TCG Optimizer crashes on AArch64 SVE2 instruction
Host environment
- Operating system: Fedora 35
- OS/kernel version: Linux li-142ea8cc-3370-11b2-a85c-c55585c2aa0e.ibm.com 5.15.11-200.fc35.x86_64 #1 SMP Wed Dec 22 15:41:11 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
- Architecture: x86_64
- QEMU flavor: qemu-system-aarch64
- QEMU version: QEMU emulator version 6.2.0 (v6.2.0) + QEMU latest master
- QEMU command line: qemu-system-aarch64 -machine virt,secure=on -cpu max -bios reproducer.img
Emulated/Virtualized environment
- Operating system: None
- OS/kernel version: None
- Architecture: ARM aarch64
Description of problem
QEMU crashes due to an assertion in the TCG optimizer when optimizing an SVE2 instruction:
Unrecognized operation 145 in do_constant_folding.
../tcg/optimize.c:458: tcg fatal error
Steps to reproduce
- Compile the following minimized reproducer: (a pre-compiled image is provided for convenience - reproducer.img)
.org 0x0
entry:
mrs x1, cptr_el3
orr x9, x1, #0x100
msr cptr_el3, x9
msr cptr_el2, xzr
mov x1, #0x3
mrs x9, cpacr_el1
bfi x9, x1, #16, #2
bfi x9, x1, #20, #2
msr cpacr_el1, x9
mov x9, 512
mov x0, x9
asr x0, x0, 7
sub x9, x0, #1
msr zcr_el1, x9
mov x9, 512
mov x0, x9
asr x0, x0, 7
sub x9, x0, #1
msr zcr_el2, x9
mov x9, 512
mov x0, x9
asr x0, x0, 7
sub x9, x0, #1
msr zcr_el3, x9
uqxtnt z11.s, z22.d
- Execute it using the command line given above.
Additional information
I tested latest master as well, and the problem persists.