[X86] LLVM crashes disassembling invalid segment register copy instruction

[rnk]

Reproducer:

echo '0xd5 0xc5 0x20 0xef' | llvm-mc --disassemble 
        .text
        movq    %llvm-mc: gen/llvm/lib/Target/X86/MCTargetDesc/X86GenAsmWriter.inc:62295: static const char *llvm::X86ATTInstPrinter::getRegisterName(MCRegister): Assertion `RegNo && RegNo < 388 && "Invalid register number!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: llvm-mc --disassemble
 #0 0x0000556cf7ca85b8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /usr/local/google/home/rnk/llvm-project/build/../llvm/lib/Support/Unix/Signals.inc:723:13
 #1 0x0000556cf7ca62ee llvm::sys::RunSignalHandlers() /usr/local/google/home/rnk/llvm-project/build/../llvm/lib/Support/Signals.cpp:106:18
 #2 0x0000556cf7ca8c4d SignalHandler(int) /usr/local/google/home/rnk/llvm-project/build/../llvm/lib/Support/Unix/Signals.inc:413:1
 #3 0x00007f29edc36510 (/lib/x86_64-linux-gnu/libc.so.6+0x3c510)
 #4 0x00007f29edc840fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x00007f29edc36472 raise ./signal/../sysdeps/posix/raise.c:27:6
 #6 0x00007f29edc204b2 abort ./stdlib/abort.c:81:7
 #7 0x00007f29edc203d5 _nl_load_domain ./intl/loadmsgcat.c:1177:9
 #8 0x00007f29edc2f3a2 (/lib/x86_64-linux-gnu/libc.so.6+0x353a2)
 #9 0x0000556cf82ced88 /usr/local/google/home/rnk/llvm-project/build/gen/llvm/lib/Target/X86/MCTargetDesc/X86GenAsmWriter.inc:62295:3
#10 0x0000556cf82cf0bb llvm::X86ATTInstPrinter::printRegName(llvm::raw_ostream&, llvm::MCRegister) const /usr/local/google/home/rnk/llvm-project/build/../llvm/lib/Target/X86/MCTargetDesc/X86ATTInstPrinter.cpp:39:42
#11 0x0000556cf82cd3f1 llvm::X86ATTInstPrinter::printInstruction(llvm::MCInst const*, unsigned long, llvm::raw_ostream&) /usr/local/google/home/rnk/llvm-project/build/gen/llvm/lib/Target/X86/MCTargetDesc/X86GenAsmWriter.inc:61563:17
#12 0x0000556cf82cf1fc llvm::X86ATTInstPrinter::printInst(llvm::MCInst const*, unsigned long, llvm::StringRef, llvm::MCSubtargetInfo const&, llvm::raw_ostream&) /usr/local/google/home/rnk/llvm-project/build/../llvm/lib/Target/X86/MCTargetDesc/X86ATTInstPrinter.cpp:0:5
#13 0x0000556cf7bcc005 llvm::MCTargetStreamer::prettyPrintAsm(llvm::MCInstPrinter&, unsigned long, llvm::MCInst const&, llvm::MCSubtargetInfo const&, llvm::raw_ostream&) /b/f/w/set_by_reclient/a/../llvm/lib/MC/MCStreamer.cpp:1073:1

This works if you replace 0xef with anything in the range 0xe7-0xef, but 0xe0-0xe7 disassembles as:

       movq    %gs, %r8 ; (up to %r15)

[llvmbot]

@llvm/issue-subscribers-backend-x86

Author: Reid Kleckner (rnk)

Reproducer: ``` echo '0xd5 0xc5 0x20 0xef' | llvm-mc --disassemble .text movq %llvm-mc: gen/llvm/lib/Target/X86/MCTargetDesc/X86GenAsmWriter.inc:62295: static const char *llvm::X86ATTInstPrinter::getRegisterName(MCRegister): Assertion `RegNo && RegNo < 388 && "Invalid register number!"' failed. PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace. Stack dump: 0. Program arguments: llvm-mc --disassemble #0 0x0000556cf7ca85b8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /usr/local/google/home/rnk/llvm-project/build/../llvm/lib/Support/Unix/Signals.inc:723:13 #1 0x0000556cf7ca62ee llvm::sys::RunSignalHandlers() /usr/local/google/home/rnk/llvm-project/build/../llvm/lib/Support/Signals.cpp:106:18 #2 0x0000556cf7ca8c4d SignalHandler(int) /usr/local/google/home/rnk/llvm-project/build/../llvm/lib/Support/Unix/Signals.inc:413:1 #3 0x00007f29edc36510 (/lib/x86_64-linux-gnu/libc.so.6+0x3c510) #4 0x00007f29edc840fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76 #5 0x00007f29edc36472 raise ./signal/../sysdeps/posix/raise.c:27:6 #6 0x00007f29edc204b2 abort ./stdlib/abort.c:81:7 #7 0x00007f29edc203d5 _nl_load_domain ./intl/loadmsgcat.c:1177:9 #8 0x00007f29edc2f3a2 (/lib/x86_64-linux-gnu/libc.so.6+0x353a2) #9 0x0000556cf82ced88 /usr/local/google/home/rnk/llvm-project/build/gen/llvm/lib/Target/X86/MCTargetDesc/X86GenAsmWriter.inc:62295:3 #10 0x0000556cf82cf0bb llvm::X86ATTInstPrinter::printRegName(llvm::raw_ostream&, llvm::MCRegister) const /usr/local/google/home/rnk/llvm-project/build/../llvm/lib/Target/X86/MCTargetDesc/X86ATTInstPrinter.cpp:39:42 #11 0x0000556cf82cd3f1 llvm::X86ATTInstPrinter::printInstruction(llvm::MCInst const*, unsigned long, llvm::raw_ostream&) /usr/local/google/home/rnk/llvm-project/build/gen/llvm/lib/Target/X86/MCTargetDesc/X86GenAsmWriter.inc:61563:17 #12 0x0000556cf82cf1fc llvm::X86ATTInstPrinter::printInst(llvm::MCInst const*, unsigned long, llvm::StringRef, llvm::MCSubtargetInfo const&, llvm::raw_ostream&) /usr/local/google/home/rnk/llvm-project/build/../llvm/lib/Target/X86/MCTargetDesc/X86ATTInstPrinter.cpp:0:5 #13 0x0000556cf7bcc005 llvm::MCTargetStreamer::prettyPrintAsm(llvm::MCInstPrinter&, unsigned long, llvm::MCInst const&, llvm::MCSubtargetInfo const&, llvm::raw_ostream&) /b/f/w/set_by_reclient/a/../llvm/lib/MC/MCStreamer.cpp:1073:1 ```

This works if you replace 0xef with anything in the range 0xe7-0xef, but 0xe0-0xe7 disassembles as:

       movq    %gs, %r8 ; (up to %r15)

[anematode]

The issue is that REX2 (strangely) allows you to encode segment and debug registers cr16–31, dr16–31. So you're essentially trying to encode movq %cr28, %r15. See page 22 of the specification:

The exception is that REX2.R4 and REX2.R3 are not ignored when the R register identifier addresses a control or debug register.

REX2.R3 is probably a typo and supposed to be REX2.X4. Anyway, it's probably best to just treat these as bad instructions. I will have a PR shortly.

[rnk]

Thanks!

REX2.R3 is probably a typo and supposed to be REX2.X4. Anyway, it's probably best to just treat these as bad instructions. I will have a PR shortly.

Sounds good. My assumption was that this is an invalid instruction, and the bug is that the decoder isn't signalling that correctly.