Crash with TLS+PIC+EXPENSIVE_CHECKS: "Bad machine code: FrameSetup is after another FrameSetup"

[TimNN]

The following IR crashes when run through llc -relocation-model=pic (originally reported in rust-lang/rust#104173):

; ModuleID = 'bugpoint-reduced-simplified.bc'
source_filename = "repro.dba56e2e-cgu.0"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

@_ZN5repro3FOO7__getit5__KEY17h8a371060d0f5b551E = external thread_local global <{ [4 x i8], [4 x i8], [1 x i8], [3 x i8] }>, align 4

declare ptr @"_ZN3std6thread5local4fast12Key$LT$T$GT$3get17h336c607071ef2f69E"(ptr, ptr) unnamed_addr #0

define hidden ptr @_ZN5repro3FOO7__getit17hcc9532ca2598edd1E(ptr %init) unnamed_addr #0 {
start:
  %0 = call align 4 ptr @"_ZN3std6thread5local4fast12Key$LT$T$GT$3get17h336c607071ef2f69E"(ptr align 4 @_ZN5repro3FOO7__getit5__KEY17h8a371060d0f5b551E, ptr align 4 undef)
  unreachable
}

attributes #0 = { "target-cpu"="x86-64" }

!llvm.module.flags = !{!0}

!0 = !{i32 2, !"RtLibUseGOT", i32 1}

LLVM compiled at deeaec7 with LLVM_ENABLE_EXPENSIVE_CHECKS enabled. Crash:

# After Instruction Selection
# Machine code for function _ZN5repro3FOO7__getit17hcc9532ca2598edd1E: IsSSA, TracksLiveness

bb.0.start:
  ADJCALLSTACKDOWN64 0, 0, 0, implicit-def dead $rsp, implicit-def dead $eflags, implicit-def dead $ssp, implicit $rsp, implicit $ssp
  ADJCALLSTACKDOWN64 0, 0, 0, implicit-def $rsp, implicit-def $eflags, implicit-def $ssp, implicit $rsp, implicit $ssp
  TLS_addr64 $noreg, 1, $noreg, target-flags(x86-tlsgd) @_ZN5repro3FOO7__getit5__KEY17h8a371060d0f5b551E, $noreg, implicit-def $rax, implicit-def dead $rcx, implicit-def dead $rdx, implicit-def dead $rsi, implicit-def dead $rdi, implicit-def dead $r8, implicit-def dead $r9, implicit-def dead $r10, implicit-def dead $r11, implicit-def dead $fp0, implicit-def dead $fp1, implicit-def dead $fp2, implicit-def dead $fp3, implicit-def dead $fp4, implicit-def dead $fp5, implicit-def dead $fp6, implicit-def dead $fp7, implicit-def dead $st0, implicit-def dead $st1, implicit-def dead $st2, implicit-def dead $st3, implicit-def dead $st4, implicit-def dead $st5, implicit-def dead $st6, implicit-def dead $st7, implicit-def dead $mm0, implicit-def dead $mm1, implicit-def dead $mm2, implicit-def dead $mm3, implicit-def dead $mm4, implicit-def dead $mm5, implicit-def dead $mm6, implicit-def dead $mm7, implicit-def dead $xmm0, implicit-def dead $xmm1, implicit-def dead $xmm2, implicit-def dead $xmm3, implicit-def dead $xmm4, implicit-def dead $xmm5, implicit-def dead $xmm6, implicit-def dead $xmm7, implicit-def dead $xmm8, implicit-def dead $xmm9, implicit-def dead $xmm10, implicit-def dead $xmm11, implicit-def dead $xmm12, implicit-def dead $xmm13, implicit-def dead $xmm14, implicit-def dead $xmm15, implicit-def dead $eflags, implicit-def dead $df, implicit $rsp, implicit $ssp
  ADJCALLSTACKUP64 0, 0, implicit-def $rsp, implicit-def $eflags, implicit-def $ssp, implicit $rsp, implicit $ssp
  %1:gr64 = COPY $rax
  $rdi = COPY %1:gr64
  %2:gr64 = IMPLICIT_DEF
  $rsi = COPY %2:gr64
  CALL64pcrel32 target-flags(x86-plt) @"_ZN3std6thread5local4fast12Key$LT$T$GT$3get17h336c607071ef2f69E", <regmask $bh $bl $bp $bph $bpl $bx $ebp $ebx $hbp $hbx $rbp $rbx $r12 $r13 $r14 $r15 $r12b $r13b $r14b $r15b $r12bh $r13bh $r14bh $r15bh $r12d $r13d $r14d $r15d $r12w $r13w $r14w $r15w $r12wh and 3 more...>, implicit $rsp, implicit $ssp, implicit $rdi, implicit $rsi, implicit-def $rsp, implicit-def $ssp, implicit-def $rax
  ADJCALLSTACKUP64 0, 0, implicit-def dead $rsp, implicit-def dead $eflags, implicit-def dead $ssp, implicit $rsp, implicit $ssp
  %3:gr64 = COPY $rax

