[clang] occasional frontend crashes on version 22.1.0-rc1
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
Since I started using LLVM 22.1.0-rc1 my custom Linux kernel builds started occasionally crashing clang.
Some builds complete perfectly fine but those that fail seem to always crash on `fs/bcachefs/data/ec/init.c` with an error like the following:
```
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0. Program arguments: clang-22 -Wp,-MMD,fs/bcachefs/data/ec/.init.o.d -nostdinc -I/var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/arch/x86/include -I./arch/x86/include/generated -I/var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/include -I./include -I/var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/include/uapi -I./include/generated/uapi -include /var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/include/linux/compiler-version.h -include /var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/include/linux/kconfig.h -include /var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/include/linux/compiler_types.h -D__KERNEL__ --target=x86_64-linux-gnu -fintegrated-as -Werror=ignored-optimization-argument -Werror=option-ignored -fmacro-prefix-map=/var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/= -std=gnu11 -fshort-wchar -funsigned-char -fno-common -fno-PIE -fno-strict-aliasing -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx -mno-sse4a -fcf-protection=branch -fno-jump-tables -m64 -falign-loops=1 -mno-80387 -mno-fp-ret-in-387 -mstack-alignment=8 -mskip-rax-setup -march=x86-64-v3 -mno-red-zone -mcmodel=kernel -mstack-protector-guard-reg=gs -mstack-protector-guard-symbol=__ref_stack_chk_guard -Wno-sign-compare -fno-asynchronous-unwind-tables -mretpoline-external-thunk -mindirect-branch-cs-prefix -mfunction-return=thunk-extern -mharden-sls=all -fpatchable-function-entry=11,11 -fno-delete-null-pointer-checks -O3 -fstack-protector-strong -ftrivial-auto-var-init=zero -fno-stack-clash-protection -pg -mfentry -DCC_USING_NOP_MCOUNT -DCC_USING_FENTRY -fno-lto -flto=thin -fsplit-lto-unit -fvisibility=hidden -fsanitize=kcfi -fsanitize-kcfi-arity -falign-functions=16 -fstrict-flex-arrays=3 -fms-extensions -fno-strict-overflow -fno-stack-check -fno-builtin-wcslen -Wall -Wextra -Wundef -Werror=implicit-function-declaration -Werror=implicit-int -Werror=return-type -Wno-format-security -Wno-trigraphs -Wno-frame-address -Wno-address-of-packed-member -Wmissing-declarations -Wmissing-prototypes -Wframe-larger-than=2048 -Wno-gnu -Wno-microsoft-anon-tag -Wno-format-overflow-non-kprintf -Wno-format-truncation-non-kprintf -Wno-default-const-init-unsafe -Wno-pointer-sign -Wcast-function-type -Wno-unterminated-string-initialization -Wimplicit-fallthrough -Werror=date-time -Wenum-conversion -Wunused -Wno-unused-but-set-variable -Wno-unused-const-variable -Wno-format-overflow -Wno-override-init -Wno-pointer-to-enum-cast -Wno-tautological-constant-out-of-range-compare -Wno-unaligned-access -Wno-enum-compare-conditional -Wno-missing-field-initializers -Wno-type-limits -Wno-shift-negative-value -Wno-enum-enum-conversion -Wno-sign-compare -Wno-unused-parameter -Wno-psabi -I/var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/fs/bcachefs -I/var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/fs/bcachefs -Ifs/bcachefs -DMODULE -DKBUILD_BASENAME=\"init\" -DKBUILD_MODNAME=\"bcachefs\" -D__KBUILD_MODNAME=bcachefs -c -o fs/bcachefs/data/ec/init.o /var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/fs/bcachefs/data/ec/init.c
1. parser at end of file
2. Optimizer
3. Running pass "require,function(invalidate),require,cgscc(devirt<4>(inline,function-attrs,argpromotion,openmp-opt-cgscc,function(sroa,early-cse,speculative-execution,jump-threading,correlated-propagation,simplifycfg,instcombine,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm,loop-rotate,licm,simple-loop-unswitch),simplifycfg,instcombine,loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-unroll-full),sroa,vector-combine,mldst-motion,gvn<>,sccp,bdce,instcombine,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm),coro-elide,simplifycfg,instcombine),function-attrs,function(require))),function(invalidate),cgscc(devirt<4>())" on module "/var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/fs/bcachefs/data/ec/init.c"
