llvm / llvm/llvm-project

[IndVars] Assertion `(It != IncomingValues.end() && (!(It->second) || It->second == OldVal)) && "Expected OldVal to match incoming value from BB!"' failed.

Open
#221,878 0 comments 0 reactions 0 assignees View on GitHub
confirmed crash-on-valid generated by fuzzer llvm:optimizations regression:23
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Reproducer: https://godbolt.org/z/xobG66959
Reduced case:
```c
#include
#include
struct s0
{
uint8_t f0;
uint8_t f1
};
struct s2
{
struct s0 f0;
struct s0 f1
} g26, f1_a1;
_Bool g5;
uint32_t g7, g9;
uint64_t g30[];
void *f1_a2;
void f1()
{
_Bool init3, c8, c12, c14, v17;
void *init5;
struct s2 as7;
uint16_t v11;
uint8_t v13;
uint32_t bb15;
lbl_f1_b0:
if (g5) goto lbl_f1_b10;
lbl_f1_b2:
g26 = as7;
switch (v11)
case 7:
goto lbl_f1_b0;
init5 = &bb15;
f1_a2 = &v17;
bb15 = g7 << 30478641;
g30[bb15] = 1;
lbl_f1_b7:
c8 = c12 = init3;
v11 = g9;
goto lbl_f1_b2;
lbl_f1_b10:
c14 = g7;
as7 = c14 ? as7 : f1_a1;
v17 = c14 & c12;
bb15 = v13 = as7.f0.f1;
init3 = v17 ^ c12;
switch (v13)
{
case 97: goto lbl_f1_b0;
case 5:
case 7: goto lbl_f1_b7;
case 3: goto lbl_f1_b14;
}
free(f1_a2);
g5 = c12;
if (c8) goto lbl_f1_b10;
lbl_f1_b14:
g5 = init5;
c12 = 702729490;
goto lbl_f1_b0;
}
```

