[DebugInfo][InstrRef] Add a max-stack-slots-to-track limitation / cut-out

[jmorse]

Summary

Over in D116821, there's a reproducer that stimulates an interesting scenario in InstrRefBasedLDV: with thousands of local variables and asan enabled, the max working set (i.e. maximum number of values live at the same time) is very large, and get forced onto the stack. InstrRefBasedLDV tries to track all those variable locations, allocates some massive tables of values, and can then run out of memory (think ~6k values across 15k blocks -> massive allocations). This is undesirable.

I believe this kind of input is rare, because it's very unlikely that a developer is able to reason about thousands of live, named variables, concurrently while writing their software. Much more likely is that the input is autogenerated, or affected by some kind of instrumentation. In that scenario we should fail gracefully, by ceasing to track stack slots past a certain number: which is what this patch does. That puts an upper bound on the maximum working set that we try to track, and avoids un-necessarily crashing. The downside is that we might un-necessarily drop some variable locations, but the developer is probably happy with something rather than nothing.

This can certainly be improved so that the quality of data tracked degrades gracefully, however this is a starting point that avoids excessive consumption.

In terms of the patch, this adds a cl::opt for max number of stack slots to track, and has the stack-slot-numbering code optionally return None. That then filters through a number of code paths, which can then chose to not track a spill / restore if it touches an untracked spill slot. The added test checks that we drop variable locations that are on the stack, if we set the limit to zero.

[jmorse]

Fix an off-by-one (The limit should be hit when the number of seen locations is >= the limit, otherwise setting a limit of 0 will never work). Add the inverse test to the MIR file added, to check that stack locations would actually be found if the limit wasn't on.

[Orlando]

llvm/lib/CodeGen/LiveDebugValues/InstrRefBasedImpl.cpp

166

nit: developers -> developer's

170

I don't know what constitutes a reasonable cut-off for this. What made you choose 250?

llvm/test/DebugInfo/MIR/InstrRef/spill-slot-limits.mir

26–27

I'm confused - why don't we see this initial non-spill location for the -livedebugvalues-max-stack-slots=0 case (in regular CHECK directives above)?

[jmorse]

llvm/test/DebugInfo/MIR/InstrRef/spill-slot-limits.mir

26–27

The test spills to the stack and restores to $esi -- if we don't track it through the stack, there'll be no location. I suppose a clearer test would test each stage.

[jmorse]

llvm/lib/CodeGen/LiveDebugValues/InstrRefBasedImpl.cpp

170

It's an educated guess -- I've been building some large C++ codebases with different limits (and with a compiler that aborts when it hits the limit) to try and find out what's reasonable. So far I've reached a limit of 30 without any "normal" builds failing. Still waiting for LTO builds to complete, which is the much more interesting case.

[Orlando]

LGTM

llvm/test/DebugInfo/MIR/InstrRef/spill-slot-limits.mir

26–27

Oops what I really meant was "why don't we see a $eax location" and, now I look again, I can answer the myself: $eax is clobbered before we get to the debug instruction (and, as per the point of this patch, we don't follow the value into the stack). Sorry for the noise!

[kda]

This may be breaking PPC sanitizer buildbot: https://lab.llvm.org/buildbot/#/builders/105/builds/20857/steps/7/logs/FAIL__LLVM__spill-slot-limits_mir

[nemanjai]

In D118601#3289012, @kda wrote:

This may be breaking PPC sanitizer buildbot: https://lab.llvm.org/buildbot/#/builders/105/builds/20857/steps/7/logs/FAIL__LLVM__spill-slot-limits_mir

It is not just the PPC bots. This is breaking multiple bots (presumably due to missing triple). A non-PPC example: https://lab.llvm.org/buildbot/#/builders/179/builds/2845

[nemanjai]

FWIW, @kda beat me to it with his revert, but I was just about to commit a fix that simply adds -march=x86-64 to the llc invocations in the test case (just as the original test case that the new one is based on).

Thanks for reverting it to bring the bots back to green Kevin.

[jmorse]

/me blinks

Yup, missing triple there, sorry for the noise :( and thanks for the recovery.

llvm/lib/CodeGen/LiveDebugValues/InstrRefBasedImpl.h

public:
   }
 
   /// Record a RegMask operand being executed. Defs any register we currently
   /// track, stores a pointer to the mask in case we have to account for it
   /// later.
   void writeRegMask(const MachineOperand *MO, unsigned CurBB, unsigned InstID);
 
   /// Find LocIdx for SpillLoc \p L, creating a new one if it's not tracked.
-  SpillLocationNo getOrTrackSpillLoc(SpillLoc L);
+  /// Returns None when in scenarios where a spill slot could be tracked, but
+  /// we would likely run into resource limitations.
+  Optional<SpillLocationNo> getOrTrackSpillLoc(SpillLoc L);
 
