Clang-18 crash: Assertion `castIsValid(getOpcode(), S, Ty) && "Illegal ZExt"' failed.

[iamanonymouscs]

Clang-18 with -fsanitize=memory -fsanitize-memory-track-origins crashes on the test case.
Compiler explorer(assertion trunck): https://godbolt.org/z/d5dE46o1a

$cat mutant.c
#define d(b, c) b || b
#define aa(b, c) b || b
#define e(g, h, i, j, k, l) m(, g, 0, ) m(, g, h, ) m(, g, h, ) m(, g, 0, )
#define n(o, g, p, q, r)                                                       \
  if (d(__builtin_##g(p, q), ))                                                \
    if (__builtin_##g(p, q) || aa(__builtin_##g(p, q), ))
#define s(g, p, q, i, j, k, l, t, u, v, w, x, y, z, a, b, c, d, e)             \
  n(, g, 0, 0, ) n(, g, 0, q, ) n(, g, 0, 0, ) n(, g, 0, q, ) n(, g, p, q, )   \
      n(, g, p, 0, ) n(, g, p, q, ) n(, g, p, 0, ) n(, g, p, q, )
#define ab(b, c) b || b
#define m(o, g, h, r)                                                          \
  if (ab(__builtin_##g(h), ) || d(__builtin_##g(h), ))                         \
    if (d(__builtin_##g(h), ) || aa(__builtin_##g(h), ))                       \
      if (d(__builtin_##g(h), ) || aa(__builtin_##g(h), ))
#define ac(o, g, p, q, r)                                                      \
  if (ab(__builtin_##g(p, q), ) || d(__builtin_##g##f(p, q), ))                \
  d(__builtin_##g(p, q), ) || q
#define ad(g, p, q, i, j, k, l, t, u, v, w, x, y, z, a, b, c, d, e)            \
  ac(, g, 0, 0, );                                                             \
  ac(, g, 0, q, );                                                             \
  ac(, g, 0, 0, );                                                             \
  ac(, g, 0, q, );                                                             \
  ac(, g, p, q, );                                                             \
  ac(, g, p, q, )
void ae() {
  m(, cacos, 1, ) m(, cacos, 1, ) e(cacos, 2.34567F, , , , )
      e(casin, 2.34567F, , , , ) e(catan, 2.34567F, , , , ) m(, cacosh, 1, ) m(
          , cacosh, 1, ) e(cacosh, 2.34567F, , , , ) e(casinh, 2.34567F, , , , )
          e(catanh, 2.34567F, , , , ) e(csin, 2.34567F, , , , )
              e(ccos, 2.34567F, , , , ) e(ctan, 2.34567F, , , , )
                  e(csinh, 2.34567F, , , , ) e(ccosh, 2.34567F, , , , )
                      e(ctanh, 2.34567F, , , , ) m(, clog, 1, ) e(
                          clog, 2.34567F, , , , ) e(csqrt, 2.34567F, , , , )
                          s(cpow, 1, 0, , , , , , , , , , , , , , ,
                            , ) s(cpow, 1.F, 0, , , , , , , , , , , , , , , , )
                              ad(cpow, 2, 3, , , , , , , , , , , , , , , , );
  ad(cpow, 3, 4, , , , , , , , , , , , , , , , );
  ad(cpow, 3, 5, , , , , , , , , , , , , , , , );
  ad(cpow, 4, 2, , , , , , , , , , , , , , , , );
  ad(cpow, 1.5, 3, , , , , , , , , , , , , , , , );
  ac(, cpow, 2.34567F, 4.56789F, );
  ac(, cpow, 2.34567F, 4.56789F, );
  ac(, cpow, 2.34567F, 1.23456F, );
  ac(, cpow, 2.34567F, 1.23456F, );
}

$clang-18 -fsanitize=memory -fsanitize-memory-track-origins -w mutant.c
fatal error: error in backend: Cannot select: 0x55ba955f1090: i64,ch = load<(load (s64) from %ir.57880, align 4), zext from v2i32> 0x55ba955f0bc0, 0x55ba955ee670, undef:i64
  0x55ba955ee670: i64 = xor FrameIndex:i64<1379>, Constant:i64<87960930222080>
    0x55ba955f0680: i64 = FrameIndex<1379>
    0x55ba955ee6e0: i64 = Constant<87960930222080>
  0x55ba955f0990: i64 = undef
In function: ae
clang-18: error: clang frontend command failed with exit code 70 (use -v to see invocation)
Ubuntu clang version 18.0.0 (++20231018091808+48a53509e851-1~exp1~20231018091910.1571)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
clang-18: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-18: note: diagnostic msg: /tmp/mutant-532c87.c
clang-18: note: diagnostic msg: /tmp/mutant-532c87.sh
clang-18: note: diagnostic msg: 

