[IPSCCP][FuncSpec] Fix compiler crash 60191.

[labrinea]

Summary

Found here https://github.com/llvm/llvm-project/issues/60191

The compiler would crash when specializing a function based on a function pointer whose call sites may expect less parameters than those of the function we are replacing the pointer with.

Fixes #60191

[nikic]

llvm/lib/Transforms/IPO/FunctionSpecialization.cpp

627

Is it okay if the arguments have different types? (If no, then you'll want to compare getFunctionType()).

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

1

Can you avoid the triple in the test?

Also, is it possible to reduce the test such that it only requires running ipsccp, and not the whole opt pipeline?

[labrinea]

llvm/lib/Transforms/IPO/FunctionSpecialization.cpp

627

Good point, I'll look into it.

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

1

I couldn't get the compiler crash without the triple, or if I further reduced the test. I'll try harder. If I change the pass to "ipsccp<func-spec>" or just "ipsccp" (func-spec is implied by default) the test will still crash.

[jhuber6]

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

1

The fact that this crashes only on amdgcn-amd-amdhsa is weird, see https://godbolt.org/z/1h1fdPs4c. @arsenm, do you have any idea what it could be? It works fine with nvptx64-nvidia-cuda FWIW.

[labrinea]

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

1

It's not crashing only on that target, I have successfully reduced it further. Will upload a revised patch soon.

[labrinea]

Changes from last revision:

• early exit the calculation of specialization bonus when the function type mismatches instead of just the number of arguments
• reduced the test case further, removed the target triple, and specified the ipsccp pass only instead of O3

[nikic]

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

2

Missing | FileCheck %s, so your CHECK-DAG lines below don't do anything...

[labrinea]

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

2

Oops

[labrinea]

Added the missing filecheck command to the run line of the test.

[nikic]

LGTM

[jdoerfert]

If this is merged after we branch off, please backport :)

llvm/lib/Transforms/IPO/FunctionSpecialization.cpp

FunctionSpecializer::getSpecializationBonus(Argument *A, Constant *C,
   // good idea.
   int Bonus = 0;
   for (User *U : A->users()) {
     if (!isa<CallInst>(U) && !isa<InvokeInst>(U))
       continue;
     auto *CS = cast<CallBase>(U);
     if (CS->getCalledOperand() != A)
       continue;
+    if (CS->arg_size() != CalledFunction->arg_size())
+      continue;
 
     // Get the cost of inlining the called function at this call site. Note
     // that this is only an estimate. The called function may eventually
     // change in a way that leads to it not being inlined here, even though
     // inlining looks profitable now. For example, one of its called
     // functions may be inlined into it, making the called function too large
     // to be inlined into this call site.
     //

llvm/test/Transforms/FunctionSpecialization/compiler-crash-60191.ll

+; RUN: opt -S -mtriple=amdgcn-amd-amdhsa --passes="default<O3>" < %s
+
+define void @foo() {
+  call fastcc void @bar(ptr null, ptr null, i64 0, ptr addrspace(5) null, ptr addrspace(5) null, ptr null, ptr null, ptr null, ptr null, ptr null, ptr null)
+  call fastcc void @bar(ptr @func, ptr null, i64 0, ptr addrspace(5) null, ptr addrspace(5) null, ptr null, ptr null, ptr null, ptr null, ptr null, ptr null)
+  ret void
+}
+
+define internal fastcc void @bar(ptr %0, ptr %1, i64 %2, ptr addrspace(5) %3, ptr addrspace(5) %4, ptr %5, ptr %6, ptr %7, ptr %8, ptr %9, ptr %10) {
+  %12 = addrspacecast ptr addrspace(5) %3 to ptr
+  %13 = addrspacecast ptr addrspace(5) %4 to ptr
+  store i32 0, ptr addrspace(5) null, align 4
+  switch i64 %2, label %36 [
+    i64 1, label %14
+    i64 8, label %27
+    i64 0, label %20
+  ]
+
+common.ret:                                       ; preds = %36, %27, %20, %14
+  ret void
+
+14:                                               ; preds = %11
+  %15 = load ptr, ptr %1, align 8
+  %16 = load ptr, ptr %5, align 8
+  %17 = load ptr, ptr %0, align 8
+  %18 = load ptr, ptr null, align 8
+  %19 = load ptr, ptr %6, align 8
+  call void %0(ptr null, ptr null, ptr %15, ptr %16, ptr %17, ptr %18, ptr %19)
+  br label %common.ret
+
+20:                                               ; preds = %11
+  %21 = load ptr, ptr %1, align 8
+  %22 = load ptr, ptr %7, align 8
+  %23 = load ptr, ptr %6, align 8
+  %24 = load ptr, ptr %5, align 8
+  %25 = load ptr, ptr %0, align 8
+  %26 = load ptr, ptr null, align 8
+  call void %0(ptr %12, ptr %13, ptr %21, ptr %22, ptr %23, ptr %24, ptr %25, ptr %26)
+  br label %common.ret
+
+27:                                               ; preds = %11
+  %28 = load ptr, ptr %1, align 8
+  %29 = load ptr, ptr %9, align 8
+  %30 = load ptr, ptr %5, align 8
+  %31 = load ptr, ptr %6, align 8
+  %32 = load ptr, ptr %0, align 8
+  %33 = load ptr, ptr %7, align 8
+  %34 = load ptr, ptr null, align 8
+  %35 = load ptr, ptr %8, align 8
+  call void %0(ptr null, ptr null, ptr %28, ptr %29, ptr %30, ptr %31, ptr %32, ptr %33, ptr %34, ptr %35)
+  br label %common.ret
+
+36:                                               ; preds = %11
+  %37 = load ptr, ptr %1, align 8
+  %38 = load ptr, ptr %8, align 8
+  %39 = load ptr, ptr %5, align 8
+  %40 = load ptr, ptr %10, align 8
+  %41 = load ptr, ptr %7, align 8
+  %42 = load ptr, ptr %9, align 8
+  %43 = load ptr, ptr %0, align 8
+  %44 = load ptr, ptr null, align 8
+  %45 = load ptr, ptr %6, align 8
+  call void %0(ptr null, ptr null, ptr %37, ptr %38, ptr %39, ptr %40, ptr %41, ptr %42, ptr %43, ptr %44, ptr %45)
+  br label %common.ret
+}
+
+define internal void @func(ptr %0, ptr %1, ptr %2, ptr %3, ptr %4, ptr %5, ptr %6, ptr %7) {
+  ret void
+}
+