   // Get LocIdx of a spill ID.
   LocIdx getSpillMLoc(unsigned SpillID) {
     assert(LocIDToLocIdx[SpillID] != UINT_MAX); // Sentinal for IndexedMap.
     return LocIDToLocIdx[SpillID];
   }
 
   /// Return true if Idx is a spill machine location.
private:
   bool AdjustsStackInCalls = false;
 
   /// If AdjustsStackInCalls is true, this holds the name of the target's stack
   /// probe function, which is the function we expect will alter the stack
   /// pointer.
   StringRef StackProbeSymbolName;
 
   /// Tests whether this instruction is a spill to a stack slot.
-  bool isSpillInstruction(const MachineInstr &MI, MachineFunction *MF);
+  Optional<SpillLocationNo> isSpillInstruction(const MachineInstr &MI,
+                                               MachineFunction *MF);
 
   /// Decide if @MI is a spill instruction and return true if it is. We use 2
   /// criteria to make this decision:
   /// - Is this instruction a store to a spill slot?
   /// - Is there a register operand that is both used and killed?
   /// TODO: Store optimization can fold spills into other stores (including
   /// other spills). We do not handle this yet (more than one memory operand).
   bool isLocationSpill(const MachineInstr &MI, MachineFunction *MF,
                        unsigned &Reg);
 
   /// If a given instruction is identified as a spill, return the spill slot
   /// and set \p Reg to the spilled register.
   Optional<SpillLocationNo> isRestoreInstruction(const MachineInstr &MI,
                                           MachineFunction *MF, unsigned &Reg);
 
   /// Given a spill instruction, extract the spill slot information, ensure it's
   /// tracked, and return the spill number.
-  SpillLocationNo extractSpillBaseRegAndOffset(const MachineInstr &MI);
+  Optional<SpillLocationNo>
+  extractSpillBaseRegAndOffset(const MachineInstr &MI);
 
   /// Observe a single instruction while stepping through a block.
   void process(MachineInstr &MI, ValueIDNum **MLiveOuts = nullptr,
                ValueIDNum **MLiveIns = nullptr);
 
   /// Examines whether \p MI is a DBG_VALUE and notifies trackers.
   /// \returns true if MI was recognized and processed.
   bool transferDebugValue(const MachineInstr &MI);

llvm/lib/CodeGen/LiveDebugValues/InstrRefBasedImpl.cpp

 
 // Enable the use of depth-first exploration of lexical scopes when solving
 // variable locations. Reduces peak memory usage, improves locality.
 static cl::opt<bool> DepthFirstSearch(
     "livedebugvalues-depth-explore", cl::Hidden,
     cl::desc("Depth first search when solving variable locs"),
     cl::init(true));
 
+// Limit for the maximum number of stack slots we should track, past which we
+// will ignore any spills. InstrRefBasedLDV gathers detailed information on all
+// stack slots which leads to high memory consumption, and in some scenarios
+// (such as asan with very many locals) the working set of the function can be
+// very large, causing many spills. In these scenarios, it is very unlikely that
+// the developer has hundreds of variables live at the same time that they're
+// carefully thinking about -- instead, they probably autogenerated the code.
+// When this happens, gracefully stop tracking excess spill slots, rather than
+// consuming all the developers memory.
+static cl::opt<unsigned>
+    StackWorkingSetLimit("livedebugvalues-max-stack-slots", cl::Hidden,
+                         cl::desc("livedebugvalues-stack-ws-limit"),
+                         cl::init(250));
+
 /// Tracker for converting machine value locations and variable values into
 /// variable locations (the output of LiveDebugValues), recorded as DBG_VALUEs
 /// specifying block live-in locations and transfers within blocks.
 ///
 /// Operating on a per-block basis, this class takes a (pre-loaded) MLocTracker
 /// and must be initialized with the set of variable values that are live-in to
 /// the block. The caller then repeatedly calls process(). TransferTracker picks
 /// out variable locations for the live-in variable values (if there _is_ a
for (auto Location : locations()) {
     unsigned ID = LocIdxToLocID[Location.Idx];
     // Don't clobber SP, even if the mask says it's clobbered.
     if (ID < NumRegs && !SPAliases.count(ID) && MO->clobbersPhysReg(ID))
       defReg(ID, CurBB, InstID);
   }
   Masks.push_back(std::make_pair(MO, InstID));
 }
 
