WASM crash when using __funcref

[glingy]

I'm attempting to instantiate a call_indirect to a specific table, and I believe this is the correct construct, but I am getting a clang crash.

typedef void (*__funcref fn)(void);
extern "C" fn table[1];

void foo() { table[1](); }

Reproduction on Godbolt here: https://godbolt.org/z/c3nc59MWz

Backtrace:

fatal error: error in backend: Cannot select: 0x19f4fbc8: funcref,ch = load<(load (s0) from `ptr getelementptr inbounds ([1 x ptr addrspace(20)], ptr @table, i32 0, i32 1)`)> 0x19f16670, 0x19f4fa60, undef:i32, example.cpp:4:14
  0x19f4fa60: i32 = add nuw 0x19f4fd30, Constant:i32<1>, example.cpp:4:14
    0x19f4fd30: i32 = WebAssemblyISD::Wrapper TargetGlobalAddress:i32<ptr @table> 0, example.cpp:4:14
      0x19f4fad8: i32 = TargetGlobalAddress<ptr @table> 0, example.cpp:4:14
    0x19f4f9e8: i32 = Constant<1>
  0x19f4fb50: i32 = undef
In function: _Z3foov
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-trunk/bin/clang++ -g -o /app/output.s -fno-verbose-asm -S -target wasm32 -fcolor-diagnostics -fno-crash-diagnostics <source>
1.	<eof> parser at end of file
2.	Code generation
3.	Running pass 'Function Pass Manager' on module '<source>'.
4.	Running pass 'WebAssembly Instruction Selection' on function '@_Z3foov'
 #0 0x0000000003c65448 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3c65448)
 #1 0x0000000003c6358c llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3c6358c)
 #2 0x0000000003bb4273 llvm::CrashRecoveryContext::HandleExit(int) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3bb4273)
 #3 0x0000000003c5b09e llvm::sys::Process::Exit(int, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3c5b09e)
 #4 0x0000000000dbd4fb LLVMErrorHandler(void*, char const*, bool) cc1_main.cpp:0:0
 #5 0x0000000003bbe0a3 llvm::report_fatal_error(llvm::Twine const&, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3bbe0a3)
 #6 0x000000000521c288 llvm::SelectionDAGISel::CannotYetSelect(llvm::SDNode*) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x521c288)
 #7 0x00000000052225f9 llvm::SelectionDAGISel::SelectCodeCommon(llvm::SDNode*, unsigned char const*, unsigned int) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x52225f9)
 #8 0x00000000025cf86f (anonymous namespace)::WebAssemblyDAGToDAGISel::Select(llvm::SDNode*) WebAssemblyISelDAGToDAG.cpp:0:0
 #9 0x0000000005219774 llvm::SelectionDAGISel::DoInstructionSelection() (/opt/compiler-explorer/clang-trunk/bin/clang+++0x5219774)
#10 0x0000000005228272 llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/opt/compiler-explorer/clang-trunk/bin/clang+++0x5228272)
#11 0x000000000522abea llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x522abea)
#12 0x000000000522cac6 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x522cac6)
#13 0x00000000052192f1 llvm::SelectionDAGISelLegacy::runOnMachineFunction(llvm::MachineFunction&) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x52192f1)
#14 0x000000000305c428 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#15 0x00000000035d1d92 llvm::FPPassManager::runOnFunction(llvm::Function&) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x35d1d92)
#16 0x00000000035d2021 llvm::FPPassManager::runOnModule(llvm::Module&) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x35d2021)
#17 0x00000000035d3989 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x35d3989)
#18 0x0000000003f170cd clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3f170cd)
#19 0x00000000045ae945 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x45ae945)
#20 0x00000000061fe3ac clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x61fe3ac)
#21 0x00000000045af4fd clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-trunk/bin/clang+++0x45af4fd)
#22 0x00000000048bf53a clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-trunk/bin/clang+++0x48bf53a)
#23 0x000000000483c22b clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x483c22b)
#24 0x00000000049b5293 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x49b5293)
#25 0x0000000000dbf432 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-trunk/bin/clang+++0xdbf432)
#26 0x0000000000db6d8d ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#27 0x0000000004621c59 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#28 0x0000000003bb4173 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3bb4173)
#29 0x0000000004621e79 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#30 0x00000000045e4c7d clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-trunk/bin/clang+++0x45e4c7d)
#31 0x00000000045e5c41 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-trunk/bin/clang+++0x45e5c41)
#32 0x00000000045f041c clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x45f041c)
#33 0x0000000000dbb981 clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-trunk/bin/clang+++0xdbb981)
#34 0x0000000000c3caf4 main (/opt/compiler-explorer/clang-trunk/bin/clang+++0xc3caf4)
#35 0x00007f9bad229d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#36 0x00007f9bad229e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#37 0x0000000000db6825 _start (/opt/compiler-explorer/clang-trunk/bin/clang+++0xdb6825)
clang++: error: clang frontend command failed with exit code 70 (use -v to see invocation)
Compiler returned: 70

