SIMD [iu]8xN tests SIGILL in --release

[workingjubilee]

Hello, we have encountered an issue in the portable-simd CI unique to tests on our i8xN and u8xN types on x86_64. It emits a SIGTRAP, or sometimes a SIGILL, or on Windows, a STATUS_ACCESS_VIOLATION! How exciting! I can reproduce this locally. Our other tests do not do this, and it only happens in --release, so I suspect this is a miscompilation by LLVM 13 inappropriately optimizing something. Full command to repro: cargo test --release --test [iu]8_ops

I am going to try to minimize this from "literally the entire test suite" but I might take a bit. The issue became apparent about 7 days ago. Tests were passing about 2030 days ago (August 818) judging by the last green in rust-lang/portable-simd#155. I believe the time frame is correct for this to have been due to #87570

More minutiae

RUSTFLAGS="-Copt-level=1" passes with the above tests.
RUSTFLAGS="-Copt-level=2" crashes with them.

Version it worked on

It most recently worked on: Rust 1.56 nightly (2021-07-17)

Version with regression

rustc --version --verbose:

rustc 1.57.0-nightly (fdf65053e 2021-09-07)
binary: rustc
commit-hash: fdf65053e99e8966f9bd83b5a8491326cb33d638
commit-date: 2021-09-07
host: x86_64-pc-windows-msvc
release: 1.57.0-nightly
LLVM version: 13.0.0

but it also happened on rustc 1.57.0-nightly 2021-09-01

Sample Crash

Caused by:
process didn't exit successfully: rustc --crate-name i8_ops --edition=2018 crates/core_simd/tests/i8_ops.rs --error-format=json --json=diagnostic-rendered-ansi --emit=dep-info,link -C opt-level=3 -C embed-bitcode=no --test --cfg 'feature="default"' --cfg 'feature="generic_const_exprs"' --cfg 'feature="std"' -C metadata=1cde5fc9e82e90f1 -C extra-filename=-1cde5fc9e82e90f1 --out-dir /home/runner/work/portable-simd/portable-simd/target/x86_64-unknown-linux-gnu/release/deps --target x86_64-unknown-linux-gnu -L dependency=/home/runner/work/portable-simd/portable-simd/target/x86_64-unknown-linux-gnu/release/deps -L dependency=/home/runner/work/portable-simd/portable-simd/target/release/deps --extern core_simd=/home/runner/work/portable-simd/portable-simd/target/x86_64-unknown-linux-gnu/release/deps/libcore_simd-4b00e5b4ae8d8fde.rlib --extern proptest=/home/runner/work/portable-simd/portable-simd/target/x86_64-unknown-linux-gnu/release/deps/libproptest-31d0a88e0e450c3e.rlib --extern test_helpers=/home/runner/work/portable-simd/portable-simd/target/x86_64-unknown-linux-gnu/release/deps/libtest_helpers-14b4f1f175a370d0.rlib --extern wasm_bindgen_test=/home/runner/work/portable-simd/portable-simd/target/x86_64-unknown-linux-gnu/release/deps/libwasm_bindgen_test-52095b4799b0069f.rlib (signal: 5, SIGTRAP: trace/breakpoint trap)
warning: build failed, waiting for other jobs to finish...

[hellow554]

During my reduction, this nice error popped up which is, at least I think so, the real error message behind this ICE:

error[E0511]: invalid monomorphization of `simd_reduce_mul_ordered` intrinsic: expected return type `i8` (element of input `Simd<i8, 16_usize>`), found `i32`
  --> src\main.rs:37:26
   |
37 |         let a = unsafe { crate::simd_reduce_mul_ordered(crate::Simd::<i8, 16>::from_array(x), 1) };
   |                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

I post my code in ~10 Minutes, after cleaning it up

[hellow554]

This ICE is very fragile, even removing the biteq mod makes that this ICE will not appear anymore... Anyway, here it is:

#![feature(platform_intrinsics, repr_simd)]

extern "platform-intrinsic" {
    pub(crate) fn simd_reduce_mul_ordered<T, U>(x: T, y: U) -> U;
}