-SpillLocationNo MLocTracker::getOrTrackSpillLoc(SpillLoc L) {
+Optional<SpillLocationNo> MLocTracker::getOrTrackSpillLoc(SpillLoc L) {
   SpillLocationNo SpillID(SpillLocs.idFor(L));
+
   if (SpillID.id() == 0) {
+    // If there is no location, and we have reached the limit of how many stack
+    // slots to track, then don't track this one.
+    if (SpillLocs.size() >= StackWorkingSetLimit)
+      return None;
+
     // Spill location is untracked: create record for this one, and all
     // subregister slots too.
     SpillID = SpillLocationNo(SpillLocs.insert(L));
     for (unsigned StackIdx = 0; StackIdx < NumSlotIdxes; ++StackIdx) {
       unsigned L = getSpillIDWithIdx(SpillID, StackIdx);
       LocIdx Idx = LocIdx(LocIdxToIDNum.size()); // New idx
       LocIdxToIDNum.grow(Idx);
       LocIdxToLocID.grow(Idx);

 //            Debug Range Extension Implementation
 //===----------------------------------------------------------------------===//
 
 #ifndef NDEBUG
 // Something to restore in the future.
 // void InstrRefBasedLDV::printVarLocInMBB(..)
 #endif
 
-SpillLocationNo
+Optional<SpillLocationNo>
 InstrRefBasedLDV::extractSpillBaseRegAndOffset(const MachineInstr &MI) {
   assert(MI.hasOneMemOperand() &&
          "Spill instruction does not have exactly one memory operand?");
   auto MMOI = MI.memoperands_begin();
   const PseudoSourceValue *PVal = (*MMOI)->getPseudoValue();
   assert(PVal->kind() == PseudoSourceValue::FixedStack &&
          "Inconsistent memory operand in spill instruction");
   int FI = cast<FixedStackPseudoSourceValue>(PVal)->getFrameIndex();
   const MachineBasicBlock *MBB = MI.getParent();
   Register Reg;
   StackOffset Offset = TFI->getFrameIndexReference(*MBB->getParent(), FI, Reg);
   return MTracker->getOrTrackSpillLoc({Reg, Offset});
 }
 
-Optional<LocIdx> InstrRefBasedLDV::findLocationForMemOperand(const MachineInstr &MI) {
-  SpillLocationNo SpillLoc =  extractSpillBaseRegAndOffset(MI);
+Optional<LocIdx>
+InstrRefBasedLDV::findLocationForMemOperand(const MachineInstr &MI) {
+  Optional<SpillLocationNo> SpillLoc = extractSpillBaseRegAndOffset(MI);
+  if (!SpillLoc)
+    return None;
 
   // Where in the stack slot is this value defined -- i.e., what size of value
   // is this? An important question, because it could be loaded into a register
   // from the stack at some point. Happily the memory operand will tell us
   // the size written to the stack.
   auto *MemOperand = *MI.memoperands_begin();
   unsigned SizeInBits = MemOperand->getSizeInBits();
 
   // Find that position in the stack indexes we're tracking.
   auto IdxIt = MTracker->StackSlotIdxes.find({SizeInBits, 0});
   if (IdxIt == MTracker->StackSlotIdxes.end())
     // That index is not tracked. This is suprising, and unlikely to ever
     // occur, but the safe action is to indicate the variable is optimised out.
     return None;
 
-  unsigned SpillID = MTracker->getSpillIDWithIdx(SpillLoc, IdxIt->second);
+  unsigned SpillID = MTracker->getSpillIDWithIdx(*SpillLoc, IdxIt->second);
   return MTracker->getSpillMLoc(SpillID);
 }
 
 /// End all previous ranges related to @MI and start a new range from @MI
 /// if it is a DBG_VALUE instr.
 bool InstrRefBasedLDV::transferDebugValue(const MachineInstr &MI) {
   if (!MI.isDebugValue())
     return false;
if (MO.isReg()) {
     // FIXME: stack slot colouring should account for slots that get merged.
     if (MFI->isDeadObjectIndex(FI))
       return true;
 
     // Identify this spill slot, ensure it's tracked.
     Register Base;
     StackOffset Offs = TFI->getFrameIndexReference(*MI.getMF(), FI, Base);
     SpillLoc SL = {Base, Offs};
-    SpillLocationNo SpillNo = MTracker->getOrTrackSpillLoc(SL);
+    Optional<SpillLocationNo> SpillNo = MTracker->getOrTrackSpillLoc(SL);
+
+    // We might be able to find a value, but have chosen not to, to avoid
+    // tracking too much stack information.
+    if (!SpillNo)
+      return true;
 
