[Reg-alloc] Bad machine code: Live segment doesn't end at a valid instruction

[JonPsson]

Bugzilla Link	35574
Resolution	FIXED
Resolved on	Dec 14, 2019 15:33
Version	trunk
OS	Linux
Attachments	reduced testcase
CC	@hfinkel,@kparzysz-quic,@mikaelholmen,@JonPsson,@qcolombet,@uweigand

Extended Description

Machine verifier complains after coalescing. Small reduced program attached.

bin/llc -mtriple=s390x-linux-gnu -mcpu=z13 tc_liveseg.ll -disable-machine-dce -verify-machineinstrs

After Simple Register Coalescing

********** INTERVALS **********
%0 [336r,336d:0) 0@336r
%1 [192r,240d:0) 0@192r
%3 [96r,128r:0) 0@96r
%5 [128r,192r:0) 0@128r
%13 [16r,32r:0) 0@16r
RegMasks:
********** MACHINEINSTRS **********

Machine code for function main: NoPHIs, TracksLiveness

0B %bb.0: derived from LLVM BB %0
16B %13:grx32bit = LHIMux 0; GRX32Bit:%13
32B CHIMux %13, 0, implicit-def %cc; GRX32Bit:%13
48B BRC 14, 6, %bb.2, implicit killed %cc
64B J %bb.1
Successors according to CFG: %bb.1(0x00000001 / 0x80000000 = 0.00%) %bb.2(0x7fffffff / 0x80000000 = 100.00%)

80B %bb.1: derived from LLVM BB %3
Predecessors according to CFG: %bb.0
96B %3:addr64bit = LARL ga:@g_979; ADDR64Bit:%3
128B %5:gr64bit = LG %3, 3, %noreg; mem:LD8bitcast (i8* getelementptr inbounds ({ i8, i8, i8, { i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8 } }, { i8, i8, i8, { i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8 } }* @​g_979, i64 0, i32 3, i32 0) to i136*)(dereferenceable) GR64Bit:%5 ADDR64Bit:%3
192B %1:gr64bit = SRLG %5, %noreg, 24; GR64Bit:%1,%5
336B dead %0:gr64bit = LGHI 0; GR64Bit:%0

352B %bb.2: derived from LLVM BB %4
Predecessors according to CFG: %bb.0
368B Return

End machine code for function main.

*** Bad machine code: Live segment doesn't end at a valid instruction ***

• function: main
• basic block: %bb.1 (0x2aa564e5ea8) [80B;352B)
• liverange: [192r,240d:0) 0@192r
• v. register: %1
• segment: [192r,240d:0)
  LLVM ERROR: Found 1 machine code errors.

[mikaelholmen]

This might be totally unrelated, but I ran into something similar 1.5 years ago after the
change "Recommit r265547, and r265610,r265639,r265657".

When I debugged the problem then I saw printouts like:

---

%vreg29 [880r,896r:0) 0@880r
[...]
880B %vreg29 = COPY %a0h
896B %vreg10 = mv_ar16_ar16_lo16In32 %vreg29
[...]
Deleting dead def 896r %vreg81<def,dead> = mv_ar16_ar16_lo16In32 %vreg29
[...]
Shrink: %vreg29 [880r,896r:0) 0@880r
Shrunk: %vreg29 [880r,896r:0) 0@880r
[...]

And then the verifier says:

*** Bad machine code: Live segment doesn't end at a valid instruction ***

• function: f3
• basic block: BB#4 bb3 (0x42e13d8) [816B;976B)
• liverange: [880r,896r:0) 0@880r
• register: %vreg29
• segment: [880r,896r:0)
  LLVM ERROR: Found 1 machine code errors.

---

Notice the "Shrunk" printout above. The new range is the same as the old one!

After some discussion with Wei Mi I solved that problem locally for our target by doing:

// Somewhat brute solution to #​10204. Always shrink live ranges for
virtual
// registers. Ideally we could identify the exact cases where it's needed
// but for now we shrink the range for all vregs.
if (ShrinkMainRange ||
TargetRegisterInfo::isVirtualRegister(CP.getDstReg())) {
LiveInterval &LI = LIS->getInterval(CP.getDstReg());
shrinkToUses(&LI);
}

instead of

if (ShrinkMainRange) {
LiveInterval &LI = LIS->getInterval(CP.getDstReg());
shrinkToUses(&LI);
}

in RegisterCoalescer::joinCopy().

Again, I have no idea if this is the issue you're seeing now but I thought I'd share
this in case it is.

[JonPsson]

Thank you, Mikael. It does however not seem to be the same problem:

192B %8:gr64bit = SRLG %5, %noreg, 24; GR64Bit:%8,%5
208B %9:grx32bit = COPY %8.subreg_l32; GRX32Bit:%9 GR64Bit:%8
224B %1:gr64bit = COPY %8; GR64Bit:%1,%8
240B dead %1.subreg_l32:gr64bit = COPY %9; GR64Bit:%1 GRX32Bit:%9

->

224B %1:gr64bit = COPY %8; GR64Bit:%1,%8
Considering merging to GR64Bit with %8 in %1
RHS = %8 [192r,240r:0) 0@192r
LHS = %1 [224r,240r:0)[240r,240d:1) 0@224r 1@240r
merge %1:0@224r into %8:0@192r --> @​192r
merge %1:1@240r into %8:0@192r --> @​192r
erased: 224r %1:gr64bit = COPY %8; GR64Bit:%1,%8
erased: 240r dead %1.subreg_l32:gr64bit = COPY %8.subreg_l32; GR64Bit:%1,%8
updated: 192B %1:gr64bit = SRLG %5, %noreg, 24; GR64Bit:%1,%5
Success: %8 -> %1
Result = %1 [192r,240d:0) 0@192r

The 240r dead COPY is erased, but the resulting live range includes it, which seems strange.

Anyone knows what could be going wrong?

[JonPsson]

*** Bug llvm/llvm-bugzilla-archive#36425 has been marked as a duplicate of this bug. ***

[JonPsson]

reduced mir testcase
Found another test case for this which I reduced to .mir this time (the original .ll test still fails for me, though)

This was unfortunately not helped by Krzysztofs recent fixes for subregliveness...

llc -mcpu=z13 ./tc_simpleregcoal.mir -verify-machineinstrs -start-before=simple-register-coalescing -o -

[JonPsson]

reduced testcase
ping! New test case in case the old ones do not trigger any more...

llc ./tc_liveseg.mir -mtriple=s390x-linux-gnu -mcpu=z13 -o - -verify-machineinstrs -systemz-subreg-liveness -misched=shuffle -start-before=simple-register-coalescing

*** Bad machine code: Live segment doesn't end at a valid instruction ***

• function: main
• basic block: %bb.1 bb4 (0x2aa510a7018) [112B;400B)
• liverange: [124r,256r:1) 0@x 1@124r

[JonPsson]

This seems to as well have been handled by 2ec71ea, so closing this.

See llvm/llvm-bugzilla-archive#41372 .

[JonPsson]

reduced testcase
This test case fails with this assert, when run with:

llc -mcpu=z13 -O3 -o out.s -systemz-subreg-liveness ./tc_livesegend.ll -verify-misched -disable-lsr

It may be worth noting that this is a reduced csmith random test case which was compiled originally with clang including the options -jump-threading-across-loop-headers and -enable-simple-loop-unswitch, both of which seem to have problems currently.

[JonPsson]

mentioned in issue llvm/llvm-bugzilla-archive#36425

[JonPsson]

mentioned in issue llvm/llvm-bugzilla-archive#41372