49993 – Clang -O3 crashes in include/llvm/Support/Casting.h:269: typename llvm::cast_retty<X, Y*>::ret_type llvm::cast(Y*) [with X = llvm::SCEVAddRecExpr; Y = const llvm::SCEV; typename llvm::cast_retty<X, Y*>::ret_type = const llvm::SCEVAddRecExpr*]

LLVM Bugzilla is read-only and represents the historical archive of all LLVM issues filled before November 26, 2021. Use github to submit LLVM bugs

Bug 49993 - Clang -O3 crashes in include/llvm/Support/Casting.h:269: typename llvm::cast_retty<X, Y*>::ret_type llvm::cast(Y*) [with X = llvm::SCEVAddRecExpr; Y = const llvm::SCEV; typename llvm::cast_retty<X, Y*>::ret_type = const llvm::SCEVAddRecExpr*]

Summary: Clang -O3 crashes in include/llvm/Support/Casting.h:269: typename llvm::cast_...

Status:	RESOLVED FIXED

Alias:	None

Product:	libraries
Classification:	Unclassified
Component:	Scalar Optimizations (show other bugs)
Version:	trunk
Hardware:	PC Linux

Importance:	P normal
Assignee:	Unassigned LLVM Bugs

URL:
Keywords:

Depends on:
Blocks:

Reported:	2021-04-16 06:24 PDT by Haoxin Tu
Modified:	2021-04-27 05:37 PDT (History)
CC List:	3 users (show)

See Also:
Fixed By Commit(s):	e808289fe643

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Haoxin Tu 2021-04-16 06:24:56 PDT

Hi all.

$cat small.c
#include <stdint.h>
void a() {
  uint8_t *b = a;
  int32_t c;
  if (0)
    for (; c <= 6; c += 1)
    d:;
      for (*b = 18; *b <= 63; *b += 1)
        c %= c + 0xD0C1B2E1;
  goto d;
}