     // Problem: what value should we extract from the stack? LLVM does not
     // record what size the last store to the slot was, and it would become
     // sketchy after stack slot colouring anyway. Take a look at what values
     // are stored on the stack, and pick the largest one that wasn't def'd
     // by a spill (i.e., the value most likely to have been def'd in a register
     // and then spilt.
     std::array<unsigned, 4> CandidateSizes = {64, 32, 16, 8};
     Optional<ValueIDNum> Result = None;
     Optional<LocIdx> SpillLoc = None;
     for (unsigned CS : CandidateSizes) {
-      unsigned SpillID = MTracker->getLocID(SpillNo, {CS, 0});
+      unsigned SpillID = MTracker->getLocID(*SpillNo, {CS, 0});
       SpillLoc = MTracker->getSpillMLoc(SpillID);
       ValueIDNum Val = MTracker->readMLoc(*SpillLoc);
       // If this value was defined in it's own position, then it was probably
       // an aliasing index of a small value that was spilt.
       if (Val.getLoc() != SpillLoc->asU64()) {
         Result = Val;
         break;
       }
     }
 
     // If we didn't find anything, we're probably looking at a PHI, or a memory
     // store folded into an instruction. FIXME: Take a guess that's it's 64
     // bits. This isn't ideal, but tracking the size that the spill is
     // "supposed" to be is more complex, and benefits a small number of
     // locations.
     if (!Result) {
-      unsigned SpillID = MTracker->getLocID(SpillNo, {64, 0});
+      unsigned SpillID = MTracker->getLocID(*SpillNo, {64, 0});
       SpillLoc = MTracker->getSpillMLoc(SpillID);
       Result = MTracker->readMLoc(*SpillLoc);
     }
 
     // Record this DBG_PHI for later analysis.
     auto DbgPHI = DebugPHIRecord({InstrNum, MI.getParent(), *Result, *SpillLoc});
     DebugPHINumToValue.push_back(DbgPHI);
   }
void InstrRefBasedLDV::transferRegisterDef(MachineInstr &MI) {
   for (uint32_t DeadReg : DeadRegs)
     MTracker->defReg(DeadReg, CurBB, CurInst);
 
   for (auto *MO : RegMaskPtrs)
     MTracker->writeRegMask(MO, CurBB, CurInst);
 
   // If this instruction writes to a spill slot, def that slot.
   if (hasFoldedStackStore(MI)) {
-    SpillLocationNo SpillNo = extractSpillBaseRegAndOffset(MI);
+    if (Optional<SpillLocationNo> SpillNo = extractSpillBaseRegAndOffset(MI)) {
       for (unsigned int I = 0; I < MTracker->NumSlotIdxes; ++I) {
-      unsigned SpillID = MTracker->getSpillIDWithIdx(SpillNo, I);
+        unsigned SpillID = MTracker->getSpillIDWithIdx(*SpillNo, I);
         LocIdx L = MTracker->getSpillMLoc(SpillID);
         MTracker->setMLoc(L, ValueIDNum(CurBB, CurInst, L));
       }
     }
+  }
 
   if (!TTracker)
     return;
 
   // When committing variable values to locations: tell transfer tracker that
   // we've clobbered things. It may be able to recover the variable from a
   // different location.
 
for (auto L : MTracker->locations()) {
 
     for (auto *MO : RegMaskPtrs)
       if (MO->clobbersPhysReg(Reg))
         TTracker->clobberMloc(L.Idx, MI.getIterator(), false);
   }
 
   // Tell TTracker about any folded stack store.
   if (hasFoldedStackStore(MI)) {
-    SpillLocationNo SpillNo = extractSpillBaseRegAndOffset(MI);
+    if (Optional<SpillLocationNo> SpillNo = extractSpillBaseRegAndOffset(MI)) {
       for (unsigned int I = 0; I < MTracker->NumSlotIdxes; ++I) {
-      unsigned SpillID = MTracker->getSpillIDWithIdx(SpillNo, I);
+        unsigned SpillID = MTracker->getSpillIDWithIdx(*SpillNo, I);
         LocIdx L = MTracker->getSpillMLoc(SpillID);
         TTracker->clobberMloc(L, MI.getIterator(), true);
       }
     }
   }
+}
 
 void InstrRefBasedLDV::performCopy(Register SrcRegNum, Register DstRegNum) {
   // In all circumstances, re-def all aliases. It's definitely a new value now.
   for (MCRegAliasIterator RAI(DstRegNum, TRI, true); RAI.isValid(); ++RAI)
     MTracker->defReg(*RAI, CurBB, CurInst);
 
   ValueIDNum SrcValue = MTracker->readReg(SrcRegNum);
   MTracker->setReg(DstRegNum, SrcValue);
for (MCSubRegIndexIterator SRI(SrcRegNum, TRI); SRI.isValid(); ++SRI) {
     (void)SrcL;
     (void)DstL;
     ValueIDNum CpyValue = MTracker->readReg(SrcSubReg);
 