#[repr(simd)]
pub struct Simd<T, const LANES: usize>([T; LANES]);

impl<T, const LANES: usize> Simd<T, LANES> {
    pub fn new(array: [T; LANES]) -> Self {
        Self(array)
    }
}

mod biteq {
    pub trait BitEq {
        fn biteq(&self, other: &Self) -> bool;
    }
    impl BitEq for i8 {
        fn biteq(&self, _: &Self) -> bool {
            false
        }
    }

    pub struct BitEqWrapper<T>(pub T);
    impl<T: BitEq> PartialEq for BitEqWrapper<T> {
        fn eq(&self, _: &Self) -> bool {
            false
        }
    }
}

fn main() {
    pub fn implementation(x: [i8; 16]) {
        use crate::biteq::BitEqWrapper;

        let a = unsafe { crate::simd_reduce_mul_ordered(crate::Simd::<i8, 16>::new(x), 1) };
        let b = 0;

        let left = BitEqWrapper(a);
        let right = BitEqWrapper(b);

        let _ = left == right;
    }

    implementation([0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]);
}

cargo build --release is needed. But it isn't limited to windows, it also crashes under linux:

Backtrace

cargo build --release
   Compiling abc v0.1.0 (/tmp/tmp.dgm1dFPHR4)
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-523b587517d366cb.so(+0x5083e3)[0x7f0b5e7123e3]
/lib/x86_64-linux-gnu/libc.so.6(+0x46510)[0x7f0b5dc95510]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so(_ZNK4llvm8Constant21containsPoisonElementEv+0x6b)[0x7f0b5bdacd9b]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so(+0x2345774)[0x7f0b5aec4774]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so(+0x23413d9)[0x7f0b5aec03d9]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so(_ZN4llvm16ConstantFoldCallEPKNS_8CallBaseEPNS_8FunctionENS_8ArrayRefIPNS_8ConstantEEEPKNS_17TargetLibraryInfoE+0x101)[0x7f0b5aebf121]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so(_ZN4llvm12SimplifyCallEPNS_8CallBaseERKNS_13SimplifyQueryE+0x6e0)[0x7f0b5aeb7990]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so(+0x2332181)[0x7f0b5aeb1181]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so(_ZN4llvm19SimplifyInstructionEPNS_11InstructionERKNS_13SimplifyQueryEPNS_25OptimizationRemarkEmitterE+0xa5)[0x7f0b5aeb0f35]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so(+0x232d61c)[0x7f0b5aeac61c]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so(+0x38688ac)[0x7f0b5c3e78ac]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so(_ZN4llvm13FPPassManager13runOnFunctionERNS_8FunctionE+0x307)[0x7f0b5ac88e07]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so(+0x272559c)[0x7f0b5b2a459c]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so(_ZN4llvm6legacy15PassManagerImpl3runERNS_6ModuleE+0x36c)[0x7f0b5bacce6c]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so(LLVMRunPassManager+0xa)[0x7f0b5bdc200a]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-523b587517d366cb.so(+0x20766f1)[0x7f0b602806f1]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-523b587517d366cb.so(+0x207a3ad)[0x7f0b602843ad]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-523b587517d366cb.so(+0x20b9be8)[0x7f0b602c3be8]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-523b587517d366cb.so(+0x20ecf0c)[0x7f0b602f6f0c]
/home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/libstd-d31eae41cd792517.so(rust_metadata_std_f70e4442901790c2+0xaa8a3)[0x7f0b5df458a3]
/lib/x86_64-linux-gnu/libc.so.6(+0x988d7)[0x7f0b5dce78d7]
/lib/x86_64-linux-gnu/libc.so.6(+0x129510)[0x7f0b5dd78510]
error: could not compile `abc`

Caused by:
  process didn't exit successfully: `rustc --crate-name abc --edition=2021 src/main.rs --error-format=json --json=diagnostic-rendered-ansi --crate-type bin --emit=dep-info,link -C opt-level=3 -C embed-bitcode=no -C metadata=7e9cc9164c2a8ca5 -C extra-filename=-7e9cc9164c2a8ca5 --out-dir /tmp/tmp.dgm1dFPHR4/target/release/deps -L dependency=/tmp/tmp.dgm1dFPHR4/target/release/deps` (signal: 11, SIGSEGV: invalid memory reference)