********************

[llvmbot]

@llvm/issue-subscribers-backend-x86

Author: Anonymous (iamanonymouscs)

Clang-18 with -fsanitize=memory -fsanitize-memory-track-origins crashes on the test case. Compiler explorer(assertion trunck): https://godbolt.org/z/d5dE46o1a ``` $cat mutant.c #define d(b, c) b || b #define aa(b, c) b || b #define e(g, h, i, j, k, l) m(, g, 0, ) m(, g, h, ) m(, g, h, ) m(, g, 0, ) #define n(o, g, p, q, r) \ if (d(__builtin_##g(p, q), )) \ if (__builtin_##g(p, q) || aa(__builtin_##g(p, q), )) #define s(g, p, q, i, j, k, l, t, u, v, w, x, y, z, a, b, c, d, e) \ n(, g, 0, 0, ) n(, g, 0, q, ) n(, g, 0, 0, ) n(, g, 0, q, ) n(, g, p, q, ) \ n(, g, p, 0, ) n(, g, p, q, ) n(, g, p, 0, ) n(, g, p, q, ) #define ab(b, c) b || b #define m(o, g, h, r) \ if (ab(__builtin_##g(h), ) || d(__builtin_##g(h), )) \ if (d(__builtin_##g(h), ) || aa(__builtin_##g(h), )) \ if (d(__builtin_##g(h), ) || aa(__builtin_##g(h), )) #define ac(o, g, p, q, r) \ if (ab(__builtin_##g(p, q), ) || d(__builtin_##g##f(p, q), )) \ d(__builtin_##g(p, q), ) || q #define ad(g, p, q, i, j, k, l, t, u, v, w, x, y, z, a, b, c, d, e) \ ac(, g, 0, 0, ); \ ac(, g, 0, q, ); \ ac(, g, 0, 0, ); \ ac(, g, 0, q, ); \ ac(, g, p, q, ); \ ac(, g, p, q, ) void ae() { m(, cacos, 1, ) m(, cacos, 1, ) e(cacos, 2.34567F, , , , ) e(casin, 2.34567F, , , , ) e(catan, 2.34567F, , , , ) m(, cacosh, 1, ) m( , cacosh, 1, ) e(cacosh, 2.34567F, , , , ) e(casinh, 2.34567F, , , , ) e(catanh, 2.34567F, , , , ) e(csin, 2.34567F, , , , ) e(ccos, 2.34567F, , , , ) e(ctan, 2.34567F, , , , ) e(csinh, 2.34567F, , , , ) e(ccosh, 2.34567F, , , , ) e(ctanh, 2.34567F, , , , ) m(, clog, 1, ) e( clog, 2.34567F, , , , ) e(csqrt, 2.34567F, , , , ) s(cpow, 1, 0, , , , , , , , , , , , , , , , ) s(cpow, 1.F, 0, , , , , , , , , , , , , , , , ) ad(cpow, 2, 3, , , , , , , , , , , , , , , , ); ad(cpow, 3, 4, , , , , , , , , , , , , , , , ); ad(cpow, 3, 5, , , , , , , , , , , , , , , , ); ad(cpow, 4, 2, , , , , , , , , , , , , , , , ); ad(cpow, 1.5, 3, , , , , , , , , , , , , , , , ); ac(, cpow, 2.34567F, 4.56789F, ); ac(, cpow, 2.34567F, 4.56789F, ); ac(, cpow, 2.34567F, 1.23456F, ); ac(, cpow, 2.34567F, 1.23456F, ); }

$clang-18 -fsanitize=memory -fsanitize-memory-track-origins -w mutant.c
fatal error: error in backend: Cannot select: 0x55ba955f1090: i64,ch = load<(load (s64) from %ir.57880, align 4), zext from v2i32> 0x55ba955f0bc0, 0x55ba955ee670, undef:i64
0x55ba955ee670: i64 = xor FrameIndex:i64<1379>, Constant:i64<87960930222080>
0x55ba955f0680: i64 = FrameIndex<1379>
0x55ba955ee6e0: i64 = Constant<87960930222080>
0x55ba955f0990: i64 = undef
In function: ae
clang-18: error: clang frontend command failed with exit code 70 (use -v to see invocation)
Ubuntu clang version 18.0.0 (++20231018091808+48a53509e851-1exp120231018091910.1571)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
clang-18: note: diagnostic msg:

---

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-18: note: diagnostic msg: /tmp/mutant-532c87.c
clang-18: note: diagnostic msg: /tmp/mutant-532c87.sh
clang-18: note: diagnostic msg:

---

</details>

[llvmbot]

@llvm/issue-subscribers-clang-frontend

Author: Anonymous (iamanonymouscs)

Clang-18 with -fsanitize=memory -fsanitize-memory-track-origins crashes on the test case. Compiler explorer(assertion trunck): https://godbolt.org/z/d5dE46o1a ``` $cat mutant.c #define d(b, c) b || b #define aa(b, c) b || b #define e(g, h, i, j, k, l) m(, g, 0, ) m(, g, h, ) m(, g, h, ) m(, g, 0, ) #define n(o, g, p, q, r) \ if (d(__builtin_##g(p, q), )) \ if (__builtin_##g(p, q) || aa(__builtin_##g(p, q), )) #define s(g, p, q, i, j, k, l, t, u, v, w, x, y, z, a, b, c, d, e) \ n(, g, 0, 0, ) n(, g, 0, q, ) n(, g, 0, 0, ) n(, g, 0, q, ) n(, g, p, q, ) \ n(, g, p, 0, ) n(, g, p, q, ) n(, g, p, 0, ) n(, g, p, q, ) #define ab(b, c) b || b #define m(o, g, h, r) \ if (ab(__builtin_##g(h), ) || d(__builtin_##g(h), )) \ if (d(__builtin_##g(h), ) || aa(__builtin_##g(h), )) \ if (d(__builtin_##g(h), ) || aa(__builtin_##g(h), )) #define ac(o, g, p, q, r) \ if (ab(__builtin_##g(p, q), ) || d(__builtin_##g##f(p, q), )) \ d(__builtin_##g(p, q), ) || q #define ad(g, p, q, i, j, k, l, t, u, v, w, x, y, z, a, b, c, d, e) \ ac(, g, 0, 0, ); \ ac(, g, 0, q, ); \ ac(, g, 0, 0, ); \ ac(, g, 0, q, ); \ ac(, g, p, q, ); \ ac(, g, p, q, ) void ae() { m(, cacos, 1, ) m(, cacos, 1, ) e(cacos, 2.34567F, , , , ) e(casin, 2.34567F, , , , ) e(catan, 2.34567F, , , , ) m(, cacosh, 1, ) m( , cacosh, 1, ) e(cacosh, 2.34567F, , , , ) e(casinh, 2.34567F, , , , ) e(catanh, 2.34567F, , , , ) e(csin, 2.34567F, , , , ) e(ccos, 2.34567F, , , , ) e(ctan, 2.34567F, , , , ) e(csinh, 2.34567F, , , , ) e(ccosh, 2.34567F, , , , ) e(ctanh, 2.34567F, , , , ) m(, clog, 1, ) e( clog, 2.34567F, , , , ) e(csqrt, 2.34567F, , , , ) s(cpow, 1, 0, , , , , , , , , , , , , , , , ) s(cpow, 1.F, 0, , , , , , , , , , , , , , , , ) ad(cpow, 2, 3, , , , , , , , , , , , , , , , ); ad(cpow, 3, 4, , , , , , , , , , , , , , , , ); ad(cpow, 3, 5, , , , , , , , , , , , , , , , ); ad(cpow, 4, 2, , , , , , , , , , , , , , , , ); ad(cpow, 1.5, 3, , , , , , , , , , , , , , , , ); ac(, cpow, 2.34567F, 4.56789F, ); ac(, cpow, 2.34567F, 4.56789F, ); ac(, cpow, 2.34567F, 1.23456F, ); ac(, cpow, 2.34567F, 1.23456F, ); }

$clang-18 -fsanitize=memory -fsanitize-memory-track-origins -w mutant.c
fatal error: error in backend: Cannot select: 0x55ba955f1090: i64,ch = load<(load (s64) from %ir.57880, align 4), zext from v2i32> 0x55ba955f0bc0, 0x55ba955ee670, undef:i64
0x55ba955ee670: i64 = xor FrameIndex:i64<1379>, Constant:i64<87960930222080>
0x55ba955f0680: i64 = FrameIndex<1379>
0x55ba955ee6e0: i64 = Constant<87960930222080>
0x55ba955f0990: i64 = undef
In function: ae
clang-18: error: clang frontend command failed with exit code 70 (use -v to see invocation)
Ubuntu clang version 18.0.0 (++20231018091808+48a53509e851-1exp120231018091910.1571)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
clang-18: note: diagnostic msg:

---

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-18: note: diagnostic msg: /tmp/mutant-532c87.c
clang-18: note: diagnostic msg: /tmp/mutant-532c87.sh
clang-18: note: diagnostic msg:

---

</details>

[RKSimon]

AFAICT this isn't a backend issue:

clang: /home/simon/LLVM/llvm-project/llvm/lib/IR/Instructions.cpp:3832: llvm::ZExtInst::ZExtInst(llvm::Value*, llvm::Type*, const llvm::Twine&, llvm::Instruction*): Assertion `castIsValid(getOpcode(), S, Ty) && "Illegal ZExt"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: clang -fsanitize=memory -fsanitize-memory-track-origins bug.c -c -S -emit-llvm -o bug.ll
1.      <eof> parser at end of file
2.      Optimizer
 #0 0x000055e0448eb26c llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/simon/LLVM/llvm-project/llvm/lib/Support/Unix/Signals.inc:727:3
 #1 0x000055e0448e8d04 llvm::sys::RunSignalHandlers() /home/simon/LLVM/llvm-project/llvm/lib/Support/Signals.cpp:105:20
 #2 0x000055e0448e97e8 llvm::sys::CleanupOnSignal(unsigned long) /home/simon/LLVM/llvm-project/llvm/lib/Support/Unix/Signals.inc:367:31
 #3 0x000055e0448459d8 HandleCrash /home/simon/LLVM/llvm-project/llvm/lib/Support/CrashRecoveryContext.cpp:71:27
 #4 0x000055e0448459d8 CrashRecoverySignalHandler(int) /home/simon/LLVM/llvm-project/llvm/lib/Support/CrashRecoveryContext.cpp:390:62
 #5 0x00007fc85219d420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #6 0x00007fc851c6a00b raise /build/glibc-wuryBv/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
 #7 0x00007fc851c49859 abort /build/glibc-wuryBv/glibc-2.31/stdlib/abort.c:81:7
 #8 0x00007fc851c49729 get_sysdep_segment_value /build/glibc-wuryBv/glibc-2.31/intl/loadmsgcat.c:509:8
 #9 0x00007fc851c49729 _nl_load_domain /build/glibc-wuryBv/glibc-2.31/intl/loadmsgcat.c:970:34
#10 0x00007fc851c5afd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
#11 0x000055e044283c94 (/home/simon/LLVM/stage1/bin/clang-17+0x3637c94)
#12 0x000055e041fc2dc0 llvm::ZExtInst* llvm::IRBuilderBase::Insert<llvm::ZExtInst>(llvm::ZExtInst*, llvm::Twine const&) const /home/simon/LLVM/llvm-project/llvm/include/llvm/IR/IRBuilder.h:146:0
#13 0x000055e041fc2dc0 llvm::IRBuilderBase::CreateZExt(llvm::Value*, llvm::Type*, llvm::Twine const&, bool) /home/simon/LLVM/llvm-project/llvm/include/llvm/IR/IRBuilder.h:2006:0
#14 0x000055e041fc2dc0 llvm::IRBuilderBase::CreateZExt(llvm::Value*, llvm::Type*, llvm::Twine const&, bool) /home/simon/LLVM/llvm-project/llvm/include/llvm/IR/IRBuilder.h:2000:0
#15 0x000055e045ec06bb materializeOneCheck /home/simon/LLVM/llvm-project/llvm/lib/Transforms/Instrumentation/MemorySanitizer.cpp:1397:36
#16 0x000055e045ec06bb materializeInstructionChecks /home/simon/LLVM/llvm-project/llvm/lib/Transforms/Instrumentation/MemorySanitizer.cpp:1445:28
#17 0x000055e045ec06bb materializeChecks /home/simon/LLVM/llvm-project/llvm/lib/Transforms/Instrumentation/MemorySanitizer.cpp:1481:35

[nikic]

https://gist.github.com/nikic/3a68e1f03a9577de1b3fcd6e08e91256 is the input IR for -passes='msan<eager-checks;track-origins=1>'. Wasn't able to automatically reduce.