# End machine code for function _ZN5repro3FOO7__getit17hcc9532ca2598edd1E.

*** Bad machine code: FrameSetup is after another FrameSetup ***
- function:    _ZN5repro3FOO7__getit17hcc9532ca2598edd1E
- basic block: %bb.0 start (0x555b97b5f478)
- instruction: ADJCALLSTACKDOWN64 0, 0, 0, implicit-def $rsp, implicit-def $eflags, implicit-def $ssp, implicit $rsp, implicit $ssp

*** Bad machine code: FrameDestroy is not after a FrameSetup ***
- function:    _ZN5repro3FOO7__getit17hcc9532ca2598edd1E
- basic block: %bb.0 start (0x555b97b5f478)
- instruction: ADJCALLSTACKUP64 0, 0, implicit-def dead $rsp, implicit-def dead $eflags, implicit-def dead $ssp, implicit $rsp, implicit $ssp
LLVM ERROR: Found 2 machine code errors.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: llc -relocation-model=pic min.ll
1.      Running pass 'Function Pass Manager' on module 'min.ll'.
2.      Running pass 'Verify generated machine code' on function '@_ZN5repro3FOO7__getit17hcc9532ca2598edd1E'

[llvmbot]

@llvm/issue-subscribers-backend-x86

The following IR crashes when run through `llc -relocation-model=pic` (originally reported in https://github.com/rust-lang/rust/issues/104173):

; ModuleID = 'bugpoint-reduced-simplified.bc'
source_filename = "repro.dba56e2e-cgu.0"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

@<!-- -->_ZN5repro3FOO7__getit5__KEY17h8a371060d0f5b551E = external thread_local global &lt;{ [4 x i8], [4 x i8], [1 x i8], [3 x i8] }&gt;, align 4

declare ptr @"_ZN3std6thread5local4fast12Key$LT$T$GT$3get17h336c607071ef2f69E"(ptr, ptr) unnamed_addr #<!-- -->0

define hidden ptr @<!-- -->_ZN5repro3FOO7__getit17hcc9532ca2598edd1E(ptr %init) unnamed_addr #<!-- -->0 {
start:
  %0 = call align 4 ptr @"_ZN3std6thread5local4fast12Key$LT$T$GT$3get17h336c607071ef2f69E"(ptr align 4 @<!-- -->_ZN5repro3FOO7__getit5__KEY17h8a371060d0f5b551E, ptr align 4 undef)
  unreachable
}

attributes #<!-- -->0 = { "target-cpu"="x86-64" }

!llvm.module.flags = !{!0}

!0 = !{i32 2, !"RtLibUseGOT", i32 1}

LLVM compiled at deeaec7 with LLVM_ENABLE_EXPENSIVE_CHECKS enabled. Crash:

# After Instruction Selection
# Machine code for function _ZN5repro3FOO7__getit17hcc9532ca2598edd1E: IsSSA, TracksLiveness

bb.0.start:
  ADJCALLSTACKDOWN64 0, 0, 0, implicit-def dead $rsp, implicit-def dead $eflags, implicit-def dead $ssp, implicit $rsp, implicit $ssp
  ADJCALLSTACKDOWN64 0, 0, 0, implicit-def $rsp, implicit-def $eflags, implicit-def $ssp, implicit $rsp, implicit $ssp
  TLS_addr64 $noreg, 1, $noreg, target-flags(x86-tlsgd) @<!-- -->_ZN5repro3FOO7__getit5__KEY17h8a371060d0f5b551E, $noreg, implicit-def $rax, implicit-def dead $rcx, implicit-def dead $rdx, implicit-def dead $rsi, implicit-def dead $rdi, implicit-def dead $r8, implicit-def dead $r9, implicit-def dead $r10, implicit-def dead $r11, implicit-def dead $fp0, implicit-def dead $fp1, implicit-def dead $fp2, implicit-def dead $fp3, implicit-def dead $fp4, implicit-def dead $fp5, implicit-def dead $fp6, implicit-def dead $fp7, implicit-def dead $st0, implicit-def dead $st1, implicit-def dead $st2, implicit-def dead $st3, implicit-def dead $st4, implicit-def dead $st5, implicit-def dead $st6, implicit-def dead $st7, implicit-def dead $mm0, implicit-def dead $mm1, implicit-def dead $mm2, implicit-def dead $mm3, implicit-def dead $mm4, implicit-def dead $mm5, implicit-def dead $mm6, implicit-def dead $mm7, implicit-def dead $xmm0, implicit-def dead $xmm1, implicit-def dead $xmm2, implicit-def dead $xmm3, implicit-def dead $xmm4, implicit-def dead $xmm5, implicit-def dead $xmm6, implicit-def dead $xmm7, implicit-def dead $xmm8, implicit-def dead $xmm9, implicit-def dead $xmm10, implicit-def dead $xmm11, implicit-def dead $xmm12, implicit-def dead $xmm13, implicit-def dead $xmm14, implicit-def dead $xmm15, implicit-def dead $eflags, implicit-def dead $df, implicit $rsp, implicit $ssp
  ADJCALLSTACKUP64 0, 0, implicit-def $rsp, implicit-def $eflags, implicit-def $ssp, implicit $rsp, implicit $ssp
  %1:gr64 = COPY $rax
  $rdi = COPY %1:gr64
  %2:gr64 = IMPLICIT_DEF
  $rsi = COPY %2:gr64
  CALL64pcrel32 target-flags(x86-plt) @"_ZN3std6thread5local4fast12Key$LT$T$GT$3get17h336c607071ef2f69E", &lt;regmask $bh $bl $bp $bph $bpl $bx $ebp $ebx $hbp $hbx $rbp $rbx $r12 $r13 $r14 $r15 $r12b $r13b $r14b $r15b $r12bh $r13bh $r14bh $r15bh $r12d $r13d $r14d $r15d $r12w $r13w $r14w $r15w $r12wh and 3 more...&gt;, implicit $rsp, implicit $ssp, implicit $rdi, implicit $rsi, implicit-def $rsp, implicit-def $ssp, implicit-def $rax
  ADJCALLSTACKUP64 0, 0, implicit-def dead $rsp, implicit-def dead $eflags, implicit-def dead $ssp, implicit $rsp, implicit $ssp
  %3:gr64 = COPY $rax

# End machine code for function _ZN5repro3FOO7__getit17hcc9532ca2598edd1E.

*** Bad machine code: FrameSetup is after another FrameSetup ***
- function:    _ZN5repro3FOO7__getit17hcc9532ca2598edd1E
- basic block: %bb.0 start (0x555b97b5f478)
- instruction: ADJCALLSTACKDOWN64 0, 0, 0, implicit-def $rsp, implicit-def $eflags, implicit-def $ssp, implicit $rsp, implicit $ssp

*** Bad machine code: FrameDestroy is not after a FrameSetup ***
- function:    _ZN5repro3FOO7__getit17hcc9532ca2598edd1E
- basic block: %bb.0 start (0x555b97b5f478)
- instruction: ADJCALLSTACKUP64 0, 0, implicit-def dead $rsp, implicit-def dead $eflags, implicit-def dead $ssp, implicit $rsp, implicit $ssp
LLVM ERROR: Found 2 machine code errors.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: llc -relocation-model=pic min.ll
1.      Running pass 'Function Pass Manager' on module 'min.ll'.
2.      Running pass 'Verify generated machine code' on function '@<!-- -->_ZN5repro3FOO7__getit17hcc9532ca2598edd1E'