     MTracker->setReg(DstSubReg, CpyValue);
   }
 }
 
-bool InstrRefBasedLDV::isSpillInstruction(const MachineInstr &MI,
-                                          MachineFunction *MF) {
+Optional<SpillLocationNo>
+InstrRefBasedLDV::isSpillInstruction(const MachineInstr &MI,
   // TODO: Handle multiple stores folded into one.
   if (!MI.hasOneMemOperand())
-    return false;
+    return None;
 
   // Reject any memory operand that's aliased -- we can't guarantee its value.
   auto MMOI = MI.memoperands_begin();
   const PseudoSourceValue *PVal = (*MMOI)->getPseudoValue();
   if (PVal->isAliased(MFI))
-    return false;
+    return None;
 
   if (!MI.getSpillSize(TII) && !MI.getFoldedSpillSize(TII))
-    return false; // This is not a spill instruction, since no valid size was
-                  // returned from either function.
+    return None; // This is not a spill instruction, since no valid size was
 
-  return true;
+  return extractSpillBaseRegAndOffset(MI);
 }
 
 bool InstrRefBasedLDV::isLocationSpill(const MachineInstr &MI,
                                        MachineFunction *MF, unsigned &Reg) {
   if (!isSpillInstruction(MI, MF))
     return false;
 
   int FI;
bool InstrRefBasedLDV::transferSpillOrRestoreInst(MachineInstr &MI) {
   int FIDummy;
   if (!TII->isStoreToStackSlotPostFE(MI, FIDummy) &&
       !TII->isLoadFromStackSlotPostFE(MI, FIDummy))
     return false;
 
   // First, if there are any DBG_VALUEs pointing at a spill slot that is
   // written to, terminate that variable location. The value in memory
   // will have changed. DbgEntityHistoryCalculator doesn't try to detect this.
-  if (isSpillInstruction(MI, MF)) {
-    SpillLocationNo Loc = extractSpillBaseRegAndOffset(MI);
-
+  if (Optional<SpillLocationNo> Loc = isSpillInstruction(MI, MF)) {
     // Un-set this location and clobber, so that earlier locations don't
     // continue past this store.
     for (unsigned SlotIdx = 0; SlotIdx < MTracker->NumSlotIdxes; ++SlotIdx) {
-      unsigned SpillID = MTracker->getSpillIDWithIdx(Loc, SlotIdx);
+      unsigned SpillID = MTracker->getSpillIDWithIdx(*Loc, SlotIdx);
       Optional<LocIdx> MLoc = MTracker->getSpillMLoc(SpillID);
       if (!MLoc)
         continue;
 
       // We need to over-write the stack slot with something (here, a def at
       // this instruction) to ensure no values are preserved in this stack slot
       // after the spill. It also prevents TTracker from trying to recover the
       // location and re-installing it in the same place.
       ValueIDNum Def(CurBB, CurInst, *MLoc);
       MTracker->setMLoc(*MLoc, Def);
       if (TTracker)
         TTracker->clobberMloc(*MLoc, MI.getIterator());
     }
   }
 
   // Try to recognise spill and restore instructions that may transfer a value.
   if (isLocationSpill(MI, MF, Reg)) {
-    SpillLocationNo Loc = extractSpillBaseRegAndOffset(MI);
+    // isLocationSpill returning true should guarantee we can extract a
+    // location.
+    SpillLocationNo Loc = *extractSpillBaseRegAndOffset(MI);
 
     auto DoTransfer = [&](Register SrcReg, unsigned SpillID) {
       auto ReadValue = MTracker->readReg(SrcReg);
       LocIdx DstLoc = MTracker->getSpillMLoc(SpillID);
       MTracker->setMLoc(DstLoc, ReadValue);
 
       if (TTracker) {
         LocIdx SrcLoc = MTracker->getRegMLoc(SrcReg);
for (MCSubRegIterator SRI(Reg, TRI, false); SRI.isValid(); ++SRI) {
       DoTransfer(*SRI, SpillID);
     }
 
     // Directly lookup size of main source reg, and transfer.
     unsigned Size = TRI->getRegSizeInBits(Reg, *MRI);
     unsigned SpillID = MTracker->getLocID(Loc, {Size, 0});
     DoTransfer(Reg, SpillID);
   } else {
-    Optional<SpillLocationNo> OptLoc = isRestoreInstruction(MI, MF, Reg);
-    if (!OptLoc)
+    Optional<SpillLocationNo> Loc = isRestoreInstruction(MI, MF, Reg);
+    if (!Loc)
       return false;
-    SpillLocationNo Loc = *OptLoc;
 
     // Assumption: we're reading from the base of the stack slot, not some
     // offset into it. It seems very unlikely LLVM would ever generate
     // restores where this wasn't true. This then becomes a question of what
     // subregisters in the destination register line up with positions in the
     // stack slot.
 
