[BUG] ICE in llvm::SelectionDAGISel::SelectBasicBlock
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
## Bug Report: ICE in llvm::SelectionDAGISel::SelectBasicBlock(llvm::ilist_iterator_w_bits, false, true>, llvm::ilist_iterator_w_bits, false, true>, bool&)
Clang crashes when compiling the following C code.
**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: backend
This is a **backend** crash (does not reproduce with `-emit-llvm`).
## Reduced Test Case
> Minimized from the original fuzzer-generated input using `creduce`.
```sh
clang -O0 test.c -o /dev/null
```
```c
long a;
void b() { asm("" : "=cV"(a)); }
```
## Crash Output
```
clang-22: /root/compilers/llvm-project-release/llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp:10298: void llvm::SelectionDAGBuilder::visitInlineAsm(const llvm::CallBase&, const llvm::BasicBlock*): Assertion \`ConstraintID != InlineAsm::ConstraintCode::Unknown && "Failed to convert memory constraint code to constraint id."' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name fhXbSBXqDDxu_surfuzz_0.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/fhXbSBXqDDxu_surfuzz_0-0910ee.o -x c /root/outputs/experiments-on-metamut/surfuzz,gcc,4/fhXbSBXqDDxu_surfuzz_0.c
1\. parser at end of file
2\. Code generation
3\. Running pass 'Function Pass Manager' on module '/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fhXbSBXqDDxu_surfuzz_0.c'.
4\. Running pass 'X86 DAG->DAG Instruction Selection' on function '@main'
#0 0x000056148fd9a2d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x000056148fd96caf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x000056148fd96dfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f8d9a505520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007f8d9a559a7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007f8d9a559a7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007f8d9a559a7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007f8d9a505476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007f8d9a4eb7f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007f8d9a4eb71b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007f8d9a4fce96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x00005614913977db llvm::SelectionDAGBuilder::visitInlineAsm(llvm::CallBase const&, llvm::BasicBlock const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x5af37db)
#12 0x00005614913c7f0f llvm::SelectionDAGBuilder::visit(llvm::Instruction const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x5b23f0f)
#13 0x00005614914615d2 llvm::SelectionDAGISel::SelectBasicBlock(llvm::ilist_iterator_w_bits, false, true>, llvm::ilist_iterator_w_bits, false, true>, bool&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x5bbd5d2)
#14 0x0000561491462612 llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x5bbe612)
#15 0x000056149146381c llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x5bbf81c)
#16 0x000056149144ef87 llvm::SelectionDAGISelLegacy::runOnMachineFunction(llvm::MachineFunction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x5baaf87)
#17 0x000056148efbff65 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#18 0x000056148f653d51 llvm::FPPassManager::runOnFunction(llvm::Function&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x3dafd51)
#19 0x000056148f653f31 llvm::FPPassManager::runOnModule(llvm::Module&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x3daff31)
#20 0x000056148f6548ae llvm::legacy::PassManagerImpl::run(llvm::Module&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x3db08ae)
#21 0x000056149005a610 (anonymous namespace)::EmitAssemblyHelper::emitAssembly(clang::BackendAction, std::unique_ptr >, clang::BackendConsumer*) BackendUtil.cpp:0:0
#22 0x000056149005a917 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr, std::unique_ptr >, clang::BackendConsumer*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x47b6917)
#23 0x000056149070b6c9 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4e676c9)
#24 0x00005614925abafc clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d07afc)
#25 0x0000561490a23987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#26 0x00005614909ab0e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#27 0x0000561490b2095e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#28 0x000056148c82b657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#29 0x000056148c820694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#30 0x000056148c825907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#31 0x000056148c6e30ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#32 0x00007f8d9a4ecd90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#33 0x00007f8d9a4ece40 call_init ./csu/../csu/libc-start.c:128:20
#34 0x00007f8d9a4ece40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#35 0x000056148c81fcb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/fhXbSBXqDDxu_surfuzz_0-4c62d8.c
clang: note: diagnostic msg: /tmp/fhXbSBXqDDxu_surfuzz_0-4c62d8.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```
## Preprocessed Source & Run Script
**Preprocessed source** (`/tmp/fhXbSBXqDDxu_surfuzz_0-4c62d8.c`):
```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fhXbSBXqDDxu_surfuzz_0.c"
extern void abort ();
extern void exit (int);
typedef unsigned long long int uint64_t;
__attribute__((aligned(16))) uint64_t vec[2] = {0,0};
int
main()
{
volatile uint64_t vcc;
for (int i = 0 ; i < 1 ; ++i)
vcc = 0xabcdef012345689ULL;
asm volatile ("s_mov_b32 vcc_lo, 0x12345689\n\t"
"s_mov_b32 vcc_hi, 0xabcdef0"
::: "memory");
asm volatile ("; no-op" : "=cV"(vcc) : "v"(vec[0]), "v"(vec[1]));
if (vcc != 0xabcdef012345689)
abort ();
return 0;
}
```
**Run script** (`/tmp/fhXbSBXqDDxu_surfuzz_0-4c62d8.sh`):
```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fhXbSBXqDDxu_surfuzz_0.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "fhXbSBXqDDxu_surfuzz_0.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/fhXbSBXqDDxu_surfuzz_0-0910ee.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fhXbSBXqDDxu_surfuzz_0.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "fhXbSBXqDDxu_surfuzz_0.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "fhXbSBXqDDxu_surfuzz_0-4c62d8.c"
```
* found via a fuzzer
[fhXbSBXqDDxu_surfuzz_0-4c62d8.c](https://github.com/user-attachments/files/29127869/fhXbSBXqDDxu_surfuzz_0-4c62d8.c)
[fhXbSBXqDDxu_surfuzz_0-4c62d8.sh](https://github.com/user-attachments/files/29127868/fhXbSBXqDDxu_surfuzz_0-4c62d8.sh)
Contributor guide
Research direction
Reproduce the crash with the reduced C source using clang -O0, then inspect llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp around visitInlineAsm and the assertion at line 10298. Trace handling of the "=cV" constraint and verify that the reproducer no longer aborts during x86 DAG instruction selection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- backend, compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100