The [3/3] Fix mangle problem when variable used in inline asm （Support ARR[BaseReg+IndexReg+..] in PIC model）

[xiangzhangllvm]

Summary

This patch is base on D120886 and D120887

These 2 patches let Global Value inline asm operand visible in inline asm code string.
But they bring some problems in building inline asm in PIC model.
(Some problems of building inline asm in PIC model are always existed for a long time.)

There are 3 kind PIC models in X86 : GOTPIC, RIPPIC and StubPIC
This patch support building Global Value inline asm operand in GOTPIC, RIPPIC PIC model.

For StubPIC , there is always incorrect in using global value in inline asm.
For example, the mangle and address calculation is incorrect in
https://godbolt.org/z/3T4PGdeqM 
I will fix it in another patch if we have such requirement.

[skan]

llvm/test/CodeGen/X86/ms-inline-asm-variables-x64-1.ll

2

Please use a more specific name for the test files. "-1" is ambiguous.

[skan]

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

490–492

Why do you need to check AttachToOperandIdx and SymName at same time?

[skan]

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

841–855

Split this workaround to another patch and add a negative test for StubPIC . We'd better to remind the user that something goes wrong here.

[xiangzhangllvm]

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

490–492

Because in back end, (when the source code is *.ll), the GV will be present like $0 , we should use AttachToOperandIdx to make sure there is an operand.

841–855

Make sense

[skan]

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

490–492

Please add comments about this.

If I understood it right, the check !SymName.empty() was for front end, shouldn't we add a C test for it?

844

inline asm

[xiangzhangllvm]

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

490–492

For the StrubPIC the SymName can also be get in the back end. Current comments is enough. The comments should focus on what the purpose here. Not focus on explain the SymName or other variables. (If need comments for variables, they should "attached" on the position where these variables defines)

[skan]

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

490–492

But this patch is not going to support StrubPIC.
Question: Is "!SymName.empty()" here covered by your tests?

[xiangzhangllvm]

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

490–492

The key problem is the "IsPIC " may not works in FE, so I didn't add FE test. In FE Parser, the pic info is not yet collected.
@jyu2 , Is there any better way to get the PIC info in front end Parser ?

[xiangzhangllvm]

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

490–492

Let me push this go on quickly. (For our customers are waiting for the fixing)
In fact, it is not much worth for tangling in this place for much time.

The condition here is just to give a more friendly Error report "Don't use 2 or ..." for
(e.g.) $0[intel Expression] and Symbol[intel Expression] in PIC model.
It is also no problem to continue use the old Error report "BaseReg/IndexReg ...".

I am ok to remove the "Symbol" check if you insist on that.

[skan]

llvm/docs/LangRef.rst

5058–5060 ↗

(On Diff #417480)

It -> it, edditional ->additional.

Print a memory reference or operand for use as the argument of a call instruction (E.g. omit `(rip)`, even though it's PC-relative) or a memory reference with explict base reg and index reg.

[skan]

Added @jyknight as reviewer to let him know the sematic of modifier P is extended in this patch. The documentation of P was added in D10816.

[skan]

LGTM except the doc part.

llvm/docs/LangRef.rst

5058 ↗

(On Diff #417496)

I suggest the following doc:

Print a memory reference or operand for use as the argument of a call instruction (e.g. omit (rip), even though it's PC-relative) or a memory reference with explict base reg and index reg.

[xiangzhangllvm]

In D121785#3401608, @skan wrote:

Added @jyknight as reviewer to let him know the sematic of modifier P is extended in this patch. The documentation of P was added in D10816.

This patch is in at 7 years ago (2015), I don't think the author remember so details. What's more, this is x86 only modifier and it is time to update it today (with finding so many defects in inline asm)

llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

 #include "llvm/MC/MCSymbol.h"
 #include "llvm/MC/TargetRegistry.h"
 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/Compiler.h"
 #include "llvm/Support/SourceMgr.h"
 #include "llvm/Support/raw_ostream.h"
 #include <algorithm>
 #include <memory>
+#include <queue>
 
 using namespace llvm;
 
 static cl::opt<bool> LVIInlineAsmHardening(
     "x86-experimental-lvi-inline-asm-hardening",
     cl::desc("Harden inline assembly code that may be vulnerable to Load Value"
              " Injection (LVI). This feature is experimental."), cl::Hidden);
 
class IntelExprStateMachine {
     int64_t Imm;
     const MCExpr *Sym;
     StringRef SymName;
     InfixCalculator IC;
     InlineAsmIdentifierInfo Info;
     short BracCount;
     bool MemExpr;
     bool OffsetOperator;
+    bool AttachToOperandIdx;
+    bool IsPIC;
     SMLoc OffsetOperatorLoc;
     AsmTypeInfo CurType;
 
     bool setSymRef(const MCExpr *Val, StringRef ID, StringRef &ErrMsg) {
       if (Sym) {
         ErrMsg = "cannot use more than one symbol in memory operand";
         return true;
       }
       Sym = Val;
       SymName = ID;
       return false;
     }
 
   public:
     IntelExprStateMachine()
         : State(IES_INIT), PrevState(IES_ERROR), BaseReg(0), IndexReg(0),
           TmpReg(0), Scale(0), Imm(0), Sym(nullptr), BracCount(0),
-          MemExpr(false), OffsetOperator(false) {}
+          MemExpr(false), OffsetOperator(false),
+          AttachToOperandIdx(false), IsPIC(false) {}
 
