llvm / llvm/llvm-project

[flang] Assertion `mlir::isa<fir::BoxProcType>(handler.getType())' failed.

Open
#221,193 3 comments 0 reactions 0 assignees View on GitHub
crash flang:fir-hlfir generated by fuzzer mlir
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

The following code:

```fortran
module m
contains
subroutine SETUP_SIGNALS_ffl(optional_status)
integer, parameter :: SIGFPE = 8
call signal(SIGFPE, HANDLER_ffl)
end subroutine
end module
```

Resulted in this output:
```
flang-24: /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/flang/lib/Optimizer/Builder/Runtime/Intrinsics.cpp:434: void fir::runtime::genSignal(fir::FirOpBuilder &, mlir::Location, mlir::Value, mlir::Value, mlir::Value): Assertion `mlir::isa(handler.getType())' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-flang-build/bin/flang-24 -fc1 -triple x86_64-unknown-linux-gnu -emit-obj -fno-color-diagnostics -mrelocation-model pic -pic-level 2 -pic-is-pie -target-cpu x86-64 -resource-dir /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-flang-build/lib/clang/24 -mframe-pointer=all -o /tmp/min-f192c2.o -x f95 ./min.f90
#0 0x000055f63e82f33a ___interceptor_backtrace (/home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-flang-build/bin/flang-24+0x9f8933a)
#1 0x000055f640ca7ca3 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/llvm/lib/Support/Unix/Signals.inc:935:8
#2 0x000055f640ca1ae7 llvm::sys::RunSignalHandlers() /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/llvm/lib/Support/Signals.cpp:0:5
#3 0x000055f640caa68f SignalHandler(int, siginfo_t*, void*) /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/llvm/lib/Support/Unix/Signals.inc:474:38
#4 0x00007fe8398d2330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#5 0x00007fe83992bc0c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9ec0c)
#6 0x00007fe8398d227e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#7 0x00007fe8398b58ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#8 0x00007fe8398b581b (/lib/x86_64-linux-gnu/libc.so.6+0x2881b)
#9 0x00007fe8398c8517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#10 0x000055f64bd76926 fir::runtime::genSignal(fir::FirOpBuilder&, mlir::Location, mlir::Value, mlir::Value, mlir::Value) /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/flang/lib/Optimizer/Builder/Runtime/Intrinsics.cpp:434:5
#11 0x000055f64bc87c98 Value /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/flang/../mlir/include/mlir/IR/Value.h:98:56
#12 0x000055f64bc87c98 invokeHandler /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/flang/lib/Optimizer/Builder/IntrinsicCall.cpp:2092:10
#13 0x000055f64bc87c98 operator())> /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/flang/lib/Optimizer/Builder/IntrinsicCall.cpp:2121:16
#14 0x000055f64bc87c98 Log2VisitHelper<0UL, 3UL, fir::ExtendedValue, (lambda at /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/flang/lib/Optimizer/Builder/IntrinsicCall.cpp:2120:7), const std::variant), fir::ExtendedValue (fir::IntrinsicLibrary::*)(mlir::Type, llvm::ArrayRef), void (fir::IntrinsicLibrary::*)(llvm::ArrayRef), fir::ExtendedValue (fir::IntrinsicLibrary::*)(std::optional, llvm::ArrayRef)> &> /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/flang/include/flang/Common/visit.h:44:7
#15 0x000055f64bc87c98 visit<(lambda at /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/flang/lib/Optimizer/Builder/IntrinsicCall.cpp:2120:7), const std::variant), fir::ExtendedValue (fir::IntrinsicLibrary::*)(mlir::Type, llvm::ArrayRef), void (fir::IntrinsicLibrary::*)(llvm::ArrayRef), fir::ExtendedValue (fir::IntrinsicLibrary::*)(std::optional, llvm::ArrayRef)> &> /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/flang/include/flang/Common/visit.h:78:12
#16 0x000055f64bc87c98 fir::genIntrinsicCallHelper(fir::IntrinsicHandler const*, std::optional, llvm::ArrayRef, fir::IntrinsicLibrary&) /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/flang/lib/Optimizer/Builder/IntrinsicCall.cpp:2119:17
#17 0x000055f64bbdb96a operator() /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/flang/lib/Optimizer/Builder/IntrinsicCall.cpp:0:16
#18 0x000055f64bbdb96a __invoke_impl, (lambda at /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/flang/lib/Optimizer/Builder/IntrinsicCall.cpp:2171:7), const fir::IntrinsicHandler *const &> /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:61:14
#19 0x000055f64bbdb96a __invoke<(lambda at /home/fuzz/WorkSpace/fusion-fuzz/projects/flang/llvm-project/flang/lib/Optimizer/Builder/IntrinsicCall.cpp:2171:7), const fir::IntrinsicHandler *const &> /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:96:14
```

