Created attachment 23172 [details] Minimal example The following code seems to cause clang and clang-cl, 9.0.0 and trunk, to crash: intrusive_ptr<C> a; try { a = mk(); mk(); } catch (...) { } Debug logs show INSTCOMBINE ITERATION #1 on ?crash@@YAXXZ IC: ADDING: 27 instrs to worklist IC: Visiting: %call1 = invoke %struct.C* @"?mk@@YAPEAUC@@XZ"() to label %invoke.cont2 unwind label %catch.dispatch IC: Visiting: %a.sroa.0.0 = phi i64 [ %0, %invoke.cont2 ], [ 0, %entry ] IC: Visiting: %1 = catchswitch within none [label %catch] unwind label %ehcleanup IC: Visiting: %2 = catchpad within %1 [i8* null, i32 64, i8* null] IC: Visiting: catchret from %2 to label %try.cont IC: Visiting: %a.sroa.0.1 = phi i64 [ %0, %invoke.cont2 ], [ %a.sroa.0.0, %catch ] IC: ADD: %a.sroa.0.1.ptr = phi %struct.C* Assertion failed: !NodePtr->isKnownSentinel(), file C:\src\llvm_package_2663a25f\llvm-project\llvm\include\llvm/ADT/ilist_iterator.h, line 139 I've attached the logs and full trimmed down source. Thanks.
Created attachment 23173 [details] Build log
Created attachment 23174 [details] Run script
I suspect the problematic code was introduced here (2017): https://reviews.llvm.org/D37832#inline-686315 It assumes getFirstInsertionPt always points to an Instruction*, and not an end iterator.
Proposed fix: https://reviews.llvm.org/D75381
Pushed as 1adbe86d87bd4ecffc73ab17c7da56f44816f424. Marked as a 10.0 blocker to see if Hans wants to merge it. I think it's fairly safe, it adds some conditions in which instcombine will not attempt to do a transform.
(In reply to Reid Kleckner from comment #5) > Pushed as 1adbe86d87bd4ecffc73ab17c7da56f44816f424. > > Marked as a 10.0 blocker to see if Hans wants to merge it. I think it's > fairly safe, it adds some conditions in which instcombine will not attempt > to do a transform. Okay, it seems safe enough. Pushed to 10.x as 0bf4795d069642afe2a430521f3549e425f092c9. Please let me know if there are any follow-ups.