Dump at -O3:
```
clang: /root/llvm-project/llvm/lib/Transforms/Utils/Local.cpp:924: llvm::Value* selectIncomingValueForBlock(llvm::Value*, llvm::BasicBlock*, IncomingValueMap&): Assertion `(It != IncomingValues.end() && (!(It->second) || It->second == OldVal)) && "Expected OldVal to match incoming value from BB!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics -O3 -w
1. parser at end of file
2. Optimizer
3. Running pass "require,function(invalidate),require,cgscc(devirt<4>(inline,function-attrs,argpromotion,openmp-opt-cgscc,function(sroa,early-cse,speculative-execution,jump-threading,correlated-propagation,jump-table-to-switch,simplifycfg,instcombine,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm,loop-rotate,licm,simple-loop-unswitch),simplifycfg,instcombine,loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-unroll-full),sroa,vector-combine,mldst-motion,gvn<>,sccp,bdce,instcombine,dfa-jump-threading,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm),coro-elide,simplifycfg,instcombine),function-attrs,function(require),coro-split,coro-annotation-elide)),function(invalidate),cgscc(devirt<4>())" on module ""
4. Running pass "cgscc(devirt<4>(inline,function-attrs,argpromotion,openmp-opt-cgscc,function(sroa,early-cse,speculative-execution,jump-threading,correlated-propagation,jump-table-to-switch,simplifycfg,instcombine,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm,loop-rotate,licm,simple-loop-unswitch),simplifycfg,instcombine,loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-unroll-full),sroa,vector-combine,mldst-motion,gvn<>,sccp,bdce,instcombine,dfa-jump-threading,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm),coro-elide,simplifycfg,instcombine),function-attrs,function(require),coro-split,coro-annotation-elide))" on module ""
5. Running pass "jump-threading" on function "f1"
#0 0x0000000004494678 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4494678)
#1 0x00000000044918d4 llvm::sys::RunSignalHandlers() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x44918d4)
#2 0x0000000004491f0c llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4491f0c)
#3 0x00000000043ced38 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
#4 0x00007a33d8045330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#5 0x00007a33d809ec0c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9ec0c)
#6 0x00007a33d804527e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#7 0x00007a33d80288ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#8 0x00007a33d802881b (/lib/x86_64-linux-gnu/libc.so.6+0x2881b)
#9 0x00007a33d803b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#10 0x000000000457d525 selectIncomingValueForBlock(llvm::Value*, llvm::BasicBlock*, llvm::SmallDenseMap, llvm::detail::DenseMapPair>&) Local.cpp:0:0
#11 0x000000000457f2fd llvm::TryToSimplifyUncondBranchFromEmptyBlock(llvm::BasicBlock*, llvm::DomTreeUpdater*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x457f2fd)
#12 0x0000000008b05657 llvm::JumpThreadingPass::runImpl(llvm::Function&, llvm::AnalysisManager*, llvm::TargetLibraryInfo*, llvm::TargetTransformInfo*, llvm::LazyValueInfo*, llvm::AAResults*, std::unique_ptr>, llvm::BlockFrequencyInfo*, llvm::BranchProbabilityInfo*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x8b05657)
#13 0x0000000008b05e81 llvm::JumpThreadingPass::run(llvm::Function&, llvm::AnalysisManager&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x8b05e81)
#14 0x00000000048b9b2e llvm::detail::PassModel>::runImpl(llvm::detail::PassConcept>&, llvm::Function&, llvm::AnalysisManager&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x48b9b2e)
#15 0x0000000003dbf491 llvm::PassManager>::run(llvm::Function&, llvm::AnalysisManager&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3dbf491)
#16 0x00000000012bc78e llvm::detail::PassModel>, llvm::AnalysisManager>::runImpl(llvm::detail::PassConcept>&, llvm::Function&, llvm::AnalysisManager&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x12bc78e)
#17 0x0000000003240c96 llvm::CGSCCToFunctionPassAdaptor::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3240c96)
#18 0x00000000012bc7ae llvm::detail::PassModel, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::runImpl(llvm::detail::PassConcept, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>&, llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x12bc7ae)
#19 0x0000000003238e4e llvm::PassManager, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3238e4e)
#20 0x000000000577a44e llvm::detail::PassModel, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>, llvm::AnalysisManager, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::runImpl(llvm::detail::PassConcept, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>&, llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x577a44e)
#21 0x000000000323d1d4 llvm::DevirtSCCRepeatedPass::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x323d1d4)
#22 0x000000000577c2be llvm::detail::PassModel, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::runImpl(llvm::detail::PassConcept, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>&, llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x577c2be)
#23 0x000000000323b209 llvm::ModuleToPostOrderCGSCCPassAdaptor::run(llvm::Module&, llvm::AnalysisManager&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x323b209)
#24 0x00000000057624ee llvm::detail::PassModel>::runImpl(llvm::detail::PassConcept>&, llvm::Module&, llvm::AnalysisManager&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x57624ee)
#25 0x0000000003dbd89e llvm::PassManager>::run(llvm::Module&, llvm::AnalysisManager&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3dbd89e)
#26 0x0000000005f5ad81 llvm::ModuleInlinerWrapperPass::run(llvm::Module&, llvm::AnalysisManager&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x5f5ad81)
#27 0x000000000562da3e llvm::detail::PassModel>::runImpl(llvm::detail::PassConcept>&, llvm::Module&, llvm::AnalysisManager&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x562da3e)
#28 0x0000000003dbd89e llvm::PassManager>::run(llvm::Module&, llvm::AnalysisManager&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3dbd89e)
#29 0x00000000048c9f7c (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr>&, std::unique_ptr>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#30 0x00000000048ccf59 (anonymous namespace)::EmitAssemblyHelper::emitAssembly(clang::BackendAction, std::unique_ptr>, clang::BackendConsumer*) BackendUtil.cpp:0:0
#31 0x00000000048cdfbc clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr, std::unique_ptr>, clang::BackendConsumer*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x48cdfbc)
#32 0x0000000004fa6997 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4fa6997)
#33 0x0000000006ddf84c clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6ddf84c)
#34 0x0000000004fa6dc8 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4fa6dc8)
#35 0x00000000052c6e48 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x52c6e48)
#36 0x000000000525494d clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x525494d)
#37 0x000000000539b60d clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x539b60d)
#38 0x0000000000d8d50c cc1_main(llvm::ArrayRef, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xd8d50c)
#39 0x0000000000d8420a ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#40 0x0000000000d8438d int llvm::function_ref&)>::callback_fn&)>(long, llvm::SmallVectorImpl&) driver.cpp:0:0
#41 0x000000000501a359 void llvm::function_ref::callback_fn>, std::__cxx11::basic_string, std::allocator>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#42 0x00000000043cf134 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x43cf134)
#43 0x000000000501aec5 clang::driver::CC1Command::Execute(llvm::ArrayRef>, std::__cxx11::basic_string, std::allocator>*, bool*) const (.part.0) Job.cpp:0:0
#44 0x0000000004fd9472 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4fd9472)
#45 0x0000000004fdddd7 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4fdddd7)
#46 0x0000000004fe8265 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4fe8265)
#47 0x0000000000d899fa clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xd899fa)
#48 0x0000000000cc765a main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xcc765a)
#49 0x00007a33d802a1ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#50 0x00007a33d802a28b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#51 0x0000000000d83bb5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xd83bb5)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
Program terminated with signal SIGABRT (6)
Compiler returned: 134
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the reduced C case from the Godbolt link with clang at -O3 and inspect the assertion in llvm/lib/Transforms/Utils/Local.cpp:924. Trace selectIncomingValueForBlock through TryToSimplifyUncondBranchFromEmptyBlock and the JumpThreadingPass, which the stack dump identifies as the failing entry points. Done means the reproducer no longer aborts during optimization.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.