[llvmbot]

@llvm/issue-subscribers-backend-webassembly

Author: Gregory Ling (glingy)

I'm attempting to instantiate a `call_indirect` to a specific table, and I believe this is the correct construct, but I am getting a clang crash.

typedef void (*__funcref fn)(void);
extern "C" fn table[1];

void foo() { table[1](); }

Reproduction on Godbolt here: https://godbolt.org/z/c3nc59MWz

Backtrace:

fatal error: error in backend: Cannot select: 0x19f4fbc8: funcref,ch = load&lt;(load (s0) from `ptr getelementptr inbounds ([1 x ptr addrspace(20)], ptr @<!-- -->table, i32 0, i32 1)`)&gt; 0x19f16670, 0x19f4fa60, undef:i32, example.cpp:4:14
  0x19f4fa60: i32 = add nuw 0x19f4fd30, Constant:i32&lt;1&gt;, example.cpp:4:14
    0x19f4fd30: i32 = WebAssemblyISD::Wrapper TargetGlobalAddress:i32&lt;ptr @<!-- -->table&gt; 0, example.cpp:4:14
      0x19f4fad8: i32 = TargetGlobalAddress&lt;ptr @<!-- -->table&gt; 0, example.cpp:4:14
    0x19f4f9e8: i32 = Constant&lt;1&gt;
  0x19f4fb50: i32 = undef
In function: _Z3foov
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-trunk/bin/clang++ -g -o /app/output.s -fno-verbose-asm -S -target wasm32 -fcolor-diagnostics -fno-crash-diagnostics &lt;source&gt;
1.	&lt;eof&gt; parser at end of file
2.	Code generation
3.	Running pass 'Function Pass Manager' on module '&lt;source&gt;'.
4.	Running pass 'WebAssembly Instruction Selection' on function '@<!-- -->_Z3foov'
 #<!-- -->0 0x0000000003c65448 llvm::sys::PrintStackTrace(llvm::raw_ostream&amp;, int) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3c65448)
 #<!-- -->1 0x0000000003c6358c llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3c6358c)
 #<!-- -->2 0x0000000003bb4273 llvm::CrashRecoveryContext::HandleExit(int) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3bb4273)
 #<!-- -->3 0x0000000003c5b09e llvm::sys::Process::Exit(int, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3c5b09e)
 #<!-- -->4 0x0000000000dbd4fb LLVMErrorHandler(void*, char const*, bool) cc1_main.cpp:0:0
 #<!-- -->5 0x0000000003bbe0a3 llvm::report_fatal_error(llvm::Twine const&amp;, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3bbe0a3)
 #<!-- -->6 0x000000000521c288 llvm::SelectionDAGISel::CannotYetSelect(llvm::SDNode*) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x521c288)
 #<!-- -->7 0x00000000052225f9 llvm::SelectionDAGISel::SelectCodeCommon(llvm::SDNode*, unsigned char const*, unsigned int) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x52225f9)
 #<!-- -->8 0x00000000025cf86f (anonymous namespace)::WebAssemblyDAGToDAGISel::Select(llvm::SDNode*) WebAssemblyISelDAGToDAG.cpp:0:0
 #<!-- -->9 0x0000000005219774 llvm::SelectionDAGISel::DoInstructionSelection() (/opt/compiler-explorer/clang-trunk/bin/clang+++0x5219774)
#<!-- -->10 0x0000000005228272 llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/opt/compiler-explorer/clang-trunk/bin/clang+++0x5228272)
#<!-- -->11 0x000000000522abea llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&amp;) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x522abea)
#<!-- -->12 0x000000000522cac6 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&amp;) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x522cac6)
#<!-- -->13 0x00000000052192f1 llvm::SelectionDAGISelLegacy::runOnMachineFunction(llvm::MachineFunction&amp;) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x52192f1)
#<!-- -->14 0x000000000305c428 llvm::MachineFunctionPass::runOnFunction(llvm::Function&amp;) (.part.0) MachineFunctionPass.cpp:0:0
#<!-- -->15 0x00000000035d1d92 llvm::FPPassManager::runOnFunction(llvm::Function&amp;) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x35d1d92)