4. Running pass "cgscc(devirt<4>(inline,function-attrs,argpromotion,openmp-opt-cgscc,function(sroa,early-cse,speculative-execution,jump-threading,correlated-propagation,simplifycfg,instcombine,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm,loop-rotate,licm,simple-loop-unswitch),simplifycfg,instcombine,loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-unroll-full),sroa,vector-combine,mldst-motion,gvn<>,sccp,bdce,instcombine,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm),coro-elide,simplifycfg,instcombine),function-attrs,function(require)))" on module "/var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/fs/bcachefs/data/ec/init.c"
5. Running pass "jump-threading" on function "check_bucket_to_stripe_ref"
CC drivers/base/module.o
CC [M] drivers/tty/rpmsg_tty.o
CC [M] fs/smb/server/server.o
LD [M] fs/nfs/blocklayout/blocklayoutdriver.o
LD [M] drivers/nfc/st21nfca/st21nfca_hci.o
#0 0x00007fbe42fb62da llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x4bb62da)
#1 0x00007fbe42fb2a8d llvm::sys::RunSignalHandlers() (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x4bb2a8d)
#2 0x00007fbe42eaa144 (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x4aaa144)
#3 0x00007fbe3e044220 (/usr/lib64/libc.so.6+0x44220)
#4 0x00007fbe43146a27 llvm::Argument::getRange() const (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x4d46a27)
#5 0x00007fbe4503f758 llvm::LazyValueInfoImpl::solveBlockValueNonLocal(llvm::Value*, llvm::BasicBlock*) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x6c3f758)
#6 0x00007fbe4503f37c llvm::LazyValueInfoImpl::solveBlockValueImpl(llvm::Value*, llvm::BasicBlock*) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x6c3f37c)
#7 0x00007fbe4503e6e7 llvm::LazyValueInfoImpl::solveBlockValue(llvm::Value*, llvm::BasicBlock*) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x6c3e6e7)
#8 0x00007fbe4503dc2e llvm::LazyValueInfoImpl::solve() (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x6c3dc2e)
#9 0x00007fbe45049313 llvm::LazyValueInfoImpl::getValueOnEdge(llvm::Value*, llvm::BasicBlock*, llvm::BasicBlock*, llvm::Instruction*) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x6c49313)
#10 0x00007fbe4504b78a llvm::LazyValueInfo::getConstantOnEdge(llvm::Value*, llvm::BasicBlock*, llvm::BasicBlock*, llvm::Instruction*) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x6c4b78a)
#11 0x00007fbe446cbe24 llvm::JumpThreadingPass::computeValueKnownInPredecessorsImpl(llvm::Value*, llvm::BasicBlock*, llvm::SmallVectorImpl>&, llvm::jumpthreading::ConstantPreference, llvm::SmallPtrSet&, llvm::Instruction*) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x62cbe24)
#12 0x00007fbe446cc265 llvm::JumpThreadingPass::computeValueKnownInPredecessorsImpl(llvm::Value*, llvm::BasicBlock*, llvm::SmallVectorImpl>&, llvm::jumpthreading::ConstantPreference, llvm::SmallPtrSet&, llvm::Instruction*) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x62cc265)
#13 0x00007fbe446ce9ec llvm::JumpThreadingPass::processThreadableEdges(llvm::Value*, llvm::BasicBlock*, llvm::jumpthreading::ConstantPreference, llvm::Instruction*) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x62ce9ec)
#14 0x00007fbe446cbabc llvm::JumpThreadingPass::processBlock(llvm::BasicBlock*) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x62cbabc)
#15 0x00007fbe446caa4a llvm::JumpThreadingPass::runImpl(llvm::Function&, llvm::AnalysisManager*, llvm::TargetLibraryInfo*, llvm::TargetTransformInfo*, llvm::LazyValueInfo*, llvm::AAResults*, std::__1::unique_ptr>, llvm::BlockFrequencyInfo*, llvm::BranchProbabilityInfo*) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x62caa4a)
#16 0x00007fbe446ca517 llvm::JumpThreadingPass::run(llvm::Function&, llvm::AnalysisManager&) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x62ca517)
#17 0x00007fbe431ea3eb llvm::PassManager>::run(llvm::Function&, llvm::AnalysisManager&) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x4dea3eb)
#18 0x00007fbe44f182bf llvm::CGSCCToFunctionPassAdaptor::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x6b182bf)
#19 0x00007fbe44f140cc llvm::PassManager, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x6b140cc)
#20 0x00007fbe44f16af6 llvm::DevirtSCCRepeatedPass::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x6b16af6)
#21 0x00007fbe44f15b0d llvm::ModuleToPostOrderCGSCCPassAdaptor::run(llvm::Module&, llvm::AnalysisManager&) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x6b15b0d)
#22 0x00007fbe431e9025 llvm::PassManager>::run(llvm::Module&, llvm::AnalysisManager&) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x4de9025)
#23 0x00007fbe44a478ae llvm::ModuleInlinerWrapperPass::run(llvm::Module&, llvm::AnalysisManager&) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x66478ae)