     void addImm(int64_t imm) { Imm += imm; }
     short getBracCount() const { return BracCount; }
     bool isMemExpr() const { return MemExpr; }
     bool isOffsetOperator() const { return OffsetOperator; }
     SMLoc getOffsetLoc() const { return OffsetOperatorLoc; }
     unsigned getBaseReg() const { return BaseReg; }
     unsigned getIndexReg() const { return IndexReg; }
     unsigned getScale() const { return Scale; }
     const MCExpr *getSym() const { return Sym; }
     StringRef getSymName() const { return SymName; }
     StringRef getType() const { return CurType.Name; }
     unsigned getSize() const { return CurType.Size; }
     unsigned getElementSize() const { return CurType.ElementSize; }
     unsigned getLength() const { return CurType.Length; }
     int64_t getImm() { return Imm + IC.execute(); }
     bool isValidEndState() const {
       return State == IES_RBRAC || State == IES_INTEGER;
     }
+
+    // Is the intel expression appended after an operand index.
+    // [OperandIdx][Intel Expression]
+    // This is neccessary for checking if it is an independent
+    // intel expression at back end when parse inline asm.
+    void setAppendAfterOperand() { AttachToOperandIdx = true; }
+
+    bool isPIC() const { return IsPIC; }
+    void setPIC() { IsPIC = true; }
+
     bool hadError() const { return State == IES_ERROR; }
     const InlineAsmIdentifierInfo &getIdentifierInfo() const { return Info; }
 