#<!-- -->16 0x00000000035d2021 llvm::FPPassManager::runOnModule(llvm::Module&amp;) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x35d2021)
#<!-- -->17 0x00000000035d3989 llvm::legacy::PassManagerImpl::run(llvm::Module&amp;) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x35d3989)
#<!-- -->18 0x0000000003f170cd clang::emitBackendOutput(clang::CompilerInstance&amp;, clang::CodeGenOptions&amp;, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr&lt;llvm::vfs::FileSystem&gt;, std::unique_ptr&lt;llvm::raw_pwrite_stream, std::default_delete&lt;llvm::raw_pwrite_stream&gt;&gt;, clang::BackendConsumer*) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3f170cd)
#<!-- -->19 0x00000000045ae945 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&amp;) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x45ae945)
#<!-- -->20 0x00000000061fe3ac clang::ParseAST(clang::Sema&amp;, bool, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x61fe3ac)
#<!-- -->21 0x00000000045af4fd clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-trunk/bin/clang+++0x45af4fd)
#<!-- -->22 0x00000000048bf53a clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-trunk/bin/clang+++0x48bf53a)
#<!-- -->23 0x000000000483c22b clang::CompilerInstance::ExecuteAction(clang::FrontendAction&amp;) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x483c22b)
#<!-- -->24 0x00000000049b5293 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x49b5293)
#<!-- -->25 0x0000000000dbf432 cc1_main(llvm::ArrayRef&lt;char const*&gt;, char const*, void*) (/opt/compiler-explorer/clang-trunk/bin/clang+++0xdbf432)
#<!-- -->26 0x0000000000db6d8d ExecuteCC1Tool(llvm::SmallVectorImpl&lt;char const*&gt;&amp;, llvm::ToolContext const&amp;) driver.cpp:0:0
#<!-- -->27 0x0000000004621c59 void llvm::function_ref&lt;void ()&gt;::callback_fn&lt;clang::driver::CC1Command::Execute(llvm::ArrayRef&lt;std::optional&lt;llvm::StringRef&gt;&gt;, std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt;&gt;*, bool*) const::'lambda'()&gt;(long) Job.cpp:0:0
#<!-- -->28 0x0000000003bb4173 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref&lt;void ()&gt;) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x3bb4173)
#<!-- -->29 0x0000000004621e79 clang::driver::CC1Command::Execute(llvm::ArrayRef&lt;std::optional&lt;llvm::StringRef&gt;&gt;, std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt;&gt;*, bool*) const (.part.0) Job.cpp:0:0
#<!-- -->30 0x00000000045e4c7d clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&amp;, clang::driver::Command const*&amp;, bool) const (/opt/compiler-explorer/clang-trunk/bin/clang+++0x45e4c7d)
#<!-- -->31 0x00000000045e5c41 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&amp;, llvm::SmallVectorImpl&lt;std::pair&lt;int, clang::driver::Command const*&gt;&gt;&amp;, bool) const (/opt/compiler-explorer/clang-trunk/bin/clang+++0x45e5c41)
#<!-- -->32 0x00000000045f041c clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&amp;, llvm::SmallVectorImpl&lt;std::pair&lt;int, clang::driver::Command const*&gt;&gt;&amp;) (/opt/compiler-explorer/clang-trunk/bin/clang+++0x45f041c)
#<!-- -->33 0x0000000000dbb981 clang_main(int, char**, llvm::ToolContext const&amp;) (/opt/compiler-explorer/clang-trunk/bin/clang+++0xdbb981)
#<!-- -->34 0x0000000000c3caf4 main (/opt/compiler-explorer/clang-trunk/bin/clang+++0xc3caf4)
#<!-- -->35 0x00007f9bad229d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#<!-- -->36 0x00007f9bad229e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#<!-- -->37 0x0000000000db6825 _start (/opt/compiler-explorer/clang-trunk/bin/clang+++0xdb6825)
clang++: error: clang frontend command failed with exit code 70 (use -v to see invocation)
Compiler returned: 70