#24 0x00007fbe431e9025 llvm::PassManager>::run(llvm::Module&, llvm::AnalysisManager&) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x4de9025)
#25 0x00007fbe4b0944da (/usr/lib/llvm/22/bin/../lib64/libclang-cpp.so.22.1+libcxx+0x30944da)
#26 0x00007fbe4b08b314 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr, std::__1::unique_ptr>, clang::BackendConsumer*) (/usr/lib/llvm/22/bin/../lib64/libclang-cpp.so.22.1+libcxx+0x308b314)
#27 0x00007fbe4b441639 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/usr/lib/llvm/22/bin/../lib64/libclang-cpp.so.22.1+libcxx+0x3441639)
#28 0x00007fbe495ece59 clang::ParseAST(clang::Sema&, bool, bool) (/usr/lib/llvm/22/bin/../lib64/libclang-cpp.so.22.1+libcxx+0x15ece59)
#29 0x00007fbe4bdfa37f clang::FrontendAction::Execute() (/usr/lib/llvm/22/bin/../lib64/libclang-cpp.so.22.1+libcxx+0x3dfa37f)
#30 0x00007fbe4bd2f4a0 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/usr/lib/llvm/22/bin/../lib64/libclang-cpp.so.22.1+libcxx+0x3d2f4a0)
#31 0x00007fbe4be88e6c clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/usr/lib/llvm/22/bin/../lib64/libclang-cpp.so.22.1+libcxx+0x3e88e6c)
#32 0x000055a3236ba003 cc1_main(llvm::ArrayRef, char const*, void*) (/usr/lib/llvm/22/bin/clang-22+0x14003)
#33 0x000055a3236b6f42 (/usr/lib/llvm/22/bin/clang-22+0x10f42)
#34 0x000055a3236b8c99 (/usr/lib/llvm/22/bin/clang-22+0x12c99)
#35 0x00007fbe4b8e055d (/usr/lib/llvm/22/bin/../lib64/libclang-cpp.so.22.1+libcxx+0x38e055d)
#36 0x00007fbe42ea9e30 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/usr/lib/llvm/22/bin/../lib64/libLLVM.so.22.1+libcxx+0x4aa9e30)
#37 0x00007fbe4b8dfaa5 clang::driver::CC1Command::Execute(llvm::ArrayRef>, std::__1::basic_string, std::__1::allocator>*, bool*) const (/usr/lib/llvm/22/bin/../lib64/libclang-cpp.so.22.1+libcxx+0x38dfaa5)
#38 0x00007fbe4b88ef0d clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/usr/lib/llvm/22/bin/../lib64/libclang-cpp.so.22.1+libcxx+0x388ef0d)
#39 0x00007fbe4b88f1de clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const (/usr/lib/llvm/22/bin/../lib64/libclang-cpp.so.22.1+libcxx+0x388f1de)
#40 0x00007fbe4b8bad8c clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) (/usr/lib/llvm/22/bin/../lib64/libclang-cpp.so.22.1+libcxx+0x38bad8c)
#41 0x000055a3236b5e30 clang_main(int, char**, llvm::ToolContext const&) (/usr/lib/llvm/22/bin/clang-22+0xfe30)
#42 0x000055a3236c73f8 main (/usr/lib/llvm/22/bin/clang-22+0x213f8)
#43 0x00007fbe3e02764b (/usr/lib64/libc.so.6+0x2764b)
#44 0x00007fbe3e02770a __libc_start_main (/usr/lib64/libc.so.6+0x2770a)
#45 0x000055a3236b4255 _start (/usr/lib/llvm/22/bin/clang-22+0xe255)
clang-22: error: clang frontend command failed with exit code 139 (use -v to see invocation)
clang version 22.1.0+libcxx
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /usr/lib/llvm/22/bin
Configuration file: /etc/clang/22/x86_64-unknown-linux-gnu-clang.cfg
CC drivers/mfd/max8998-irq.o
AR drivers/scsi/device_handler/built-in.a
CC [M] drivers/scsi/device_handler/scsi_dh_rdac.o
AR net/mctp/built-in.a
LD [M] drivers/nfc/st21nfca/st21nfca_i2c.o
CC fs/xfs/xfs_dahash_test.o
LD [M] fs/nfs/nfs.o
CC net/mptcp/pm_kernel.o
CC [M] fs/ocfs2/cluster/tcp.o
clang-22: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-22: note: diagnostic msg: /var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/temp/init-c8d266.c
clang-22: note: diagnostic msg: /var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/temp/init-c8d266.sh
clang-22: note: diagnostic msg:
********************
make[5]: *** [/var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/scripts/Makefile.build:287: fs/bcachefs/data/ec/init.o] Error 1
make[4]: *** [/var/tmp/portage/sys-kernel/cachyos-kernel-6.19_rc6/work/linux-6.18/scripts/Makefile.build:544: fs/bcachefs] Error 2
make[4]: *** Waiting for unfinished jobs....
```
The same source files build fine with LLVM `21.1.8` and GCC `15.2.1` so I'm assuming this is a regression of some sort.
Here the requested reproducer files (for me these reproduce the crash roughly 1/3 of runs):
[init-c8d266.sh](https://github.com/user-attachments/files/24806834/init-c8d266.sh)
[init-c8d266.c](https://github.com/user-attachments/files/24806835/init-c8d266.c)
Contributor guide
Research direction
Start by reproducing the clang-22 command against fs/bcachefs/data/ec/init.c and inspect the crash in check_bucket_to_stripe_ref. Trace the jump-threading and LazyValueInfo passes shown in the stack dump, then reduce the input or identify a compiler regression and add a regression test demonstrating that the crash no longer occurs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100