Crash in SLP-Vectorizer

[Nirhar]

The Crash in SLP Vectorizer can be seen here: https://godbolt.org/z/1MMaYrxfx .

I believe the crash occurs because of Unhandled check for std::nullopt, as reported here: #121489
And the std::nullopt was returned by getPointersDiff because of #121796.

For the record, here is the IR:

target triple = "x86_64-unknown-linux-gnu"

define ptr addrspace(1) @widget(i32 %arg) {
bb:
  %zext = zext i32 0 to i64
  %zext1 = zext i32 %arg to i64
  br label %bb12

bb2:                                              ; preds = %bb12
  br i1 false, label %bb3, label %bb14

bb3:                                              ; preds = %bb2
  %getelementptr = getelementptr float, ptr addrspace(1) null, i64 %phi
  %load = load float, ptr addrspace(1) %getelementptr, align 4
  %getelementptr4 = getelementptr float, ptr addrspace(1) null, i64 %add13
  %load5 = load float, ptr addrspace(1) %getelementptr4, align 4
  %fadd = fadd float %load, %load5
  store float %fadd, ptr addrspace(1) null, align 4
  br label %bb6

bb6:                                              ; preds = %bb3
  %add = add i64 %phi, 1
  %icmp = icmp ult i64 %phi, %zext1
  %add7 = add i64 0, 0
  %icmp8 = icmp ult i64 0, %zext
  br i1 %icmp, label %bb9, label %bb14

bb9:                                              ; preds = %bb6
  %getelementptr10 = getelementptr float, ptr addrspace(1) null, i64 %add
  %getelementptr11 = getelementptr i32, ptr addrspace(1) null, i64 %add7
  br label %bb12

bb12:                                             ; preds = %bb9, %bb
  %phi = phi i64 [ 0, %bb ], [ %add, %bb9 ]
  %add13 = add i64 %phi, 1
  br label %bb2

bb14:                                             ; preds = %bb6, %bb2
  ret ptr addrspace(1) null
}

that crashes with opt -passes=slp-vectorizer -slp-threshold=99999 :

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=slp-vectorizer -slp-threshold=-99999 <source>
1.	Running pass "function(slp-vectorizer)" on module "<source>"
2.	Running pass "slp-vectorizer" on function "widget"
 #0 0x00000000052656f8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x52656f8)
 #1 0x00000000052630fc SignalHandler(int) Signals.cpp:0:0
 #2 0x000074d097e42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x000074d097e969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x000074d097e42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x000074d097e287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x000000000092d5d2 (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x92d5d2)
 #7 0x00000000042b8f1b llvm::slpvectorizer::BoUpSLP::canVectorizeLoads(llvm::ArrayRef<llvm::Value*>, llvm::Value const*, llvm::SmallVectorImpl<unsigned int>&, llvm::SmallVectorImpl<llvm::Value*>&, unsigned int*, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x42b8f1b)
 #8 0x00000000042e164e llvm::slpvectorizer::BoUpSLP::buildTree_rec(llvm::ArrayRef<llvm::Value*>, unsigned int, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&, unsigned int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x42e164e)
 #9 0x0000000004310069 llvm::SLPVectorizerPass::tryToVectorizeList(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP&, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4310069)
#10 0x00000000043130c8 llvm::SLPVectorizerPass::tryToVectorize(llvm::Instruction*, llvm::slpvectorizer::BoUpSLP&) (.part.0) SLPVectorizer.cpp:0:0
#11 0x00000000043133fe llvm::SLPVectorizerPass::tryToVectorize(llvm::ArrayRef<llvm::WeakTrackingVH>, llvm::slpvectorizer::BoUpSLP&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x43133fe)
#12 0x0000000004313ad0 llvm::SLPVectorizerPass::vectorizeRootInstruction(llvm::PHINode*, llvm::Instruction*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (.constprop.0) SLPVectorizer.cpp:0:0
#13 0x0000000004318636 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4318636)
#14 0x000000000431ebf6 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (.part.0) SLPVectorizer.cpp:0:0
#15 0x000000000431f72b llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x431f72b)
#16 0x000000000302ca5e llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x302ca5e)
#17 0x0000000005063490 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5063490)
#18 0x0000000000e6b0be llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe6b0be)
#19 0x0000000005061dab llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5061dab)
#20 0x0000000000e6a74e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe6a74e)
#21 0x00000000050617b0 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x50617b0)
#22 0x000000000094241a llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x94241a)
#23 0x00000000009349b9 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x9349b9)
#24 0x000074d097e29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#25 0x000074d097e29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#26 0x000000000092c295 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x92c295)
Program terminated with signal: SIGSEGV
Compiler returned: 139

[alexey-bataev]

It's not the SLP vectorizer issue; the problem is that SCEV analysis is unstable here. This crash just allows us to catch it.

[Nirhar]

I think this is still an issue in SLP Vectorizer, but just not #121489 . Reason being, SLP Vectorizer has produced instructions that are not SCEVable, but still wants to calculate its SCEV.

[alexey-bataev]

I think this is still an issue in SLP Vectorizer, but just not #121489 . Reason being, SLP Vectorizer has produced instructions that are not SCEVable, but still wants to calculate its SCEV.

No, the problem is that getSCEV returns different results for the same pointer.

[nikic]

@alexey-bataev Could you explain what invariant SLP expects here? Is SLP expecting that the SCEV remains the same after performing an arbitrary (but semantics-preserving) transform? That cannot be guaranteed.