+    bool regsUseUpError(StringRef &ErrMsg) {
+      // This case mostly happen in inline asm, e.g. Arr[BaseReg + IndexReg]
+      // can not intruduce additional register in inline asm in PIC model.
+      if (IsPIC && (!SymName.empty() || AttachToOperandIdx))
+        ErrMsg = "Don't use 2 or more regs for mem offset in PIC model!";
+      else
+        ErrMsg = "BaseReg/IndexReg already set!";
+      return true;
+    }
+
     void onOr() {
       IntelExprState CurrState = State;
       switch (State) {
       default:
         State = IES_ERROR;
         break;
       case IES_INTEGER:
       case IES_RPAREN:
bool onPlus(StringRef &ErrMsg) {
         State = IES_PLUS;
         IC.pushOperator(IC_PLUS);
         if (CurrState == IES_REGISTER && PrevState != IES_MULTIPLY) {
           // If we already have a BaseReg, then assume this is the IndexReg with
           // no explicit scale.
           if (!BaseReg) {
             BaseReg = TmpReg;
           } else {
-            if (IndexReg) {
-              ErrMsg = "BaseReg/IndexReg already set!";
-              return true;
-            }
+            if (IndexReg)
+              return regsUseUpError(ErrMsg);
             IndexReg = TmpReg;
             Scale = 0;
           }
         }
         break;
       }
       PrevState = CurrState;
       return false;
bool onMinus(StringRef &ErrMsg) {
         } else
           IC.pushOperator(IC_NEG);
         if (CurrState == IES_REGISTER && PrevState != IES_MULTIPLY) {
           // If we already have a BaseReg, then assume this is the IndexReg with
           // no explicit scale.
           if (!BaseReg) {
             BaseReg = TmpReg;
           } else {
-            if (IndexReg) {
-              ErrMsg = "BaseReg/IndexReg already set!";
-              return true;
-            }
+            if (IndexReg)
+              return regsUseUpError(ErrMsg);
             IndexReg = TmpReg;
             Scale = 0;
           }
         }
         break;
       }
       PrevState = CurrState;
       return false;
bool onRegister(unsigned Reg, StringRef &ErrMsg) {
       case IES_LBRAC:
         State = IES_REGISTER;
         TmpReg = Reg;
         IC.pushOperand(IC_REGISTER);
         break;
       case IES_MULTIPLY:
         // Index Register - Scale * Register
         if (PrevState == IES_INTEGER) {
-          if (IndexReg) {
-            ErrMsg = "BaseReg/IndexReg already set!";
-            return true;
-          }
+          if (IndexReg)
+            return regsUseUpError(ErrMsg);
           State = IES_REGISTER;
           IndexReg = Reg;
           // Get the scale and replace the 'Scale * Register' with '0'.
           Scale = IC.popOperand();
           if (checkScale(Scale, ErrMsg))
             return true;
           IC.pushOperand(IC_IMM);
           IC.popOperator();
bool onIdentifierExpr(const MCExpr *SymRef, StringRef SymRefName,
         break;
       case IES_CAST:
       case IES_PLUS:
       case IES_MINUS:
       case IES_NOT:
       case IES_INIT:
       case IES_LBRAC:
       case IES_LPAREN:
+        // The InineAsm can also be parsed from emitInlineAsm (not from FE)
+        // which may generate "Sym - BaseSym" for pic-base-offset addressing
+        // model (e.g. i386-darwin).
+        // Here we remove "- BaseSym" in inlineasm if it exists.
+        // TODO(RefineMe): Here is an architecture defect for both FE parser
+        // and BE emitInlineAsm share the same way to parse the inline asm.
+        // So the 2 symbol syntax checking may not be always right.
+        if (isPIC()) {
+          if (!Sym && setSymRef(SymRef, SymRefName, ErrMsg))
+            return true;
+        } else {
           if (setSymRef(SymRef, SymRefName, ErrMsg))
             return true;
+        }
         MemExpr = true;
         State = IES_INTEGER;
         IC.pushOperand(IC_IMM);
         if (ParsingMSInlineAsm)
           Info = IDInfo;
         setTypeInfo(Type);
         break;
       }
       return false;
bool onInteger(int64_t TmpInt, StringRef &ErrMsg) {
       case IES_MOD:
       case IES_MULTIPLY:
       case IES_LPAREN:
       case IES_INIT:
       case IES_LBRAC:
         State = IES_INTEGER;
         if (PrevState == IES_REGISTER && CurrState == IES_MULTIPLY) {
           // Index Register - Register * Scale
-          if (IndexReg) {
-            ErrMsg = "BaseReg/IndexReg already set!";
-            return true;
-          }
+          if (IndexReg)
+            return regsUseUpError(ErrMsg);
           IndexReg = TmpReg;
           Scale = TmpInt;
           if (checkScale(Scale, ErrMsg))
             return true;
           // Get the scale and replace the 'Register * Scale' with '0'.
           IC.popOperator();
         } else {
           IC.pushOperand(IC_IMM, TmpInt);
bool onLBrac() {
         assert(!BracCount && "BracCount should be zero on parsing's start");
         State = IES_LBRAC;
         break;
       }
       MemExpr = true;
       BracCount++;
       return false;
     }
-    bool onRBrac() {
+    bool onRBrac(StringRef &ErrMsg) {
       IntelExprState CurrState = State;
       switch (State) {
       default:
         State = IES_ERROR;
         break;
       case IES_INTEGER:
       case IES_OFFSET:
       case IES_REGISTER:
       case IES_RPAREN:
-        if (BracCount-- != 1)
+        if (BracCount-- != 1) {
+          ErrMsg = "unexpected bracket encountered";
           return true;
+        }
         State = IES_RBRAC;
         if (CurrState == IES_REGISTER && PrevState != IES_MULTIPLY) {
           // If we already have a BaseReg, then assume this is the IndexReg with
           // no explicit scale.
           if (!BaseReg) {
             BaseReg = TmpReg;
           } else {
-            assert (!IndexReg && "BaseReg/IndexReg already set!");
+            if (IndexReg)
+              return regsUseUpError(ErrMsg);
             IndexReg = TmpReg;
             Scale = 0;
           }
         }
         break;
       }
       PrevState = CurrState;
       return false;
bool onOffset(const MCExpr *Val, SMLoc OffsetLoc, StringRef ID,
       PrevState = State;
       switch (State) {
       default:
         ErrMsg = "unexpected offset operator expression";
         return true;
       case IES_PLUS:
       case IES_INIT:
       case IES_LBRAC:
+        // The InineAsm can also be parsed from emitInlineAsm (not from FE)
+        // which may generate "Sym - BaseSym" for pic-base-offset addressing
+        // model (e.g. i386-darwin).
+        // Here we remove "- BaseSym" in inlineasm if it exists.
+        // TODO(RefineMe): Here is an architecture defect for both FE parser
+        // and BE emitInlineAsm share the same way to parse the inline asm.
+        // So the 2 symbol syntax checking may not be always right.
+        if (isPIC()) {
+          if (!Sym && setSymRef(Val, ID, ErrMsg))
+            return true;
+        } else {
           if (setSymRef(Val, ID, ErrMsg))
             return true;
+        }
         OffsetOperator = true;
         OffsetOperatorLoc = OffsetLoc;
         State = IES_OFFSET;
         // As we cannot yet resolve the actual value (offset), we retain
         // the requested semantics by pushing a '0' to the operands stack
         IC.pushOperand(IC_IMM);
         if (ParsingMSInlineAsm) {
           Info = IDInfo;
bool ParseMasmNamedOperator(StringRef Name, IntelExprStateMachine &SM,
                               bool &ParseError, SMLoc &End);
   void RewriteIntelExpression(IntelExprStateMachine &SM, SMLoc Start,
                               SMLoc End);
   bool ParseIntelExpression(IntelExprStateMachine &SM, SMLoc &End);
   bool ParseIntelInlineAsmIdentifier(const MCExpr *&Val, StringRef &Identifier,
                                      InlineAsmIdentifierInfo &Info,
                                      bool IsUnevaluatedOperand, SMLoc &End,
                                      bool IsParsingOffsetOperator = false);
+  void tryParseOperandIdx(std::queue<AsmToken::TokenKind> &PrevTKs,
+                          IntelExprStateMachine &SM);
 
   bool ParseMemOperand(unsigned SegReg, const MCExpr *Disp, SMLoc StartLoc,
                        SMLoc EndLoc, OperandVector &Operands);
 
   X86::CondCode ParseConditionCode(StringRef CCode);
 
   bool ParseIntelMemoryOperandSize(unsigned &Size);
   bool CreateMemForMSInlineAsm(unsigned SegReg, const MCExpr *Disp,
if (Name.equals_insensitive("eq")) {
     SM.onGE();
   } else {
     return false;
   }
   End = consumeToken();
   return true;
 }
 