[woruyu]

I took a quick look at the code and found that the problem occurred in the instruction selection of llvm's llc backend, which is this one: %1 = load ptr addrspace(20), ptr getelementptr inbounds nuw (i8, ptr @table, i32 1), align 4, !tbaa !2, looks interesting！
By the way, you can delete __funcref, which remove addrspace(20) for global var in llvm ir, to compile successfully

[woruyu]

Hello, this is the details about this problem, the key pointer is that there is no load pattern for funcref type, which is created by addressSpace 20.

; ModuleID = 'test.cpp'
source_filename = "test.cpp"
target datalayout = "e-m:e-p:32:32-p10:8:8-p20:8:8-i64:64-i128:128-n32:64-S128-ni:1:10:20"
target triple = "wasm32-unknown-unknown"

@table = external global [1 x ptr addrspace(20)], align 4

; Function Attrs: mustprogress noinline optnone
define hidden void @_Z3foov() #0 {
entry:
  %0 = load ptr addrspace(20), ptr getelementptr inbounds ([1 x ptr addrspace(20)], ptr @table, i32 0, i32 1), align 4
  call addrspace(20) void %0()
  ret void
}

attributes #0 = { mustprogress noinline optnone "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="generic" "target-features"="+bulk-memory,+bulk-memory-opt,+call-indirect-overlong,+multivalue,+mutable-globals,+nontrapping-fptoint,+reference-types,+sign-ext" }

!llvm.module.flags = !{!0}
!llvm.ident = !{!1}

if you delete __funcref, the IR looks like this

@table = external global [1 x ptr], align 4

; Function Attrs: mustprogress noinline optnone
define hidden void @_Z3foov() #0 {
entry:
  %0 = load ptr, ptr getelementptr inbounds ([1 x ptr], ptr @table, i32 0, i32 1), align 4
  call void %0()
  ret void
}

So, lets go on, in lowering to DAG, there are two strange things caused by addrspace(20), they all happen during the Lowering process of load ir，the DAG likes this

the first thing is global address offset is const 1(in my understanding it should be 4), the culprit is DataLayout::getPointerSpec(uint32_t AddrSpace) this function.

const DataLayout::PointerSpec &
DataLayout::getPointerSpec(uint32_t AddrSpace) const {
  if (AddrSpace != 0) {
    auto I = lower_bound(PointerSpecs, AddrSpace, LessPointerAddrSpace());
    if (I != PointerSpecs.end() && I->AddrSpace == AddrSpace)
      return *I;
  }

  assert(PointerSpecs[0].AddrSpace == 0);
  return PointerSpecs[0];
}

the second thing is load result type, it's created by getPointerTy func.

MVT WebAssemblyTargetLowering::getPointerTy(const DataLayout &DL,
                                            uint32_t AS) const {
  if (AS == WebAssembly::WasmAddressSpace::WASM_ADDRESS_SPACE_EXTERNREF)
    return MVT::externref;
  if (AS == WebAssembly::WasmAddressSpace::WASM_ADDRESS_SPACE_FUNCREF)
    return MVT::funcref;
  return TargetLowering::getPointerTy(DL, AS);
}

In short, I have found all reason about this problem, but for the best Solution，I think we should ask the webassembly backend mentener, maybe add a pattern or modify load lowring codes?

[woruyu]

Can someone give me some advice? I hope I can fixed this bug.

[dschuff]

@pmatos might be able to give some advice.