32), %4:_(s32)
  %2:_(<2 x s32>) = G_ZEXT %0:_(<2 x s1>)
  %5:_(<2 x s32>) = G_SHL %3:_, %2:_(<2 x s32>)
  %6:_(<2 x s8>) = G_TRUNC %5:_(<2 x s32>)
  %7:_(<2 x s32>) = G_ANYEXT %6:_(<2 x s8>)
  $d0 = COPY %7:_(<2 x s32>)
  RET_ReallyLR implicit $d0

Note that both operands to the G_SHL instruction have the same type. Then, the pre-legaliser combiner runs and we obtain:

bb.1.entry:
  %1:_(s1) = G_CONSTANT i1 false
  %0:_(<2 x s1>) = G_BUILD_VECTOR %1:_(s1), %1:_(s1)
  %2:_(<2 x s32>) = G_ZEXT %0:_(<2 x s1>)
  %10:_(s8) = G_CONSTANT i8 1
  %8:_(<2 x s8>) = G_BUILD_VECTOR %10:_(s8), %10:_(s8)
  %9:_(<2 x s8>) = G_SHL %8:_, %2:_(<2 x s32>)
  %7:_(<2 x s32>) = G_ANYEXT %9:_(<2 x s8>)
  $d0 = COPY %7:_(<2 x s32>)
  RET_ReallyLR implicit $d0

In particular, we've optimised out the G_TRUNC. This optimisation--i.e., trunk(shl(a, b)) = shl(trunk(a), b)--and the corresponding optimisation for extensions--i.e., shl(zext(a),b) = zext(shl(a,b)) (in the case of no overflow)--are implemented here and here, respectively. Note that, now, the two operands for the remaining G_SHL differ in type.

Finally, we proceed to legalisation, and we hit the following codepath:

llvm-project/llvm/lib/CodeGen/GlobalISel/LegalizerHelper.cpp

Lines 6688 to 6697 in 59ed6df

	case TargetOpcode::G_SHL:
	case TargetOpcode::G_ASHR:
	case TargetOpcode::G_LSHR: {
	Observer.changingInstr(MI);
	moreElementsVectorSrc(MI, MoreTy, 1);
	moreElementsVectorSrc(MI, MoreTy, 2);
	moreElementsVectorDst(MI, MoreTy, 0);
	Observer.changedInstr(MI);
	return Legalized;
	}

Specifically, we're trying to increase the number of lanes in the vectors to legalise the G_SHL instruction. At this point in the code, the target vector type has already been computed (MoreTy), but the 3rd operand to G_SHL differs in type from the other two operands (the element type is s32 not s8). As such, the second call to moreElementsVectorSrc notes a type mismatch and trips the assert.

There are a few obvious places we could tweak the logic to avoid this case:

1. Provide a different wide type for the second call to moreElementsVectorSrc; (Though, AFAIU, at least on ARM, this wouldn't be legal as the bitwidths of operands of a NEON shift have to agree...)
2. Adapt the pre-legaliser combiner to make sure that it adjusts the bitwidths of both of its operands when combining shifts and truncs/exts;
3. Simply reject this code with unable to legalise?

I'm expecting that 2. is the correct solution but wanted to make sure! Thanks in advance.