+// Check if current intel expression append after an operand.
+// Like: [Operand][Intel Expression]
+void X86AsmParser::tryParseOperandIdx(std::queue<AsmToken::TokenKind> &PrevTKs,
+                                      IntelExprStateMachine &SM) {
+  if (PrevTKs.size() != 3)
+    return;
+
+  if (PrevTKs.front() != AsmToken::LBrac ||
+      PrevTKs.back() != AsmToken::RBrac)
+    return;
+
+  PrevTKs.pop();
+  if (PrevTKs.front() != AsmToken::Integer &&
+      PrevTKs.front() != AsmToken::Identifier)
+    return;
+
+  SM.setAppendAfterOperand();
+}
+
 bool X86AsmParser::ParseIntelExpression(IntelExprStateMachine &SM, SMLoc &End) {
   MCAsmParser &Parser = getParser();
   StringRef ErrMsg;
 
-  AsmToken::TokenKind PrevTK = AsmToken::Error;
+  std::queue<AsmToken::TokenKind> PrevTKs;
+  PrevTKs.push(AsmToken::Error);
+
+  if (getContext().getObjectFileInfo()->isPositionIndependent())
+    SM.setPIC();
+
   bool Done = false;
   while (!Done) {
     // Get a fresh reference on each loop iteration in case the previous
-    // iteration moved the token storage during UnLex().
+    // iteration moved the token storage during UnLenx().
     const AsmToken &Tok = Parser.getTok();
 
     bool UpdateLocLex = true;
     AsmToken::TokenKind TK = getLexer().getKind();
 
     switch (TK) {
     default:
       if ((Done = SM.isValidEndState()))
case AsmToken::Identifier: {
         break;
       }
       // Symbol reference, when parsing assembly content
       InlineAsmIdentifierInfo Info;
       AsmFieldInfo FieldInfo;
       const MCExpr *Val;
       if (isParsingMSInlineAsm() || Parser.isParsingMasm()) {
         // MS Dot Operator expression
         if (Identifier.count('.') &&
-            (PrevTK == AsmToken::RBrac || PrevTK == AsmToken::RParen)) {
+            (PrevTKs.back() == AsmToken::RBrac ||
+             PrevTKs.back() == AsmToken::RParen)) {
           if (ParseIntelDotOperator(SM, End))
             return true;
           break;
         }
       }
       if (isParsingMSInlineAsm()) {
         // MS InlineAsm operators (TYPE/LENGTH/SIZE)
         if (unsigned OpKind = IdentifyIntelInlineAsmOperator(Identifier)) {
while (!Done) {
     case AsmToken::Amp:     SM.onAnd(); break;
     case AsmToken::LessLess:
                             SM.onLShift(); break;
     case AsmToken::GreaterGreater:
                             SM.onRShift(); break;
     case AsmToken::LBrac:
       if (SM.onLBrac())
         return Error(Tok.getLoc(), "unexpected bracket encountered");
+        tryParseOperandIdx(PrevTKs, SM);
       break;
     case AsmToken::RBrac:
-      if (SM.onRBrac())
-        return Error(Tok.getLoc(), "unexpected bracket encountered");
+      if (SM.onRBrac(ErrMsg)) {
+        return Error(Tok.getLoc(), ErrMsg);
+      }
       break;
     case AsmToken::LParen:  SM.onLParen(); break;
     case AsmToken::RParen:  SM.onRParen(); break;
     }
     if (SM.hadError())
       return Error(Tok.getLoc(), "unknown token in expression");
 
     if (!Done && UpdateLocLex)
       End = consumeToken();
 
-    PrevTK = TK;
+    // Update history token kinds.
+    // Currently we only need to keep 3 token kinds.
+    PrevTKs.push(TK);
+    if (PrevTKs.size() > 3)
+      PrevTKs.pop();
   }
   return false;
 }
 
 void X86AsmParser::RewriteIntelExpression(IntelExprStateMachine &SM,
                                           SMLoc Start, SMLoc End) {
   SMLoc Loc = Start;
   unsigned ExprLen = End.getPointer() - Start.getPointer();
bool X86AsmParser::ParseIntelOperand(OperandVector &Operands) {
   if ((BaseReg == X86::SI || BaseReg == X86::DI) &&
       (IndexReg == X86::BX || IndexReg == X86::BP))
     std::swap(BaseReg, IndexReg);
 
   if ((BaseReg || IndexReg) &&
       CheckBaseRegAndIndexRegAndScale(BaseReg, IndexReg, Scale, is64BitMode(),
                                       ErrMsg))
     return Error(Start, ErrMsg);
+
   if (isParsingMSInlineAsm())
     return CreateMemForMSInlineAsm(RegNo, Disp, BaseReg, IndexReg, Scale, Start,
                                    End, Size, SM.getSymName(),
                                    SM.getIdentifierInfo(), Operands);
 
   // When parsing x64 MS-style assembly, all non-absolute references to a named
   // variable default to RIP-relative.
   if (Parser.isParsingMasm() && is64BitMode() && SM.getElementSize() > 0) {

llvm/lib/Target/X86/X86AsmPrinter.cpp

void X86AsmPrinter::PrintIntelMemReference(const MachineInstr *MI,
   const MachineOperand &SegReg = MI->getOperand(OpNo + X86::AddrSegmentReg);
 
   // If we really don't want to print out (rip), don't.
   bool HasBaseReg = BaseReg.getReg() != 0;
   if (HasBaseReg && Modifier && !strcmp(Modifier, "no-rip") &&
       BaseReg.getReg() == X86::RIP)
     HasBaseReg = false;
 
