clang crashes under -O3 in llvm-project/llvm/lib/Transforms/Scalar/LoopStrengthReduce.cpp:516: void {anonymous}::Formula::canonicalize(const llvm::Loop&): Assertion `!BaseRegs.empty() && "1*reg => reg, should not be needed."' failed.


Bugzilla Link	PR49697
Status	NEW
Importance	P normal
Reported by	Haoxin Tu (haoxintu@gmail.com)
Reported on	2021-03-23 07:42:13 -0700
Last modified on	2021-08-25 09:59:56 -0700
Version	trunk
Hardware	PC Linux
CC	llvm-bugs@lists.llvm.org, ty1208chiang@gmail.com
Fixed by commit(s)
Attachments
Blocks
Blocked by
See also	PR50325

Hi all.

Clang crashes on the valid code under -O3. Note that this issue only occurs in
the current trunk version of clang while released versions of clang handle it
well.

$cat small.c
#include <stdint.h>
int a;
int8_t b;
void c() {
  for (b = 8; b <= 6;)
    ;
  int d = -4;
  while (d < 20) {
    d += 5;
    int e = 7;
    do {
      int f = 7;
      a = b;
      while (f--)
        for (b = 20; b <= 30; b++) {
          int8_t *g = &b;
          (*g -= a) || 0 > g < g;
        }
    } while (e--);
  }
}