     // Def all registers that alias the destination.
auto DoTransfer = [&](Register DestReg, unsigned SpillID) {
       if (TTracker) {
         LocIdx DstLoc = MTracker->getRegMLoc(DestReg);
         TTracker->transferMlocs(SrcIdx, DstLoc, MI.getIterator());
       }
     };
 
     for (MCSubRegIterator SRI(Reg, TRI, false); SRI.isValid(); ++SRI) {
       unsigned Subreg = TRI->getSubRegIndex(Reg, *SRI);
-      unsigned SpillID = MTracker->getLocID(Loc, Subreg);
+      unsigned SpillID = MTracker->getLocID(*Loc, Subreg);
       DoTransfer(*SRI, SpillID);
     }
 
     // Directly look up this registers slot idx by size, and transfer.
     unsigned Size = TRI->getRegSizeInBits(Reg, *MRI);
-    unsigned SpillID = MTracker->getLocID(Loc, {Size, 0});
+    unsigned SpillID = MTracker->getLocID(*Loc, {Size, 0});
     DoTransfer(Reg, SpillID);
   }
   return true;
 }
 
 bool InstrRefBasedLDV::transferRegisterCopy(MachineInstr &MI) {
   auto DestSrc = TII->isCopyInstr(MI);
   if (!DestSrc)

llvm/test/DebugInfo/MIR/InstrRef/spill-slot-limits.mir

+# RUN: llc %s -o - -experimental-debug-variable-locations \
+# RUN:     -run-pass=livedebugvalues -livedebugvalues-max-stack-slots=0  | \
+# RUN: FileCheck %s --implicit-check-not=DBG_VALUE
+# RUN: llc %s -o - -experimental-debug-variable-locations \
+# RUN:     -run-pass=livedebugvalues -livedebugvalues-max-stack-slots=100  | \
+# RUN: FileCheck %s --check-prefixes=NOLIMIT --implicit-check-not=DBG_VALUE
+#
+# Test that spills of live values to the stack are NOT tracked by
+# LiveDebugValues if an internal accounting limit is exceeded -- in this test,
+# set to zero. This is to avoid scenarios where we track thousands of stack
+# slots, which can show up with autogenerated code and/or asan.
+#
+# This is a copy of livedebugvalues_stackslot_subregs.mir, here the stack slot
+#  limit is set to zero, meaning the spill shouldn't be tracked.
+#
+## Capture variable num,
+# CHECK: ![[VARNUM:[0-9]+]] = !DILocalVariable
+#
+## There should be no variable location, just a single DBG_VALUE $noreg.
+# CHECK:     DBG_VALUE $noreg
+#
+## And then another.
+# CHECK:     DBG_VALUE $noreg
+#
+## Test that if there's no limit, we _do_ get some locations.
+# NOLIMIT:      DBG_INSTR_REF 1, 0
+# NOLIMIT-NEXT: DBG_VALUE $esi
+#
+# NOLIMIT:      DBG_INSTR_REF 5,
+# NOLIMIT-NEXT: DBG_VALUE $rsp
+--- |
+  define i8 @test(i32 %bar) local_unnamed_addr !dbg !7 {
+  entry:
+    ret i8 0, !dbg !12
+  }
+
+  declare dso_local void @ext(i64)
+
+  !llvm.dbg.cu = !{!0}
+  !llvm.module.flags = !{!3, !4, !5, !6}
+  !0 = distinct !DICompileUnit(language: DW_LANG_C_plus_plus, file: !1, producer: "", isOptimized: true, runtimeVersion: 0, emissionKind: FullDebug)
+  !1 = !DIFile(filename: "foo.cpp", directory: ".")
+  !2 = !DIBasicType(name: "int", size: 8, encoding: DW_ATE_signed)
+  !3 = !{i32 2, !"Dwarf Version", i32 4}
+  !4 = !{i32 2, !"Debug Info Version", i32 3}
+  !5 = !{i32 1, !"wchar_size", i32 2}
+  !6 = !{i32 7, !"PIC Level", i32 2}
+  !7 = distinct !DISubprogram(name: "foo", linkageName: "foo", scope: !1, file: !1, line: 6, type: !8, scopeLine: 6, flags: DIFlagPrototyped, spFlags: DISPFlagDefinition | DISPFlagOptimized, unit: !0, retainedNodes: !10)
+  !8 = !DISubroutineType(types: !9)
+  !9 = !{!2, !2}
+  !10 = !{!11}
+  !11 = !DILocalVariable(name: "baz", scope: !7, file: !1, line: 7, type: !2)
+  !12 = !DILocation(line: 10, scope: !7)
+...
+---
+name: test
+tracksRegLiveness: true
+liveins:
+  - { reg: '$rdi', virtual-reg: '' }
+stack:
+  - { id: 0, name: '', type: spill-slot, offset: -16, size: 8, alignment: 8,
+      stack-id: default, callee-saved-register: '', callee-saved-restored: true,
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+body:  |
+  bb.0:
+  liveins: $rdi, $rax, $rbx
+    $eax = MOV32ri 0, debug-instr-number 1
+    $edi = COPY $eax
+    MOV64mr $rsp, 1, $noreg, 16, $noreg, $rdi :: (store 8 into %stack.0)
+    $rsi = MOV64rm $rsp, 1, $noreg, 8, $noreg :: (load 8 from %stack.0)
+
+    MOV64mr $rsp, 1, $noreg, 16, $noreg, $rbx :: (store 8 into %stack.0)
+    $rax = MOV64ri 0
+    $rdi = MOV64ri 0
+
+    DBG_INSTR_REF 1, 0, !11, !DIExpression(), debug-location !12
+    ; This shouldn't find anything -- we have disabled tracking of spills.
+
+    ; In addition to plain spills, spills that are folded into instructions
+    ; shouldn't be tracked either.
+    INC32m $rsp, 1, $noreg, 4, $noreg, implicit-def dead $eflags, debug-instr-number 5, debug-location !12 :: (store (s32) into %stack.0)
+
+
+    DBG_INSTR_REF 5, 1000000, !11, !DIExpression(), debug-location !12
+    ; Shouldn't be able to find the reference to instr 5's memory operand.
+
+    RET64 $rsi, debug-location !12
+...