Trunk output:
```
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
#0 0x0000000004ae4a08 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/cefs/8a/8adaadf5797d75c89e042dd9_clang-llvmflang-trunk-20260904/bin/flang-24+0x4ae4a08)
#1 0x0000000004ae1e4d SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#2 0x000076f6c9a45330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#3 0x000000000d218473 mlir::Type::getContext() const (/cefs/8a/8adaadf5797d75c89e042dd9_clang-llvmflang-trunk-20260904/bin/flang-24+0xd218473)
#4 0x000000000d21e640 (anonymous namespace)::OperationVerifier::verifyOnEntrance(mlir::Operation&) Verifier.cpp:0:0
#5 0x000000000d2215eb (anonymous namespace)::OperationVerifier::verifyOperation(mlir::Operation&) Verifier.cpp:0:0
#6 0x000000000d22252a llvm::detail::UniqueFunctionBase::UniqueFunctionBase(mlir::MLIRContext*, mlir::Operation**, mlir::Operation**, (anonymous namespace)::OperationVerifier::verifyOnExit(mlir::Operation&)::'lambda'(mlir::Operation*)&&)::'lambda'(mlir::Operation**&&)>(mlir::MLIRContext*, mlir::Operation**, mlir::Operation**, (anonymous namespace)::OperationVerifier::verifyOnExit(mlir::Operation&)::'lambda'(mlir::Operation*)&&)::'lambda'(), llvm::LogicalResult mlir::failableParallelForEach(mlir::MLIRContext*, mlir::Operation**, mlir::Operation**, (anonymous namespace)::OperationVerifier::verifyOnExit(mlir::Operation&)::'lambda'(mlir::Operation*)&&)::'lambda'(mlir::Operation**&&)>(mlir::MLIRContext*, mlir::Operation**, mlir::Operation**, (anonymous namespace)::OperationVerifier::verifyOnExit(mlir::Operation&)::'lambda'(mlir::Operation*)&&)::'lambda'()>(mlir::Operation**, llvm::detail::UniqueFunctionBase::CalledAs<(anonymous namespace)::OperationVerifier::verifyOnExit(mlir::Operation&)::'lambda'(mlir::Operation*)>)::'lambda'(llvm::detail::UniqueFunctionBase const*)::_FUN(llvm::detail::UniqueFunctionBase const*) Verifier.cpp:0:0
#7 0x0000000004b56377 std::_Function_handler (), std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker>>, void>>::_M_invoke(std::_Any_data const&) (/cefs/8a/8adaadf5797d75c89e042dd9_clang-llvmflang-trunk-20260904/bin/flang-24+0x4b56377)
#8 0x0000000004b56cbb std::__future_base::_State_baseV2::_M_do_set(std::function ()>*, bool*) (/cefs/8a/8adaadf5797d75c89e042dd9_clang-llvmflang-trunk-20260904/bin/flang-24+0x4b56cbb)
#9 0x000076f6c9aa1fb3 (/lib/x86_64-linux-gnu/libc.so.6+0xa1fb3)
#10 0x0000000004b569b1 std::__future_base::_Deferred_state>>, void>::_M_complete_async() (/cefs/8a/8adaadf5797d75c89e042dd9_clang-llvmflang-trunk-20260904/bin/flang-24+0x4b569b1)
#11 0x0000000004b5663c llvm::detail::UniqueFunctionBase::UniqueFunctionBase llvm::ThreadPoolInterface::asyncImpl(llvm::unique_function, llvm::ThreadPoolTaskGroup*)::'lambda'(), std::shared_future llvm::ThreadPoolInterface::asyncImpl(llvm::unique_function, llvm::ThreadPoolTaskGroup*)::'lambda'()>(void, llvm::detail::UniqueFunctionBase::CalledAs llvm::ThreadPoolInterface::asyncImpl(llvm::unique_function, llvm::ThreadPoolTaskGroup*)::'lambda'()>)::'lambda'(llvm::detail::UniqueFunctionBase const*)::_FUN(llvm::detail::UniqueFunctionBase const*) (/cefs/8a/8adaadf5797d75c89e042dd9_clang-llvmflang-trunk-20260904/bin/flang-24+0x4b5663c)
#12 0x000000000d294489 llvm::StdThreadPool::processTasks(llvm::ThreadPoolTaskGroup*) (/cefs/8a/8adaadf5797d75c89e042dd9_clang-llvmflang-trunk-20260904/bin/flang-24+0xd294489)
#13 0x000000000d294ac7 void* llvm::thread::ThreadProxy>(void*) ThreadPool.cpp:0:0
#14 0x000076f6c9a9cb84 (/lib/x86_64-linux-gnu/libc.so.6+0x9cb84)
#15 0x000076f6c9b29d6c (/lib/x86_64-linux-gnu/libc.so.6+0x129d6c)
flang-24: error: unable to execute command: Segmentation fault (core dumped)
flang-24: error: flang frontend command failed with exit code -2 (use -v to see invocation)
flang version 24.0.0git (https://github.com/llvm/llvm-project.git f6f14162f59d360509ad79ae96336223b724f44d)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /cefs/8a/8adaadf5797d75c89e042dd9_clang-llvmflang-trunk-20260904/bin
flang-24: note: diagnostic msg:
********************

PLEASE ATTACH THE FOLLOWING CRASH REPRODUCER FILES TO THE BUG REPORT:
flang-24: note: diagnostic msg: /tmp/example-8d4ca7
flang-24: note: diagnostic msg: /tmp/example-8d4ca7.sh
flang-24: note: diagnostic msg:

********************
flang-trunk - 277ms
```

Trunk: https://godbolt.org/z/6Eezb7v51

*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*

Contributor guide

Open the contributing guide

Research direction

Reproduce the crash with the Fortran module and signal call, then inspect flang/lib/Optimizer/Builder/Runtime/Intrinsics.cpp at genSignal and flang/lib/Optimizer/Builder/IntrinsicCall.cpp around invokeHandler. Trace why the handler is not a fir::BoxProcType and verify the compiler no longer asserts or segfaults on the provided reproducer.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.