+  // If we really just want to print out displacement.
+  bool HasIndexReg = IndexReg.getReg() != 0;
+  if (Modifier && (DispSpec.isGlobal() || DispSpec.isSymbol()) &&
+     !strcmp(Modifier, "disp-only")) {
+    HasBaseReg = false;
+    HasIndexReg = false;
+  }
+
   // If this has a segment register, print it.
   if (SegReg.getReg()) {
     PrintOperand(MI, OpNo + X86::AddrSegmentReg, O);
     O << ':';
   }
 
   O << '[';
 
case 'H':
       if (MI->getInlineAsmDialect() == InlineAsm::AD_Intel) {
         return true;  // Unsupported modifier in Intel inline assembly.
       } else {
         PrintMemReference(MI, OpNo, O, "H");
       }
       return false;
     case 'P': // Don't print @PLT, but do print as memory.
       if (MI->getInlineAsmDialect() == InlineAsm::AD_Intel) {
-        PrintIntelMemReference(MI, OpNo, O, "no-rip");
+        PrintIntelMemReference(MI, OpNo, O, "disp-only");
       } else {
         PrintMemReference(MI, OpNo, O, "no-rip");
       }
       return false;
     }
   }
   if (MI->getInlineAsmDialect() == InlineAsm::AD_Intel) {
     PrintIntelMemReference(MI, OpNo, O, nullptr);

llvm/test/CodeGen/X86/ms-inline-asm-variables-x64-1.ll

+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
+; RUN: llc -mtriple=x86_64-unknown-unknown -relocation-model=pic %s -o - | FileCheck %s
+
+; Tests come from "clang/test/CodeGen/ms-inline-asm-variables.c"
+; int gVar;
+; void t1() {
+;  __asm add eax, dword ptr gVar[rax]
+;  __asm add dword ptr [rax+gVar], eax
+;  __asm add ebx, dword ptr gVar[271 - 82 + 81 + rbx]
+;  __asm add dword ptr [rbx + gVar + 828], ebx
+;  gVar = 3;
+; }
+;
+; void t2(void) {
+;  int lVar;
+;  __asm mov eax, dword ptr lVar[rax]
+;  __asm mov dword ptr [rax+lVar], eax
+;  __asm mov ebx, dword ptr lVar[271 - 82 + 81 + rbx]
+;  __asm mov dword ptr [rbx + lVar + 828], ebx
+;  __asm mov 5 + 8 + 13 + 21[lVar + rbx], eax
+;  lVar = 2;
+; }
+
+@gVar = global i32 0, align 4
+
+; Function Attrs: noinline nounwind optnone uwtable
+define void @t1() #0 {
+; CHECK-LABEL: t1:
+; CHECK:       # %bb.0: # %entry
+; CHECK-NEXT:    pushq %rbp
+; CHECK-NEXT:    .cfi_def_cfa_offset 16
+; CHECK-NEXT:    .cfi_offset %rbp, -16
+; CHECK-NEXT:    movq %rsp, %rbp
+; CHECK-NEXT:    .cfi_def_cfa_register %rbp
+; CHECK-NEXT:    pushq %rbx
+; CHECK-NEXT:    .cfi_offset %rbx, -24
+; CHECK-NEXT:    movq gVar@GOTPCREL(%rip), %rcx
+; CHECK-NEXT:    #APP
+; CHECK-EMPTY:
+; CHECK-NEXT:    addl (%rcx,%rax), %eax
+; CHECK-NEXT:    addl %eax, (%rcx,%rax)
+; CHECK-NEXT:    addl 270(%rcx,%rbx), %ebx
+; CHECK-NEXT:    addl %ebx, 828(%rcx,%rbx)
+; CHECK-EMPTY:
+; CHECK-NEXT:    #NO_APP
+; CHECK-NEXT:    movq gVar@GOTPCREL(%rip), %rax
+; CHECK-NEXT:    movl $3, (%rax)
+; CHECK-NEXT:    popq %rbx
+; CHECK-NEXT:    popq %rbp
+; CHECK-NEXT:    .cfi_def_cfa %rsp, 8
+; CHECK-NEXT:    retq
+entry:
+  call void asm sideeffect inteldialect "add eax, dword ptr $2[rax]\0A\09add dword ptr $0[rax], eax\0A\09add ebx, dword ptr $3[rbx + $$270]\0A\09add dword ptr $1[rbx + $$828], ebx", "=*m,=*m,*m,*m,~{eax},~{ebx},~{flags},~{dirflag},~{fpsr},~{flags}"(i32* elementtype(i32) @gVar, i32* elementtype(i32) @gVar, i32* elementtype(i32) @gVar, i32* elementtype(i32) @gVar) #1
+  store i32 3, i32* @gVar, align 4
+  ret void
+}
+
+; Function Attrs: noinline nounwind optnone uwtable
+define void @t2() #0 {
+; CHECK-LABEL: t2:
+; CHECK:       # %bb.0: # %entry
+; CHECK-NEXT:    pushq %rbp
+; CHECK-NEXT:    .cfi_def_cfa_offset 16
+; CHECK-NEXT:    .cfi_offset %rbp, -16
+; CHECK-NEXT:    movq %rsp, %rbp
+; CHECK-NEXT:    .cfi_def_cfa_register %rbp
+; CHECK-NEXT:    pushq %rbx
+; CHECK-NEXT:    .cfi_offset %rbx, -24
+; CHECK-NEXT:    #APP
+; CHECK-EMPTY:
+; CHECK-NEXT:    movl -12(%rbp,%rax), %eax
+; CHECK-NEXT:    movl %eax, -12(%rbp,%rax)
+; CHECK-NEXT:    movl 258(%rbp,%rbx), %ebx
+; CHECK-NEXT:    movl %ebx, 816(%rbp,%rbx)
+; CHECK-NEXT:    movl %eax, 35(%rbp,%rbx)
+; CHECK-EMPTY:
+; CHECK-NEXT:    #NO_APP
+; CHECK-NEXT:    movl $2, -12(%rbp)
+; CHECK-NEXT:    popq %rbx
+; CHECK-NEXT:    popq %rbp
+; CHECK-NEXT:    .cfi_def_cfa %rsp, 8
+; CHECK-NEXT:    retq
+entry:
+  %lVar = alloca i32, align 4
+  call void asm sideeffect inteldialect "mov eax, dword ptr $3[rax]\0A\09mov dword ptr $0[rax], eax\0A\09mov ebx, dword ptr $4[rbx + $$270]\0A\09mov dword ptr $1[rbx + $$828], ebx\0A\09mov $2[rbx + $$47], eax", "=*m,=*m,=*m,*m,*m,~{eax},~{ebx},~{dirflag},~{fpsr},~{flags}"(i32* elementtype(i32) %lVar, i32* elementtype(i32) %lVar, i32* elementtype(i32) %lVar, i32* elementtype(i32) %lVar, i32* elementtype(i32) %lVar) #1
+  store i32 2, i32* %lVar, align 4
+  ret void
+}
+
+attributes #0 = { noinline nounwind optnone uwtable "frame-pointer"="all" "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
+attributes #1 = { nounwind }
+
+!llvm.module.flags = !{!0}
+
+!0 = !{i32 1, !"wchar_size", i32 4}

