compile-time crash with virtual inheritance

LLVM r159521

% cat tsan-bug.cc 
struct AAA              {  virtual long aaa (); };
struct BBB: virtual AAA { unsigned long bbb; };
struct CCC: virtual AAA { };
struct DDD: CCC, BBB { DDD (); };
DDD::DDD()  { }

% clang -O2 -c -fthread-sanitizer tsan-bug.cc 
clang: /home/kcc/llvm/lib/VMCore/Constants.cpp:1366: static llvm::Constant 
*llvm::ConstantExpr::getCast(unsigned int, llvm::Constant *, llvm::Type *): 
Assertion `CastInst::castIsValid(opc, C, Ty) && "Invalid constantexpr cast!"' 
failed.

The assertion happens here: 

bool ThreadSanitizer::instrumentLoadOrStore(Instruction *I) {                   

...
  if (IsWrite && isVtableAccess(I)) {                                                                                                                                                               
    Value *StoredValue = cast<StoreInst>(I)->getValueOperand();                                                                                                                                     
    IRB.CreateCall2(TsanVptrUpdate,                                                                                                                                                                 
                    IRB.CreatePointerCast(Addr, IRB.getInt8PtrTy()),                                                                                                                                
                    IRB.CreatePointerCast(StoredValue, IRB.getInt8PtrTy())); <<<<<<<<<<<<<<<<

The IR looks like this: 
  store i64 ptrtoint (i8** getelementptr inbounds ([9 x i8*]* @_ZTC3DDD8_3BBB, i64 0, i64 8) to i64), i64* %add.ptr.i, align 8, !tbaa !0

!0 = metadata !{metadata !"vtable pointer", metadata !1}

So, we have a store which is marked as "vtable pointer" but which is actually 
not a pointer store.

Investigating.

Original issue reported on code.google.com by konstant...@gmail.com on 4 Jul 2012 at 12:23

Ramki-Ravindran / thread-sanitizer

compile-time crash with virtual inheritance #3