$clang -w -O3 small.c
clang: /home/haoxin/haoxin-data/dut-research/compilers/llvm-
project/llvm/lib/Transforms/Scalar/LoopStrengthReduce.cpp:516: void
{anonymous}::Formula::canonicalize(const llvm::Loop&): Assertion
`!BaseRegs.empty() && "1*reg => reg, should not be needed."' failed.
PLEASE submit a bug report to https://bugs.llvm.org/ and include the crash
backtrace, preprocessed source, and associated run script.
Stack dump:
0.  Program arguments: clang -w -c -O3 small.c
1.  <eof> parser at end of file
2.  Code generation
3.  Running pass 'Function Pass Manager' on module 'small.c'.
4.  Running pass 'Loop Pass Manager' on function '@c'
5.  Running pass 'Loop Strength Reduction' on basic block '%for.body11.6.1'
 #0 0x00005629c94918ac llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x345f8ac)
 #1 0x00005629c948f4e4 llvm::sys::RunSignalHandlers() (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x345d4e4)
 #2 0x00005629c948f77b llvm::sys::CleanupOnSignal(unsigned long) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x345d77b)
 #3 0x00005629c93ec738 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #4 0x00007f6a94406980 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x12980)
 #5 0x00007f6a9302efb7 raise /build/glibc-S9d2JN/glibc-2.27/signal/../sysdeps/unix/sysv/linux/raise.c:51:0
 #6 0x00007f6a93030921 abort /build/glibc-S9d2JN/glibc-2.27/stdlib/abort.c:81:0
 #7 0x00007f6a9302048a __assert_fail_base /build/glibc-S9d2JN/glibc-2.27/assert/assert.c:89:0
 #8 0x00007f6a93020502 (/lib/x86_64-linux-gnu/libc.so.6+0x30502)
 #9 0x00005629c926a39a (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x323839a)
#10 0x00005629c9274c95 (anonymous
namespace)::LSRInstance::GenerateReassociationsImpl((anonymous
namespace)::LSRUse&, unsigned int, (anonymous namespace)::Formula const&,
unsigned int, unsigned long, bool) LoopStrengthReduce.cpp:0:0
#11 0x00005629c9274d6d (anonymous
namespace)::LSRInstance::GenerateReassociationsImpl((anonymous
namespace)::LSRUse&, unsigned int, (anonymous namespace)::Formula const&,
unsigned int, unsigned long, bool) LoopStrengthReduce.cpp:0:0
#12 0x00005629c927e57a (anonymous
namespace)::LSRInstance::GenerateAllReuseFormulae() LoopStrengthReduce.cpp:0:0
#13 0x00005629c9287652 (anonymous
namespace)::LSRInstance::LSRInstance(llvm::Loop*, llvm::IVUsers&,
llvm::ScalarEvolution&, llvm::DominatorTree&, llvm::LoopInfo&,
llvm::TargetTransformInfo const&, llvm::AssumptionCache&,
llvm::TargetLibraryInfo&, llvm::MemorySSAUpdater*) LoopStrengthReduce.cpp:0:0
#14 0x00005629c928a267 ReduceLoopStrength(llvm::Loop*, llvm::IVUsers&,
llvm::ScalarEvolution&, llvm::DominatorTree&, llvm::LoopInfo&,
llvm::TargetTransformInfo const&, llvm::AssumptionCache&,
llvm::TargetLibraryInfo&, llvm::MemorySSA*) LoopStrengthReduce.cpp:0:0
#15 0x00005629c928cdba (anonymous
namespace)::LoopStrengthReduce::runOnLoop(llvm::Loop*, llvm::LPPassManager&)
LoopStrengthReduce.cpp:0:0
#16 0x00005629c8521833 llvm::LPPassManager::runOnFunction(llvm::Function&)
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x24ef833)
#17 0x00005629c8c4eca4 llvm::FPPassManager::runOnFunction(llvm::Function&)
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x2c1cca4)
#18 0x00005629c8c4f7e9 llvm::FPPassManager::runOnModule(llvm::Module&)
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x2c1d7e9)
#19 0x00005629c8c4e5c1 llvm::legacy::PassManagerImpl::run(llvm::Module&)
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x2c1c5c1)
#20 0x00005629c975422b (anonymous
namespace)::EmitAssemblyHelper::EmitAssemblyWithNewPassManager(clang::BackendAction,
std::unique_ptr<llvm::raw_pwrite_stream,
std::default_delete<llvm::raw_pwrite_stream> >) BackendUtil.cpp:0:0
