[CFI] ThinLTO-built llc traps on AArch64Subtarget cast in createMachineFunctionInfo
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
Building `LLVM/Clang` with CFI sanitizer via `thin-LTO` causes llc to crash `(SIGILL / illegal
hardware instruction)` when targeting any non-host architecture.
The crash is a `CFI violation (ud2 trap)` triggered by a type-check on the indirect virtual call from
`MachineModuleInfo::getOrCreateMachineFunction` into
`AArch64TargetMachine::createMachineFunctionInfo`.
The same llc binary works correctly when targeting the host architecture (x86_64), confirming the issue is specific to cross-target virtual dispatch paths.
This was discovered while running `ninja check-llvm` on a CFI-enabled build. `5,836` of `66,377` tests fail with the same `SIGILL` pattern across AArch64, SystemZ, X86 (cross), and AMDGPU targets.
**Build configuration:**
- System compiler: Clang 18.1.3
- CFI flags: `-flto=thin -fvisibility=default -fsanitize=cfi -fsanitize-cfi-icall-generalize-pointers`
- Linker: LLD 18
**Steps to reproduce:**
1. Build LLVM with CFI:
```bash
cmake -S ../llvm -B build-cfi -G Ninja \
-DCMAKE_BUILD_TYPE=Release \
-DLLVM_ENABLE_PROJECTS="clang" \
-DCMAKE_C_COMPILER=/usr/bin/clang \
-DCMAKE_CXX_COMPILER=/usr/bin/clang++ \
-DCMAKE_C_FLAGS="-flto=thin -fvisibility=default -fsanitize=cfi -fsanitize-cfi-icall-generalize-pointers" \
-DCMAKE_CXX_FLAGS="-flto=thin -fvisibility=default -fsanitize=cfi -fsanitize-cfi-icall-generalize-pointers" \
-DCMAKE_EXE_LINKER_FLAGS="-fuse-ld=lld" \
-DCMAKE_SHARED_LINKER_FLAGS="-fuse-ld=lld" \
-DCMAKE_MODULE_LINKER_FLAGS="-fuse-ld=lld" \
-DLLVM_TABLEGEN= \
-DCLANG_TABLEGEN=
```
2. Build all component and then check-llvm
```bash
ninja
ninja check-llvm
```
```bash
/home/aitr/osc/llvm-project/cfi_build/bin/llc /home/aitr/osc/llvm-project/llvm/test/Analysis/CostModel/AArch64/free-widening-casts.ll -mtriple=aarch64--linux-gnu | /home/aitr/osc/llvm-project/cfi_build/bin/FileCheck /home/aitr/osc/llvm-project/llvm/test/Analysis/CostModel/AArch64/free-widening-casts.ll --check-prefix=CODE
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: /home/aitr/osc/llvm-project/cfi_build/bin/llc /home/aitr/osc/llvm-project/llvm/test/Analysis/CostModel/AArch64/free-widening-casts.ll -mtriple=aarch64--linux-gnu
1. Running pass 'Function Pass Manager' on module '/home/aitr/osc/llvm-project/llvm/test/Analysis/CostModel/AArch64/free-widening-casts.ll'.
2. Running pass 'Analysis containing CSE Info' on function '@uaddl_8h'
#0 0x00006187481977fb llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/aitr/osc/llvm-project/cfi_build/bin/llc+0x788e7fb)
#1 0x0000618748193e1d llvm::sys::RunSignalHandlers() (/home/aitr/osc/llvm-project/cfi_build/bin/llc+0x788ae1d)
#2 0x0000618748198022 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x000074bf6f645330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x0000618744d980ab llvm::AArch64TargetMachine::createMachineFunctionInfo(llvm::BumpPtrAllocatorImpl&, llvm::Function const&, llvm::TargetSubtargetInfo const*) const AArch64TargetMachine.cpp:0:0
#5 0x0000618746ef2370 llvm::MachineModuleInfo::getOrCreateMachineFunction(llvm::Function&) (/home/aitr/osc/llvm-project/cfi_build/bin/llc+0x65e9370)
#6 0x0000618746ead674 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (/home/aitr/osc/llvm-project/cfi_build/bin/llc+0x65a4674)
#7 0x00006187473cd355 llvm::FPPassManager::runOnFunction(llvm::Function&) (/home/aitr/osc/llvm-project/cfi_build/bin/llc+0x6ac4355)
#8 0x00006187473d5573 llvm::FPPassManager::runOnModule(llvm::Module&) (/home/aitr/osc/llvm-project/cfi_build/bin/llc+0x6acc573)
#9 0x00006187473ce548 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/home/aitr/osc/llvm-project/cfi_build/bin/llc+0x6ac5548)
#10 0x00006187449c5e5b main (/home/aitr/osc/llvm-project/cfi_build/bin/llc+0x40bce5b)
#11 0x000074bf6f62a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#12 0x000074bf6f62a28b call_init ./csu/../csu/libc-start.c:128:20
#13 0x000074bf6f62a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#14 0x000061874498cda5 _start (/home/aitr/osc/llvm-project/cfi_build/bin/llc+0x4083da5)
FileCheck error: '' is empty.
FileCheck command line: /home/aitr/osc/llvm-project/cfi_build/bin/FileCheck /home/aitr/osc/llvm-project/llvm/test/Analysis/CostModel/AArch64/free-widening-casts.ll --check-prefix=CODE
[1] 858638 illegal hardware instruction (core dumped) /home/aitr/osc/llvm-project/cfi_build/bin/llc -mtriple=aarch64--linux-gnu |
858639 exit 2 /home/aitr/osc/llvm-project/cfi_build/bin/FileCheck --check-prefix=CODE
```
Contributor guide
Assessment
This issue has not been assessed yet.