Gdb:

#0  0x00007ffff208ad9b in llvm::Constant::containsPoisonElement() const () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so
#1  0x00007ffff11a2774 in (anonymous namespace)::ConstantFoldScalarCall1(llvm::StringRef, unsigned int, llvm::Type*, llvm::ArrayRef<llvm::Constant*>, llvm::TargetLibraryInfo const*, llvm::CallBase const*) () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so
#2  0x00007ffff119e3d9 in (anonymous namespace)::ConstantFoldScalarCall(llvm::StringRef, unsigned int, llvm::Type*, llvm::ArrayRef<llvm::Constant*>, llvm::TargetLibraryInfo const*, llvm::CallBase const*) () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so
#3  0x00007ffff119d121 in llvm::ConstantFoldCall(llvm::CallBase const*, llvm::Function*, llvm::ArrayRef<llvm::Constant*>, llvm::TargetLibraryInfo const*) () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so
#4  0x00007ffff1195990 in llvm::SimplifyCall(llvm::CallBase*, llvm::SimplifyQuery const&) () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so
#5  0x00007ffff118f181 in simplifyInstructionWithOperands(llvm::Instruction*, llvm::ArrayRef<llvm::Value*>, llvm::SimplifyQuery const&, llvm::OptimizationRemarkEmitter*) [clone .llvm.6782241817502413270] () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so
#6  0x00007ffff118ef35 in llvm::SimplifyInstruction(llvm::Instruction*, llvm::SimplifyQuery const&, llvm::OptimizationRemarkEmitter*) () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so
#7  0x00007ffff118a61c in (anonymous namespace)::EarlyCSE::run() () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so
#8  0x00007ffff26c58ac in (anonymous namespace)::EarlyCSELegacyCommonPass<true>::runOnFunction(llvm::Function&) [clone .llvm.3498732353281808599] () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so
#9  0x00007ffff0f66e07 in llvm::FPPassManager::runOnFunction(llvm::Function&) () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so
#10 0x00007ffff158259c in (anonymous namespace)::CGPassManager::runOnModule(llvm::Module&) () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so
#11 0x00007ffff1daae6c in llvm::legacy::PassManagerImpl::run(llvm::Module&) () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so
#12 0x00007ffff20a000a in LLVMRunPassManager () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-13-rust-1.57.0-nightly.so
#13 0x00007ffff655e6f1 in rustc_codegen_llvm::back::write::optimize () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-523b587517d366cb.so
#14 0x00007ffff65623ad in rustc_codegen_ssa::back::write::execute_work_item () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-523b587517d366cb.so
#15 0x00007ffff65a1be8 in std::sys_common::backtrace::__rust_begin_short_backtrace () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-523b587517d366cb.so
#16 0x00007ffff65d4f0c in core::ops::function::FnOnce::call_once{{vtable.shim}} () from /home/marcel/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-523b587517d366cb.so
#17 0x00007ffff42238a3 in alloc::boxed::{impl#44}::call_once<(), dyn core::ops::function::FnOnce<(), Output=()>, alloc::alloc::Global> () at /rustc/fdf65053e99e8966f9bd83b5a8491326cb33d638/library/alloc/src/boxed.rs:1636
#18 alloc::boxed::{impl#44}::call_once<(), alloc::boxed::Box<dyn core::ops::function::FnOnce<(), Output=()>, alloc::alloc::Global>, alloc::alloc::Global> () at /rustc/fdf65053e99e8966f9bd83b5a8491326cb33d638/library/alloc/src/boxed.rs:1636
#19 std::sys::unix::thread::{impl#2}::new::thread_start () at library/std/src/sys/unix/thread.rs:106
#20 0x00007ffff3fc58d7 in start_thread (arg=<optimized out>) at pthread_create.c:434
#21 0x00007ffff4056510 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

based on the error message:

@rustbot modify labels: I-crash I-monomorphization

[nagisa]

rustc: llvm/include/llvm/Support/Casting.h:104: static bool llvm::isa_impl_cl<To, const From*>::doit(const From*) [with To = llvm::PoisonValue; From = llvm::Constant]: Assertion `Val && "isa<> used on a null pointer"' failed.

is the assertion being triggered (with @hellow554's minimization)

[workingjubilee]

I do not understand how that is finding a null pointer or how it is getting a poison value out of this.

