Debugging UNREACHABLE "Couldn't join subrange" in RegisterCoalescer (out-of-tree backend)

Hello,

I have a minimal testcase which crashes RegisterCoalescer in my out-of-tree target. It only crashes in Debug builds of llc---not in Release builds. Also, interesting to note that the x86 backend lowers this same testcase successfully. I did a quick search of bugs.llvm.org and found no matches.

This implies that the problem is in my backend and/or how my backend interacts with RegisterCoalescer. I'm not too familiar with RegisterCoalescer. Can anyone give me a hint on where I should start looking for the problem in my backend?

Thank you,
Nick Johnson
D. E. Shaw Research

Here's my minimal testcase:

$ llvm-dis -o - bugpoint.reduced.simplified.bc
; ModuleID = 'bugpoint.reduced.simplified.bc'
source_filename = "bugpoint-output-7eb0c3b.bc"
target datalayout = "e-m:e-p:32:32-i8:8:32-i16:16:32-i32:32:32-i64:64:64-v64:64:64-v128:128:128-n32-S128"
target triple = "desgcv3-unknown-elf"

; Function Attrs: noreturn nounwind
define void @wobble() local_unnamed_addr #0 {
  %1 = extractelement <4 x i32> <i32 0, i32 2, i32 3, i32 4>, i32 undef
  %2 = sub nsw i32 0, %1
  %3 = icmp sgt i32 %2, 0
  br i1 %3, label %4, label %5

; <label>:4: ; preds = %5, %0
  unreachable

; <label>:5: ; preds = %0
  %6 = extractelement <4 x i32> <i32 0, i32 2, i32 3, i32 4>, i32 undef
  %7 = sub nsw i32 0, %6
  %8 = icmp sgt i32 %7, 0
  br i1 %8, label %9, label %4

; <label>:9: ; preds = %5
  unreachable
}

attributes #0 = { noreturn nounwind "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "less-precise-fpmad"="false" "no-frame-pointer-elim"="true" "no-frame-pointer-elim-non-leaf" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-cpu"="generic" "unsafe-fp-math"="false" "use-soft-float"="false" }

Here's the tail-end of the log, with debugging turned on:

$llc bugpoint.reduced.simplified.bc -debug
...
208B %vreg13:sub_64_1<def> = COPY %vreg34:sub_64_1; VecRegs:%vreg13,%vreg34
        Considering merging to VecRegs with %vreg34 in %vreg13
                RHS = %vreg34 [160r,240r:0)[240r,384B:1)[400B,480r:1)[480r,496r:2)[496r,672r:3) 0@160r 1@240r 2@480r 3@496r L00000020 [240r,384B:1)[400B,672r:1) 0@x 1@240r L00000010 [160r,384B:1)[400B,672r:1) 0@x 1@160r L00000002 [480r,480d:1)[496r,672r:0) 0@496r 1@480r L00000001 [480r,672r:0) 0@480r
                LHS = %vreg13 [96r,112r:0)[112r,208r:1)[208r,288r:2) 0@96r 1@112r 2@208r L00000002 [96r,96d:1)[112r,288r:0) 0@112r 1@96r L00000030 [208r,288r:1) 0@x 1@208r L00000001 [96r,288r:0) 0@96r
                merge %vreg13:2@208r into %vreg34:0@160r --> @160r
                LHST = %vreg13 %vreg13 [96r,112r:0)[112r,208r:1)[208r,288r:2) 0@96r 1@112r 2@208r L00000002 [96r,96d:1)[112r,288r:0) 0@112r 1@96r L00000030 [208r,288r:1) 0@x 1@208r L00000001 [96r,288r:0) 0@96r
                Copy+Merge 00000030 into 00000020
                Reduce Lane to 00000010
                conflict at %vreg34:1@240r
*** Couldn't join subrange!