llvm/unittests/CodeGen/InstrRefLDVTest.cpp

TEST_F(InstrRefLDVTest, MTransferCopies) {
   TransferMap.resize(1);
   produceMLocTransferFunction(*MF, TransferMap, 1);
 
   // Check that the spill location contains the value defined in rax by
   // instruction 1. The MIR header says -16 offset, but it's stored as -8;
   // it's not completely clear why, but here we only care about correctly
   // identifying the slot, not that all the surrounding data is correct.
   SpillLoc L = {getRegByName("RSP"), StackOffset::getFixed(-8)};
-  SpillLocationNo SpillNo = MTracker->getOrTrackSpillLoc(L);
+  SpillLocationNo SpillNo = *MTracker->getOrTrackSpillLoc(L);
   unsigned SpillLocID = MTracker->getLocID(SpillNo, {64, 0});
   LocIdx SpillLoc = MTracker->getSpillMLoc(SpillLocID);
   ValueIDNum V = MTracker->readMLoc(SpillLoc);
   Register RAX = getRegByName("RAX");
   LocIdx RaxLoc = MTracker->getRegMLoc(RAX);
   ValueIDNum Cmp(0, 1, RaxLoc);
   EXPECT_EQ(V, Cmp);
 
TEST_F(InstrRefLDVTest, MTransferSubregSpills) {
   MLocTracker::StackSlotPos SubRegIdxes[] = {{8, 0}, {8, 8}, {16, 0}, {32, 0}, {64, 0}};
   const char *SubRegNames[] = {"AL", "AH", "AX", "EAX", "RAX"};
   for (unsigned int I = 0; I < 5; ++I) {
     // Value number where it's defined,
     LocIdx RegLoc = MTracker->getRegMLoc(getRegByName(SubRegNames[I]));
     ValueIDNum DefNum(0, 1, RegLoc);
     // Read the corresponding subreg field from the stack.
     SpillLoc L = {getRegByName("RSP"), StackOffset::getFixed(-8)};
-    SpillLocationNo SpillNo = MTracker->getOrTrackSpillLoc(L);
+    SpillLocationNo SpillNo = *MTracker->getOrTrackSpillLoc(L);
     unsigned SpillID = MTracker->getLocID(SpillNo, SubRegIdxes[I]);
     LocIdx SpillLoc = MTracker->getSpillMLoc(SpillID);
     ValueIDNum SpillValue = MTracker->readMLoc(SpillLoc);
     EXPECT_EQ(DefNum, SpillValue);
   }
 
   // If we have exactly the same code, but we write $eax to the stack slot after
   // $rax, then we should still have exactly the same output in the lower five
for (unsigned int I = 0; I < 5; ++I) {
     LocIdx A = MTracker->getRegMLoc(getRegByName(ARegs[I]));
     LocIdx B = MTracker->getRegMLoc(getRegByName(BRegs[I]));
     EXPECT_EQ(MTracker->readMLoc(A), MTracker->readMLoc(B));
   }
 