llvm/test/CodeGen/X86/ms-inline-asm-variables-x64-2.ll

+; RUN: not llc -mtriple=x86_64-unknown-unknown -relocation-model=pic %s -o /dev/null 2>&1 | FileCheck %s
+
+; Tests come from "clang/test/CodeGen/ms-inline-asm-variables.c"
+;
+; int gVar;
+; void t1() {
+;  __asm add ecx, dword ptr gVar[4590 + rax + rcx*4]
+;  __asm add dword ptr [gVar + rax + 45 + 23 - 53 + 60 - 2 + rcx*8], ecx
+;  __asm add 1 + 1 + 2 + 3[gVar + rcx + rbx], eax
+; gVar = 3;
+; }
+
+@gVar = global i32 0, align 4
+
+; Function Attrs: noinline nounwind optnone uwtable
+define void @t1() #0 {
+; CHECK: error: Don't use 2 or more regs for mem offset in PIC model
+; CHECK: error: Don't use 2 or more regs for mem offset in PIC model
+; CHECK: error: Don't use 2 or more regs for mem offset in PIC model
+entry:
+  call void asm sideeffect inteldialect "add ecx, dword ptr ${2:P}[rax + rcx * $$4 + $$4590]\0A\09add dword ptr ${0:P}[rcx + rcx * $$8 + $$73], ecx\0A\09add ${1:P}[rcx + rbx + $$7], eax", "=*m,=*m,*m,~{ecx},~{flags},~{dirflag},~{fpsr},~{flags}"(i32* elementtype(i32) @gVar, i32* elementtype(i32) @gVar, i32* elementtype(i32) @gVar)
+  store i32 3, i32* @gVar, align 4
+  ret void
+}
+
+attributes #0 = { noinline nounwind optnone uwtable "frame-pointer"="all" "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
+attributes #1 = { nounwind }
+
+!llvm.module.flags = !{!0}
+
+!0 = !{i32 1, !"wchar_size", i32 4}