#21 0x00005629c97574f5 clang::EmitBackendOutput(clang::DiagnosticsEngine&,
clang::HeaderSearchOptions const&, clang::CodeGenOptions const&,
clang::TargetOptions const&, clang::LangOptions const&, llvm::DataLayout
const&, llvm::Module*, clang::BackendAction,
std::unique_ptr<llvm::raw_pwrite_stream,
std::default_delete<llvm::raw_pwrite_stream> >)
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x37254f5)
#22 0x00005629ca3d3816
clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&)
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x43a1816)
#23 0x00005629caf38969 clang::ParseAST(clang::Sema&, bool, bool)
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x4f06969)
#24 0x00005629ca3d25d8 clang::CodeGenAction::ExecuteAction()
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x43a05d8)
#25 0x00005629c9d60ab9 clang::FrontendAction::Execute()
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x3d2eab9)
#26 0x00005629c9cfe6f1
clang::CompilerInstance::ExecuteAction(clang::FrontendAction&)
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x3ccc6f1)
#27 0x00005629c9e28df0
clang::ExecuteCompilerInvocation(clang::CompilerInstance*)
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x3df6df0)
#28 0x00005629c70800f4 cc1_main(llvm::ArrayRef<char const*>, char const*,
void*) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-
project/build-20210321/bin/clang-13+0x104e0f4)
#29 0x00005629c707c657 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&)
driver.cpp:0:0
#30 0x00005629c9bb00a5 void llvm::function_ref<void
()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<llvm::Optional<llvm::StringRef>
>, std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> >*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#31 0x00005629c93ec8b2
llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>)
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x33ba8b2)
#32 0x00005629c9bb13ec
clang::driver::CC1Command::Execute(llvm::ArrayRef<llvm::Optional<llvm::StringRef>
>, std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> >*, bool*) const (.part.186) Job.cpp:0:0
#33 0x00005629c9b89309
clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&,
clang::driver::Command const*&) const (/media/haoxin/SeagateData/haoxin-
data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x3b57309)
#34 0x00005629c9b89de7
clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&,
llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*> >&) const
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x3b57de7)
#35 0x00005629c9b92c49
clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&,
llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*> >&)
(/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210321/bin/clang-13+0x3b60c49)
#36 0x00005629c6faaf8e main (/media/haoxin/SeagateData/haoxin-data/dut-
research/compilers/llvm-project/build-20210321/bin/clang-13+0xf78f8e)
#37 0x00007f6a93011bf7 __libc_start_main /build/glibc-S9d2JN/glibc-
2.27/csu/../csu/libc-start.c:344:0
#38 0x00005629c707c0da _start (/media/haoxin/SeagateData/haoxin-data/dut-
research/compilers/llvm-project/build-20210321/bin/clang-13+0x104a0da)
clang-13: error: clang frontend command failed with exit code 134 (use -v to
see invocation)
clang version 13.0.0 (https://github.com/llvm/llvm-project
613157dd67ddddc1bbb1e87236efd389358b281b)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/haoxin/haoxin-data/dut-research/compilers/llvm-
project/build-20210321/bin
clang-13: note: diagnostic msg:
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-13: note: diagnostic msg: /tmp/small-d37230.c
clang-13: note: diagnostic msg: /tmp/small-d37230.sh
clang-13: note: diagnostic msg:

********************

Thanks,
Haoxin

This case also still crashes, too.

$clang -w -O3 samll.c
PLEASE submit a bug report to https://bugs.llvm.org/ and include the crash
backtrace, preprocessed source, and associated run script.
Stack dump:
0.  Program arguments: /home/haoxin/haoxin-data/compilers/llvm-
project/build/bin/clang-14 -cc1 -triple x86_64-unknown-linux-gnu -emit-obj --
mrelax-relocations -disable-free -main-file-name test.c -mrelocation-model
static -mframe-pointer=none -fmath-errno -fno-rounding-math -mconstructor-
aliases -munwind-tables -target-cpu x86-64 -tune-cpu generic -debugger-
tuning=gdb -fcoverage-compilation-dir=/home/haoxin/haoxin-data/test -resource-
dir /home/haoxin/haoxin-data/compilers/llvm-project/build/lib/clang/14.0.0 -
internal-isystem /home/haoxin/haoxin-data/compilers/llvm-
project/build/lib/clang/14.0.0/include -internal-isystem /usr/local/include -
internal-isystem /usr/lib/gcc/x86_64-linux-gnu/9/../../../../x86_64-linux-
gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-
externc-isystem /include -internal-externc-isystem /usr/include -O3 -w -fdebug-
compilation-dir=/home/haoxin/haoxin-data/test -ferror-limit 19 -fgnuc-
version=4.2.1 -fcolor-diagnostics -vectorize-loops -vectorize-slp -faddrsig -
D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/test-d93eba.o -x c test.c
1.  <eof> parser at end of file
2.  Code generation
3.  Running pass 'Function Pass Manager' on module 'test.c'.
4.  Running pass 'Loop Pass Manager' on function '@c'
5.  Running pass 'Loop Strength Reduction' on basic block '%for.body11.6.3.1'
 #0 0x000055b5d1d9b354 PrintStackTraceSignalHandler(void*) (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x3b32354)
 #1 0x000055b5d1d98a6e SignalHandler(int) (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x3b2fa6e)
 #2 0x00007f7fbdfb43c0 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x153c0)
 #3 0x000055b5d0d09a92 llvm::ScalarEvolution::computeBlockDisposition(llvm::SCEV const*, llvm::BasicBlock const*) (.localalias) (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x2aa0a92)
 #4 0x000055b5d0d09619 llvm::ScalarEvolution::getBlockDisposition(llvm::SCEV const*, llvm::BasicBlock const*) (.localalias) (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x2aa0619)
 #5 0x000055b5d0d099dd llvm::ScalarEvolution::properlyDominates(llvm::SCEV const*, llvm::BasicBlock const*) (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x2aa09dd)
 #6 0x000055b5d1b53b4e (anonymous namespace)::LSRInstance::GenerateAllReuseFormulae() (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x38eab4e)
 #7 0x000055b5d1b5ce69 (anonymous namespace)::LSRInstance::LSRInstance(llvm::Loop*, llvm::IVUsers&, llvm::ScalarEvolution&, llvm::DominatorTree&, llvm::LoopInfo&, llvm::TargetTransformInfo const&, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::MemorySSAUpdater*) (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x38f3e69)
 #8 0x000055b5d1b60356 ReduceLoopStrength(llvm::Loop*, llvm::IVUsers&, llvm::ScalarEvolution&, llvm::DominatorTree&, llvm::LoopInfo&, llvm::TargetTransformInfo const&, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::MemorySSA*) (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x38f7356)
 #9 0x000055b5d1b6298f (anonymous namespace)::LoopStrengthReduce::runOnLoop(llvm::Loop*, llvm::LPPassManager&) (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x38f998f)
#10 0x000055b5d0c60a13 llvm::LPPassManager::runOnFunction(llvm::Function&)
(.localalias) (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-
14+0x29f7a13)
#11 0x000055b5d1448c65 llvm::FPPassManager::runOnFunction(llvm::Function&)
(.localalias) (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-
14+0x31dfc65)
#12 0x000055b5d1448ea9 llvm::FPPassManager::runOnModule(llvm::Module&)
(.localalias) (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-
14+0x31dfea9)
#13 0x000055b5d1449f92 llvm::legacy::PassManagerImpl::run(llvm::Module&)
(.localalias) (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-
14+0x31e0f92)
#14 0x000055b5d20df82a (anonymous
namespace)::EmitAssemblyHelper::EmitAssemblyWithNewPassManager(clang::BackendAction,
std::unique_ptr<llvm::raw_pwrite_stream,
std::default_delete<llvm::raw_pwrite_stream> >) (/home/haoxin/haoxin-
data/compilers/llvm-project/build/bin/clang-14+0x3e7682a)
#15 0x000055b5d20e135d clang::EmitBackendOutput(clang::DiagnosticsEngine&,
clang::HeaderSearchOptions const&, clang::CodeGenOptions const&,
clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef,
llvm::Module*, clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream,
std::default_delete<llvm::raw_pwrite_stream> >) (/home/haoxin/haoxin-
data/compilers/llvm-project/build/bin/clang-14+0x3e7835d)
#16 0x000055b5d2f4520f
clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&)
(/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x4cdc20f)
#17 0x000055b5d3cb06b9 clang::ParseAST(clang::Sema&, bool, bool) (.localalias)
(/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x5a476b9)
#18 0x000055b5d2f43d48 clang::CodeGenAction::ExecuteAction() (.localalias)
(/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x4cdad48)
#19 0x000055b5d27d7ba9 clang::FrontendAction::Execute() (/home/haoxin/haoxin-
data/compilers/llvm-project/build/bin/clang-14+0x456eba9)
#20 0x000055b5d276d2be
clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (.localalias)
(/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x45042be)
#21 0x000055b5d28b69c0
clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/home/haoxin/haoxin-
data/compilers/llvm-project/build/bin/clang-14+0x464d9c0)
#22 0x000055b5cf5ab6bd cc1_main(llvm::ArrayRef<char const*>, char const*,
void*) (/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-
14+0x13426bd)
#23 0x000055b5cf5a7a08 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&)
(/home/haoxin/haoxin-data/compilers/llvm-project/build/bin/clang-14+0x133ea08)
#24 0x000055b5cf4dcac9 main (/home/haoxin/haoxin-data/compilers/llvm-
project/build/bin/clang-14+0x1273ac9)
#25 0x00007f7fbda340b3 __libc_start_main /build/glibc-eX1tMB/glibc-
2.31/csu/../csu/libc-start.c:342:3
#26 0x000055b5cf5a757e _start (/home/haoxin/haoxin-data/compilers/llvm-
project/build/bin/clang-14+0x133e57e)
clang-14: error: unable to execute command: Segmentation fault (core dumped)
clang-14: error: clang frontend command failed due to signal (use -v to see
invocation)
clang version 14.0.0 (https://github.com/llvm/llvm-project
5541a05d6a5a74424dd6d98cfb6d9014a5fb17ca)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/haoxin/haoxin-data/compilers/llvm-project/build/bin
clang-14: note: diagnostic msg:
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-14: note: diagnostic msg: /tmp/test-1fdfa4.c
clang-14: note: diagnostic msg: /tmp/test-1fdfa4.sh
clang-14: note: diagnostic msg:

********************

Quuxplusone / LLVMBugzillaTest

clang crashes under -O3 in llvm-project/llvm/lib/Transforms/Scalar/LoopStrengthReduce.cpp:516: void {anonymous}::Formula::canonicalize(const llvm::Loop&): Assertion `!BaseRegs.empty() && "1*reg => reg, should not be needed."' failed. #48666