[IPSCCP][FuncSpec] Fix compiler crash 60191.

[labrinea]

Summary

Found here https://github.com/llvm/llvm-project/issues/60191

The compiler would crash when specializing a function based on a function pointer whose call sites may expect less parameters than those of the function we are replacing the pointer with.

Fixes #60191

[nikic]

llvm/lib/Transforms/IPO/FunctionSpecialization.cpp

627

Is it okay if the arguments have different types? (If no, then you'll want to compare getFunctionType()).

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

2

Can you avoid the triple in the test?

Also, is it possible to reduce the test such that it only requires running ipsccp, and not the whole opt pipeline?

[labrinea]

llvm/lib/Transforms/IPO/FunctionSpecialization.cpp

627

Good point, I'll look into it.

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

2

I couldn't get the compiler crash without the triple, or if I further reduced the test. I'll try harder. If I change the pass to "ipsccp<func-spec>" or just "ipsccp" (func-spec is implied by default) the test will still crash.

[jhuber6]

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

2

The fact that this crashes only on amdgcn-amd-amdhsa is weird, see https://godbolt.org/z/1h1fdPs4c. @arsenm, do you have any idea what it could be? It works fine with nvptx64-nvidia-cuda FWIW.

[labrinea]

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

2

It's not crashing only on that target, I have successfully reduced it further. Will upload a revised patch soon.

[labrinea]

Changes from last revision:

• early exit the calculation of specialization bonus when the function type mismatches instead of just the number of arguments
• reduced the test case further, removed the target triple, and specified the ipsccp pass only instead of O3

[nikic]

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

2

Missing | FileCheck %s, so your CHECK-DAG lines below don't do anything...

[labrinea]

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

2

Oops

[labrinea]

Added the missing filecheck command to the run line of the test.

[nikic]

LGTM

[jdoerfert]

If this is merged after we branch off, please backport :)

llvm/lib/Transforms/IPO/FunctionSpecialization.cpp

FunctionSpecializer::getSpecializationBonus(Argument *A, Constant *C,
   // good idea.
   int Bonus = 0;
   for (User *U : A->users()) {
     if (!isa<CallInst>(U) && !isa<InvokeInst>(U))
       continue;
     auto *CS = cast<CallBase>(U);
     if (CS->getCalledOperand() != A)
       continue;
+    if (CS->getFunctionType() != CalledFunction->getFunctionType())
+      continue;
 
     // Get the cost of inlining the called function at this call site. Note
     // that this is only an estimate. The called function may eventually
     // change in a way that leads to it not being inlined here, even though
     // inlining looks profitable now. For example, one of its called
     // functions may be inlined into it, making the called function too large
     // to be inlined into this call site.
     //

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

+; RUN: opt -S --passes="ipsccp<func-spec>" -force-function-specialization < %s | FileCheck %s
+
+@A = private constant [6 x i32] [i32 1, i32 2, i32 0, i32 0, i32 0, i32 0], align 16
+@B = external global ptr, align 8
+
+define i32 @caller() {
+entry:
+  %c1 = call fastcc i32 @func(ptr @f0, i32 0, ptr null)
+  %c2 = call fastcc i32 @func(ptr @f1, i32 1, ptr @A)
+  %c3 = call fastcc i32 @func(ptr @f2, i32 2, ptr @A)
+  %add = add i32 %c1, %c2
+  %sub = sub i32 %add, %c3
+  ret i32 %sub
+}
+
+define internal fastcc i32 @func(ptr %f, i32 %N, ptr %A) {
+entry:
+  switch i32 %N, label %sw.epilog [
+    i32 2, label %sw.bb
+    i32 1, label %sw.bb2
+    i32 0, label %sw.bb4
+  ]
+
+sw.bb:                                            ; preds = %entry
+  %0 = getelementptr inbounds i32, ptr %A, i64 1
+  %1 = load i32, ptr %0, align 4
+  %2 = call i32 %f(i32 %1)
+  br label %sw.epilog
+
+sw.bb2:                                           ; preds = %entry
+  %3 = load i32, ptr %A, align 4
+  %4 = zext i32 %3 to i64
+  %5 = call i32 %f(i64 %4)
+  br label %sw.epilog
+
+sw.bb4:                                           ; preds = %entry
+  %6 = call i32 %f()
+  br label %sw.epilog
+
+sw.epilog:                                        ; preds = %sw.bb, %sw.bb2, %sw.bb4, %entry
+  %7 = phi i32 [undef, %entry], [%2, %sw.bb], [%5, %sw.bb2], [%6, %sw.bb4]
+  ret i32 %7
+}
+
+define i32 @f0() {
+  %ld = load i32, ptr @B, align 4
+  ret i32 %ld
+}
+
+define i32 @f1(i64 %offset) {
+  %gep = getelementptr inbounds i32, ptr @B, i64 %offset
+  %ld = load i32, ptr %gep, align 4
+  ret i32 %ld
+}
+
+define i32 @f2(i32 %offset) {
+  %zext = zext i32 %offset to i64 
+  %call = call i32 @f1(i64 %zext)
+  ret i32 %call
+}
+
+; Tests that `func` has been specialized and it didn't cause compiler crash.
+; CHECK-DAG: func.1
+; CHECK-DAG: func.2
+; CHECK-DAG: func.3
+