llvm/test/CodeGen/X86/ms-inline-asm-variables-x86-1.ll

+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
+; RUN: llc -mtriple=i386-unknown-unknown %s -o - | FileCheck --check-prefix=X86 %s
+; RUN: llc -mtriple=i386-unknown-unknown -relocation-model=pic %s -o -| FileCheck --check-prefix=X86PIC %s
+
+; Tests come from clang/test/CodeGen/ms-inline-asm-variables.c
+;
+; int gVar;
+; void t1() {
+;  __asm add eax, dword ptr gVar[eax]
+;  __asm add dword ptr [eax+gVar], eax
+;  __asm add ebx, dword ptr gVar[271 - 82 + 81 + ebx]
+;  __asm add dword ptr [ebx + gVar + 828], ebx
+;  gVar = 3;
+; }
+;
+; void t2(void) {
+;  int lVar;
+;  __asm mov eax, dword ptr lVar[eax]
+;  __asm mov dword ptr [eax+lVar], eax
+;  __asm mov ebx, dword ptr lVar[271 - 82 + 81 + ebx]
+;  __asm mov dword ptr [ebx + lVar + 828], ebx
+;  __asm mov 5 + 8 + 13 + 21[lVar + ebx], eax
+;  lVar = 2;
+; }
+
+@gVar = global i32 0, align 4
+
+; Function Attrs: noinline nounwind optnone uwtable
+define void @t1() #0 {
+; X86-LABEL: t1:
+; X86:       # %bb.0: # %entry
+; X86-NEXT:    pushl %ebp
+; X86-NEXT:    .cfi_def_cfa_offset 8
+; X86-NEXT:    .cfi_offset %ebp, -8
+; X86-NEXT:    movl %esp, %ebp
+; X86-NEXT:    .cfi_def_cfa_register %ebp
+; X86-NEXT:    pushl %ebx
+; X86-NEXT:    .cfi_offset %ebx, -12
+; X86-NEXT:    #APP
+; X86-EMPTY:
+; X86-NEXT:    addl gVar(%eax), %eax
+; X86-NEXT:    addl %eax, gVar(%eax)
+; X86-NEXT:    addl gVar+270(%ebx), %ebx
+; X86-NEXT:    addl %ebx, gVar+828(%ebx)
+; X86-EMPTY:
+; X86-NEXT:    #NO_APP
+; X86-NEXT:    movl $3, gVar
+; X86-NEXT:    popl %ebx
+; X86-NEXT:    popl %ebp
+; X86-NEXT:    .cfi_def_cfa %esp, 4
+; X86-NEXT:    retl
+;
+; X86PIC-LABEL: t1:
+; X86PIC:       # %bb.0: # %entry
+; X86PIC-NEXT:    pushl %ebp
+; X86PIC-NEXT:    .cfi_def_cfa_offset 8
+; X86PIC-NEXT:    .cfi_offset %ebp, -8
+; X86PIC-NEXT:    movl %esp, %ebp
+; X86PIC-NEXT:    .cfi_def_cfa_register %ebp
+; X86PIC-NEXT:    pushl %ebx
+; X86PIC-NEXT:    .cfi_offset %ebx, -12
+; X86PIC-NEXT:    calll .L0$pb
+; X86PIC-NEXT:  .L0$pb:
+; X86PIC-NEXT:    popl %ecx
+; X86PIC-NEXT:  .Ltmp0:
+; X86PIC-NEXT:    addl $_GLOBAL_OFFSET_TABLE_+(.Ltmp0-.L0$pb), %ecx
+; X86PIC-NEXT:    movl gVar@GOT(%ecx), %edx
+; X86PIC-NEXT:    #APP
+; X86PIC-EMPTY:
+; X86PIC-NEXT:    addl (%edx,%eax), %eax
+; X86PIC-NEXT:    addl %eax, (%edx,%eax)
+; X86PIC-NEXT:    addl 270(%edx,%ebx), %ebx
+; X86PIC-NEXT:    addl %ebx, 828(%edx,%ebx)
+; X86PIC-EMPTY:
+; X86PIC-NEXT:    #NO_APP
+; X86PIC-NEXT:    movl gVar@GOT(%ecx), %eax
+; X86PIC-NEXT:    movl $3, (%eax)
+; X86PIC-NEXT:    popl %ebx
+; X86PIC-NEXT:    popl %ebp
+; X86PIC-NEXT:    .cfi_def_cfa %esp, 4
+; X86PIC-NEXT:    retl
+entry:
+  call void asm sideeffect inteldialect "add eax, dword ptr $2[eax]\0A\09add dword ptr $0[eax], eax\0A\09add ebx, dword ptr $3[ebx + $$270]\0A\09add dword ptr $1[ebx + $$828], ebx", "=*m,=*m,*m,*m,~{eax},~{ebx},~{flags},~{dirflag},~{fpsr},~{flags}"(i32* elementtype(i32) @gVar, i32* elementtype(i32) @gVar, i32* elementtype(i32) @gVar, i32* elementtype(i32) @gVar)
+  store i32 3, i32* @gVar, align 4
+  ret void
+}
+
+; Function Attrs: noinline nounwind optnone uwtable
+define void @t2() #0 {
+; X86-LABEL: t2:
+; X86:       # %bb.0: # %entry
+; X86-NEXT:    pushl %ebp
+; X86-NEXT:    .cfi_def_cfa_offset 8
+; X86-NEXT:    .cfi_offset %ebp, -8
+; X86-NEXT:    movl %esp, %ebp
+; X86-NEXT:    .cfi_def_cfa_register %ebp
+; X86-NEXT:    pushl %ebx
+; X86-NEXT:    pushl %eax
+; X86-NEXT:    .cfi_offset %ebx, -12
+; X86-NEXT:    #APP
+; X86-EMPTY:
+; X86-NEXT:    movl -8(%ebp,%eax), %eax
+; X86-NEXT:    movl %eax, -8(%ebp,%eax)
+; X86-NEXT:    movl 262(%ebp,%ebx), %ebx
+; X86-NEXT:    movl %ebx, 820(%ebp,%ebx)
+; X86-NEXT:    movl %eax, 39(%ebp,%ebx)
+; X86-EMPTY:
+; X86-NEXT:    #NO_APP
+; X86-NEXT:    movl $2, -8(%ebp)
+; X86-NEXT:    addl $4, %esp
+; X86-NEXT:    popl %ebx
+; X86-NEXT:    popl %ebp
+; X86-NEXT:    .cfi_def_cfa %esp, 4
+; X86-NEXT:    retl
+;
+; X86PIC-LABEL: t2:
+; X86PIC:       # %bb.0: # %entry
+; X86PIC-NEXT:    pushl %ebp
+; X86PIC-NEXT:    .cfi_def_cfa_offset 8
+; X86PIC-NEXT:    .cfi_offset %ebp, -8
+; X86PIC-NEXT:    movl %esp, %ebp
+; X86PIC-NEXT:    .cfi_def_cfa_register %ebp
+; X86PIC-NEXT:    pushl %ebx
+; X86PIC-NEXT:    pushl %eax
+; X86PIC-NEXT:    .cfi_offset %ebx, -12
+; X86PIC-NEXT:    #APP
+; X86PIC-EMPTY:
+; X86PIC-NEXT:    movl -8(%ebp,%eax), %eax
+; X86PIC-NEXT:    movl %eax, -8(%ebp,%eax)
+; X86PIC-NEXT:    movl 262(%ebp,%ebx), %ebx
+; X86PIC-NEXT:    movl %ebx, 820(%ebp,%ebx)
+; X86PIC-NEXT:    movl %eax, 39(%ebp,%ebx)
+; X86PIC-EMPTY:
+; X86PIC-NEXT:    #NO_APP
+; X86PIC-NEXT:    movl $2, -8(%ebp)
+; X86PIC-NEXT:    addl $4, %esp
+; X86PIC-NEXT:    popl %ebx
+; X86PIC-NEXT:    popl %ebp
+; X86PIC-NEXT:    .cfi_def_cfa %esp, 4
+; X86PIC-NEXT:    retl
+entry:
+  %lVar = alloca i32, align 4
+  call void asm sideeffect inteldialect "mov eax, dword ptr $3[eax]\0A\09mov dword ptr $0[eax], eax\0A\09mov ebx, dword ptr $4[ebx + $$270]\0A\09mov dword ptr $1[ebx + $$828], ebx\0A\09mov $2[ebx + $$47], eax", "=*m,=*m,=*m,*m,*m,~{eax},~{ebx},~{dirflag},~{fpsr},~{flags}"(i32* elementtype(i32) %lVar, i32* elementtype(i32) %lVar, i32* elementtype(i32) %lVar, i32* elementtype(i32) %lVar, i32* elementtype(i32) %lVar)
+  store i32 2, i32* %lVar, align 4
+  ret void
+}
+
+attributes #0 = { noinline nounwind optnone uwtable "frame-pointer"="all" "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="pentium4" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
+attributes #1 = { nounwind }
+
+!llvm.module.flags = !{!0}
+
+!0 = !{i32 1, !"NumRegisterParameters", i32 0}

