clang-17 crash on x86 with -fzero-call-used-regs=used-gpr

[arndb]

I ran into a crash while building the Linux kernel with clang-17, version 17.0.6 (++20231208085813+6009708b4367-1exp120231208085906.81), don't see this with clang-16 or clang-18. Reduced to a trivial testcase

extern struct { void (*cb)(void); } s;
void f(void) { s.cb(); }

% clang-17 -target x86_64-unknown-linux-gnu -O2 -fzero-call-used-regs=used-gpr -c test.c

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: clang-17 -target x86_64-unknown-linux-gnu -O2 -fzero-call-used-regs=used-gpr -c channel_mgmt-0b2e67.c
1.	<eof> parser at end of file
2.	Code generation
3.	Running pass 'Function Pass Manager' on module 'channel_mgmt-0b2e67.c'.
4.	Running pass 'Prologue/Epilogue Insertion & Frame Finalization' on function '@f'
 #0 0x0000fffeefa88428 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xcc8428)
 #1 0x0000fffeefa866f0 llvm::sys::RunSignalHandlers() (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xcc66f0)
 #2 0x0000fffeef9dd65c (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xc1d65c)
 #3 0x0000fffef98607fc (linux-vdso.so.1+0x7fc)
 #4 0x0000fffeeff0f73c (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0x114f73c)
 #5 0x0000fffeefe08c04 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0x1048c04)
 #6 0x0000fffeefbc5068 llvm::FPPassManager::runOnFunction(llvm::Function&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xe05068)
 #7 0x0000fffeefbca744 llvm::FPPassManager::runOnModule(llvm::Module&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xe0a744)
 #8 0x0000fffeefbc55e0 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xe055e0)
 #9 0x0000fffef7792dbc clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream> >) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x1962dbc)
#10 0x0000fffef7a81ec8 (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x1c51ec8)
#11 0x0000fffef6864e60 clang::ParseAST(clang::Sema&, bool, bool) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0xa34e60)
#12 0x0000fffef83e4adc clang::FrontendAction::Execute() (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x25b4adc)
#13 0x0000fffef8376020 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x2546020)
#14 0x0000fffef845ac5c clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x262ac5c)
#15 0x0000aaab63651cc4 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/usr/lib/llvm-17/bin/clang+0x11cc4)
#16 0x0000aaab6364fe20 (/usr/lib/llvm-17/bin/clang+0xfe20)
#17 0x0000fffef80923f8 (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x22623f8)
#18 0x0000fffeef9dd3d0 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xc1d3d0)
#19 0x0000fffef8091bb0 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, bool*) const (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x2261bb0)
#20 0x0000fffef8061800 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x2231800)
#21 0x0000fffef8061a08 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*> >&, bool) const (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x2231a08)
#22 0x0000fffef807920c clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*> >&) (/usr/lib/llvm-17/bin/../lib/libclang-cpp.so.17+0x224920c)
#23 0x0000aaab6364f5a8 clang_main(int, char**, llvm::ToolContext const&) (/usr/lib/llvm-17/bin/clang+0xf5a8)
#24 0x0000aaab6365a468 main (/usr/lib/llvm-17/bin/clang+0x1a468)
#25 0x0000fffeee8d7780 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#26 0x0000fffeee8d7858 call_init ./csu/../csu/libc-start.c:128:20
#27 0x0000fffeee8d7858 __libc_start_main ./csu/../csu/libc-start.c:347:5
#28 0x0000aaab6364cbf0 _start (/usr/lib/llvm-17/bin/clang+0xcbf0)
clang-17: error: clang frontend command failed with exit code 139 (use -v to see invocation)
Debian clang version 17.0.6 (++20231208085813+6009708b4367-1~exp1~20231208085906.81)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
clang-17: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-17: note: diagnostic msg: /tmp/channel_mgmt-0b2e67-073631.c
clang-17: note: diagnostic msg: /tmp/channel_mgmt-0b2e67-073631.sh
clang-17: note: diagnostic msg: 

********************

[berrange]

FYI this flaw was fixed by

f800c1f

We hit the same clang bug with QEMU builds in Fedora (https://bugzilla.redhat.com/show_bug.cgi?id=2262260)