   // $rbx should contain something else; today it's a def at the spill point
   // of the 4 byte value.
   SpillLoc L = {getRegByName("RSP"), StackOffset::getFixed(-8)};
-  SpillLocationNo SpillNo = MTracker->getOrTrackSpillLoc(L);
+  SpillLocationNo SpillNo = *MTracker->getOrTrackSpillLoc(L);
   unsigned SpillID = MTracker->getLocID(SpillNo, {64, 0});
   LocIdx Spill64Loc = MTracker->getSpillMLoc(SpillID);
   ValueIDNum DefAtSpill64(0, 3, Spill64Loc);
   LocIdx RbxLoc = MTracker->getRegMLoc(getRegByName("RBX"));
   EXPECT_EQ(MTracker->readMLoc(RbxLoc), DefAtSpill64);
 
   // Same again, test that the lower four subreg slots on the stack are the
   // value defined by $rax in instruction 1.
   for (unsigned int I = 0; I < 4; ++I) {
     // Value number where it's defined,
     LocIdx RegLoc = MTracker->getRegMLoc(getRegByName(SubRegNames[I]));
     ValueIDNum DefNum(0, 1, RegLoc);
     // Read the corresponding subreg field from the stack.
-    SpillNo = MTracker->getOrTrackSpillLoc(L);
+    SpillNo = *MTracker->getOrTrackSpillLoc(L);
     SpillID = MTracker->getLocID(SpillNo, SubRegIdxes[I]);
     LocIdx SpillLoc = MTracker->getSpillMLoc(SpillID);
     ValueIDNum SpillValue = MTracker->readMLoc(SpillLoc);
     EXPECT_EQ(DefNum, SpillValue);
   }
 
   // Stack slot for $rax should be a different value, today it's EmptyValue.
   ValueIDNum SpillValue = MTracker->readMLoc(Spill64Loc);
TEST_F(InstrRefLDVTest, MTransferSubregSpills) {
    "    RET64\n");
   setupLDVObj(MF);
   TransferMap.clear();
   TransferMap.resize(1);
   produceMLocTransferFunction(*MF, TransferMap, 1);
 
   for (unsigned int I = 0; I < 5; ++I) {
     // Read subreg fields from the stack.
-    SpillLocationNo SpillNo = MTracker->getOrTrackSpillLoc(L);
+    SpillLocationNo SpillNo = *MTracker->getOrTrackSpillLoc(L);
     unsigned SpillID = MTracker->getLocID(SpillNo, SubRegIdxes[I]);
     LocIdx SpillLoc = MTracker->getSpillMLoc(SpillID);
     ValueIDNum SpillValue = MTracker->readMLoc(SpillLoc);
 
     // Value should be defined by the spill-to-xmm0 instr, get value of a def
     // at the point of the spill.
     ValueIDNum SpillDef(0, 4, SpillLoc);
     EXPECT_EQ(SpillValue, SpillDef);
   }
 
   // Read xmm0's position and ensure it has a value. Should be the live-in
   // value to the block, as IMPLICIT_DEF isn't a real def.
-  SpillNo = MTracker->getOrTrackSpillLoc(L);
+  SpillNo = *MTracker->getOrTrackSpillLoc(L);
   SpillID = MTracker->getLocID(SpillNo, {128, 0});
   LocIdx Spill128Loc = MTracker->getSpillMLoc(SpillID);
   SpillValue = MTracker->readMLoc(Spill128Loc);
   Register XMM0 = getRegByName("XMM0");
   LocIdx Xmm0Loc = MTracker->getRegMLoc(XMM0);
   EXPECT_EQ(ValueIDNum(0, 0, Xmm0Loc), SpillValue);
 
   // What happens if we spill ah to the stack, then load al? It should find
TEST_F(InstrRefLDVTest, MLocDiamondSpills) {
   // test for this behaviour.
   setupDiamondBlocks();
 
   ASSERT_TRUE(MTracker->getNumLocs() == 1);
   LocIdx RspLoc(0);
 
   // Create a stack location and ensure it's tracked.
   SpillLoc SL = {getRegByName("RSP"), StackOffset::getFixed(-8)};
-  SpillLocationNo SpillNo = MTracker->getOrTrackSpillLoc(SL);
+  SpillLocationNo SpillNo = *MTracker->getOrTrackSpillLoc(SL);
   ASSERT_EQ(MTracker->getNumLocs(), 10u); // Tracks all possible stack locs.
   // Locations are: RSP, stack slots from 2^3 bits wide up to 2^9 for zmm regs,
   // then slots for sub_8bit_hi and sub_16bit_hi ({8, 8} and {16, 16}).
 
   // Pick out the locations on the stack that various x86 regs would be written
   // to. HAX is the upper 16 bits of EAX.
   unsigned ALID = MTracker->getLocID(SpillNo, {8, 0});
   unsigned AHID = MTracker->getLocID(SpillNo, {8, 8});