UNREACHABLE executed at /d/en/johnsoni-0/gctools/llvm/lib/CodeGen/RegisterCoalescer.cpp:2693!
#0 0x00000000027395af llvm::sys::PrintStackTrace(llvm::raw_ostream&) /d/en/johnsoni-0/gctools/llvm/lib/Support/Unix/Signals.inc:402:0
#1 0x0000000002739971 PrintStackTraceSignalHandler(void*) /d/en/johnsoni-0/gctools/llvm/lib/Support/Unix/Signals.inc:466:0
#2 0x0000000002737bce llvm::sys::RunSignalHandlers() /d/en/johnsoni-0/gctools/llvm/lib/Support/Signals.cpp:44:0
#3 0x0000000002738f41 SignalHandler(int) /d/en/johnsoni-0/gctools/llvm/lib/Support/Unix/Signals.inc:256:0
#4 0x000000396140f7e0 __restore_rt (/lib64/libpthread.so.0+0x396140f7e0)
#5 0x0000003960c325e5 __GI_raise (/lib64/libc.so.6+0x3960c325e5)
#6 0x0000003960c33dc5 __GI_abort (/lib64/libc.so.6+0x3960c33dc5)
#7 0x00000000026d4c42 bindingsErrorHandler(void*, std::string const&, bool) /d/en/johnsoni-0/gctools/llvm/lib/Support/ErrorHandling.cpp:127:0
#8 0x0000000001fdbc85 (anonymous namespace)::RegisterCoalescer::joinSubRegRanges(llvm::LiveRange&, llvm::LiveRange&, llvm::LaneBitmask, llvm::CoalescerPair const&) /d/en/johnsoni-0/gctools/llvm/lib/CodeGen/RegisterCoalescer.cpp:2695:0
#9 0x0000000001fdc3df (anonymous namespace)::RegisterCoalescer::mergeSubRangeInto(llvm::LiveInterval&, llvm::LiveRange const&, llvm::LaneBitmask, llvm::CoalescerPair&) /d/en/johnsoni-0/gctools/llvm/lib/CodeGen/RegisterCoalescer.cpp:2769:0
#10 0x0000000001fdcbd5 (anonymous namespace)::RegisterCoalescer::joinVirtRegs(llvm::CoalescerPair&) /d/en/johnsoni-0/gctools/llvm/lib/CodeGen/RegisterCoalescer.cpp:2832:0
#11 0x0000000001fdd174 (anonymous namespace)::RegisterCoalescer::joinIntervals(llvm::CoalescerPair&) /d/en/johnsoni-0/gctools/llvm/lib/CodeGen/RegisterCoalescer.cpp:2892:0
#12 0x0000000001fd5fc3 (anonymous namespace)::RegisterCoalescer::joinCopy(llvm::MachineInstr*, bool&) /d/en/johnsoni-0/gctools/llvm/lib/CodeGen/RegisterCoalescer.cpp:1468:0
#13 0x0000000001fdd4b6 (anonymous namespace)::RegisterCoalescer::copyCoalesceWorkList(llvm::MutableArrayRef<llvm::MachineInstr*>) /d/en/johnsoni-0/gctools/llvm/lib/CodeGen/RegisterCoalescer.cpp:2962:0
#14 0x0000000001fddf32 (anonymous namespace)::RegisterCoalescer::coalesceLocals() /d/en/johnsoni-0/gctools/llvm/lib/CodeGen/RegisterCoalescer.cpp:3087:0
#15 0x0000000001fde3a1 (anonymous namespace)::RegisterCoalescer::joinAllIntervals() /d/en/johnsoni-0/gctools/llvm/lib/CodeGen/RegisterCoalescer.cpp:3121:0
#16 0x0000000001fde6e2 (anonymous namespace)::RegisterCoalescer::runOnMachineFunction(llvm::MachineFunction&) /d/en/johnsoni-0/gctools/llvm/lib/CodeGen/RegisterCoalescer.cpp:3167:0
#17 0x0000000001d28d87 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) /d/en/johnsoni-0/gctools/llvm/lib/CodeGen/MachineFunctionPass.cpp:62:0
...

This looks like a bug related to the subregister liveness updating in the RegisterCoalescer.
As this is always hard to debug without having the actual target at hand:

  • Make sure the testcase (or rather all testcases) passes llc -verify-machineinstrs

  • It would be good to see the full llc -debug-only=regalloc dump (looking below I would at least see which slotindexes belong to which instructions). Best to file a PR with the information.

  • There is one open PR about coalescing subregister liveness right now: http://llvm.org/PR32688 (but it’s hard to say without investigation whether it is the same).

  • Matthias

Thank you Matthias,

$ llc bugpoint-reduced-simplified.bc -verify-machineinstrs -debug-only=regalloc -print-before-all 2>log

Result file ‘log’ is attached. None of the target-specific instructions (LI, VEXT, BLT, J) do anything weird with registers.

I saw PR32688, but it looks like a different assertion failing.

One thing that struck me as odd was that RegisterCoalescer::joinVirtRegs features this guard that looks very similar to the failed condition

// Some conflicts can only be resolved after all values have been mapped.

if (!LHSVals.resolveConflicts(RHSVals) || !RHSVals.resolveConflicts(LHSVals))

return false;

Compare that to the failed condition in RegisterCoalescer::joinSubRegRanges, which is structurally quite similar but operates on (I think) sub-ranges of those intervals previously tested.

if (!LHSVals.resolveConflicts(RHSVals) ||

!RHSVals.resolveConflicts(LHSVals)) {

// We already determined that it is legal to merge the intervals, so this

// should never fail.

llvm_unreachable("*** Couldn’t join subrange!\n");

}

Nick Johnson

D. E. Shaw Research

log (32.9 KB)

I filed this under http://llvm.org/PR32773

Nick Johnson

D. E. Shaw Research