[workingjubilee]

Thank you for your work on the minimization though! I just... is it because it starts as an array and then it tries to constant fold that? And why only vectors of 8-bit values? The test is the same for larger ones.

[workingjubilee]

As a note, this crash only reproduces with cargo build (or similar, such as cargo rustc) at the moment, it doesn't when rustc is invoked directly.

[eddyb]

I can repro with this:
curl -sS https://gist.githubusercontent.com/eddyb/08ea4736082d9b2326a984c4cb828a08/raw/6a2b96cd8422950fa2b160e518671df66965a863/issue-88769-min.rs | rustc -O -

But only on rustc 1.57.0-nightly (fdf65053e 2021-09-07), not rustc 1.56.0-nightly (0035d9dce 2021-08-16) which I had before rustup update nightly, so it must be relatively recent (though I may have been pre-LLVM 13, which wouldn't narrow it down much).

[eddyb]

Running with -Z verify-llvm-ir doesn't result in a verifier error, so assume that's still working, this must be a LLVM bug.

These series of steps reproduce the crash outside rustc, which should allow minimizing the LLVM IR with e.g. bugpoint:

mkdir issue-88769
cd issue-88769

curl -sSO https://gist.githubusercontent.com/eddyb/08ea4736082d9b2326a984c4cb828a08/raw/6a2b96cd8422950fa2b160e518671df66965a863/issue-88769-min.rs

rustup toolchain install nightly-2021-09-08 -c llvm-tools-preview

# This will crash - ignore the crash and keep going, `-C save-temps` works.
rustc +nightly-2021-09-08 issue-88769-min.rs -O -C save-temps

# This reproduces the crash using the `.bc` from `-C save-temps`.
~/.rustup/toolchains/nightly-2021-09-08-x*64*/lib/rustlib/x*64*/bin/opt -O3 issue-88769-min.*-cgu.3.rcgu.no-opt.bc > opt.bc

Sadly we don't ship bugpoint with llvm-tools-preview, but if you have it installed:

bugpoint --opt-command=$(echo ~/.rustup/toolchains/nightly-2021-09-08-x*64*/lib/rustlib/x*64*/bin/opt) -O3 issue-88769-min.*-cgu.3.rcgu.no-opt.bc

After a lot of crashes, it ends in:

*** Found crashing pass: -early-cse-memssa
Emitted bitcode to 'bugpoint-reduced-simplified.bc'

*** You can reproduce the problem with: opt bugpoint-reduced-simplified.bc -early-cse-memssa

Running llvm-dis on that file gives:

; ModuleID = 'bugpoint-reduced-simplified.bc'
source_filename = "issue_88769_min.61742fa9-cgu.3"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define dso_local void @_ZN15issue_88769_min4main17h9167823f857de443E() unnamed_addr #0 {
  %1 = call i8 @llvm.vector.reduce.mul.v16i8(<16 x i8> bitcast (<1 x i128> <i128 20011376718272490338853433276725592320> to <16 x i8>))
  store i8 %1, i8* undef, align 1
  ret void
}

; Function Attrs: nofree nosync nounwind readnone willreturn
declare i8 @llvm.vector.reduce.mul.v16i8(<16 x i8>) #1

attributes #0 = { "target-cpu"="x86-64" }
attributes #1 = { nofree nosync nounwind readnone willreturn }

!llvm.module.flags = !{!0}

!0 = !{i32 2, !"RtLibUseGOT", i32 1}

cc @nikic (opt -early-cse-memssa on the above LLVM IR reduction reproduces the crash)