llvm/test/CodeGen/X86/ms-inline-asm-variables-x86-2.ll

+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
+; RUN: llc -mtriple=i386-unknown-unknown %s -o - | FileCheck --check-prefix=X86 %s
+; RUN: not llc -mtriple=i386-unknown-unknown -relocation-model=pic %s -o /dev/null 2>&1 | FileCheck --check-prefix=X86PIC %s
+
+; Tests come from "clang/test/CodeGen/ms-inline-asm-variables.c"
+;
+; int gVar;
+; void t1() {
+;  __asm add ecx, dword ptr gVar[4590 + eax + ecx*4]
+;  __asm add dword ptr [gVar + eax + 45 + 23 - 53 + 60 - 2 + ecx*8], ecx
+;  __asm add 1 + 1 + 2 + 3[gVar + ecx + ebx], eax
+;
+; gVar = 3;
+; }
+
+@gVar = global i32 0, align 4
+
+; Function Attrs: noinline nounwind optnone uwtable
+define void @t1() #0 {
+; X86-LABEL: t1:
+; X86:       # %bb.0: # %entry
+; X86-NEXT:    pushl %ebp
+; X86-NEXT:    .cfi_def_cfa_offset 8
+; X86-NEXT:    .cfi_offset %ebp, -8
+; X86-NEXT:    movl %esp, %ebp
+; X86-NEXT:    .cfi_def_cfa_register %ebp
+; X86-NEXT:    #APP
+; X86-EMPTY:
+; X86-NEXT:    addl gVar+4590(%eax,%ecx,4), %ecx
+; X86-NEXT:    addl %ecx, gVar+73(%eax,%ecx,8)
+; X86-NEXT:    addl %eax, gVar+7(%ecx,%ebx)
+; X86-EMPTY:
+; X86-NEXT:    #NO_APP
+; X86-NEXT:    movl $3, gVar
+; X86-NEXT:    popl %ebp
+; X86-NEXT:    .cfi_def_cfa %esp, 4
+; X86-NEXT:    retl
+
+; X86PIC: error: Don't use 2 or more regs for mem offset in PIC model
+; X86PIC: error: Don't use 2 or more regs for mem offset in PIC model
+; X86PIC: error: Don't use 2 or more regs for mem offset in PIC model
+
+entry:
+  call void asm sideeffect inteldialect "add ecx, dword ptr ${2:P}[eax + ecx * $$4 + $$4590]\0A\09add dword ptr ${0:P}[eax + ecx * $$8 + $$73], ecx\0A\09add ${1:P}[ecx + ebx + $$7], eax", "=*m,=*m,*m,~{eax},~{ecx},~{flags},~{dirflag},~{fpsr},~{flags}"(i32* elementtype(i32) @gVar, i32* elementtype(i32) @gVar, i32* elementtype(i32) @gVar) #1
+  store i32 3, i32* @gVar, align 4
+  ret void
+}
+
+attributes #0 = { noinline nounwind optnone uwtable "frame-pointer"="all" "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="pentium4" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
+attributes #1 = { nounwind }
+
+!llvm.module.flags = !{!0}
+
+!0 = !{i32 1, !"NumRegisterParameters", i32 0}