$clang -w -O3 small.c
clang-13: /home/haoxin/haoxin-data/dut-research/compilers/llvm-project/llvm/include/llvm/Support/Casting.h:269: typename llvm::cast_retty<X, Y*>::ret_type llvm::cast(Y*) [with X = llvm::SCEVAddRecExpr; Y = const llvm::SCEV; typename llvm::cast_retty<X, Y*>::ret_type = const llvm::SCEVAddRecExpr*]: Assertion `isa<X>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://bugs.llvm.org/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13 -cc1 -triple x86_64-unknown-linux-gnu -emit-obj --mrelax-relocations -disable-free -main-file-name small.c -mrelocation-model static -mframe-pointer=none -fmath-errno -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/home/haoxin/haoxin-data/test -resource-dir /media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/lib/clang/13.0.0 -c-isystem /usr/local/include/csmith-2.3.0 -cxx-isystem /usr/local/include/csmith-2.3.0 -internal-isystem /media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/lib/clang/13.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/8/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -w -fdebug-compilation-dir=/home/haoxin/haoxin-data/test -ferror-limit 19 -fgnuc-version=4.2.1 -fcolor-diagnostics -vectorize-loops -vectorize-slp -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/small-b9bac0.o -x c small.c
1.	<eof> parser at end of file
2.	Optimizer
 #0 0x00005645a6da25cc llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x35935cc)
 #1 0x00005645a6da03d4 llvm::sys::RunSignalHandlers() (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x35913d4)
 #2 0x00005645a6da0543 SignalHandler(int) Signals.cpp:0:0
 #3 0x00007f4e51044980 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x12980)
 #4 0x00007f4e4fc6cfb7 raise /build/glibc-S9d2JN/glibc-2.27/signal/../sysdeps/unix/sysv/linux/raise.c:51:0
 #5 0x00007f4e4fc6e921 abort /build/glibc-S9d2JN/glibc-2.27/stdlib/abort.c:81:0
 #6 0x00007f4e4fc5e48a __assert_fail_base /build/glibc-S9d2JN/glibc-2.27/assert/assert.c:89:0
 #7 0x00007f4e4fc5e502 (/lib/x86_64-linux-gnu/libc.so.6+0x30502)
 #8 0x00005645a6aec928 (anonymous namespace)::IndVarSimplify::linearFunctionTestReplace(llvm::Loop*, llvm::BasicBlock*, llvm::SCEV const*, llvm::PHINode*, llvm::SCEVExpander&) IndVarSimplify.cpp:0:0
 #9 0x00005645a6aef054 (anonymous namespace)::IndVarSimplify::run(llvm::Loop*) IndVarSimplify.cpp:0:0
#10 0x00005645a6af12bf llvm::IndVarSimplifyPass::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x32e22bf)
#11 0x00005645a7d6edb1 llvm::detail::PassModel<llvm::Loop, llvm::IndVarSimplifyPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x455fdb1)
#12 0x00005645a7ed8e86 llvm::Optional<llvm::PreservedAnalyses> llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runSinglePass<llvm::Loop, std::unique_ptr<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&> > > >(llvm::Loop&, std::unique_ptr<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&> > >&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&, llvm::PassInstrumentation&) (.constprop.159) LoopPassManager.cpp:0:0
#13 0x00005645a7eda300 llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runWithoutLoopNestPasses(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x46cb300)
#14 0x00005645a7eda4f4 llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x46cb4f4)
#15 0x00005645a7edc4cd llvm::FunctionToLoopPassAdaptor::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x46cd4cd)
#16 0x00005645a7d6e721 llvm::detail::PassModel<llvm::Function, llvm::FunctionToLoopPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function> >::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x455f721)
#17 0x00005645a65aafb5 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function> >::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x2d9bfb5)
#18 0x00005645a4c15de1 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function> >, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function> >::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x1406de1)
#19 0x00005645a5d4d128 llvm::CGSCCToFunctionPassAdaptor::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x253e128)
#20 0x00005645a4c16781 llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::CGSCCToFunctionPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x1407781)
#21 0x00005645a5d4575a llvm::PassManager<llvm::LazyCallGraph::SCC, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x253675a)
#22 0x00005645a66ad841 llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::PassManager<llvm::LazyCallGraph::SCC, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x2e9e841)
#23 0x00005645a5d491d6 llvm::DevirtSCCRepeatedPass::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x253a1d6)
#24 0x00005645a66ad801 llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::DevirtSCCRepeatedPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x2e9e801)
#25 0x00005645a5d47127 llvm::ModuleToPostOrderCGSCCPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x2538127)
#26 0x00005645a66ad881 llvm::detail::PassModel<llvm::Module, llvm::ModuleToPostOrderCGSCCPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module> >::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x2e9e881)
#27 0x00005645a65a9e75 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module> >::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x2d9ae75)
#28 0x00005645a66b05cf llvm::ModuleInlinerWrapperPass::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x2ea15cf)
#29 0x00005645a7d6fc71 llvm::detail::PassModel<llvm::Module, llvm::ModuleInlinerWrapperPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module> >::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x4560c71)
#30 0x00005645a65a9e75 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module> >::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x2d9ae75)
#31 0x00005645a7078b71 (anonymous namespace)::EmitAssemblyHelper::EmitAssemblyWithNewPassManager(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream> >) BackendUtil.cpp:0:0
#32 0x00005645a707d32d clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::DataLayout const&, llvm::Module*, clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream> >) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x386e32d)
#33 0x00005645a7d0e326 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x44ff326)
#34 0x00005645a887f149 clang::ParseAST(clang::Sema&, bool, bool) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x5070149)
#35 0x00005645a7d0d0e8 clang::CodeGenAction::ExecuteAction() (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x44fe0e8)
#36 0x00005645a7697619 clang::FrontendAction::Execute() (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x3e88619)
#37 0x00005645a76355a1 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x3e265a1)
#38 0x00005645a775f440 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x3f50440)
#39 0x00005645a4981574 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x1172574)
#40 0x00005645a497da77 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&) driver.cpp:0:0
#41 0x00005645a48ab0f4 main (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x109c0f4)
#42 0x00007f4e4fc4fbf7 __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:344:0
#43 0x00005645a497d4da _start (/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin/clang-13+0x116e4da)
clang-13: error: unable to execute command: Aborted (core dumped)
clang-13: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 13.0.0 (https://github.com/llvm/llvm-project f7c9de0de5804498085af973dc6bfc934a18f000)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/haoxin/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin
clang-13: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-13: note: diagnostic msg: /tmp/small-80b913.c
clang-13: note: diagnostic msg: /tmp/small-80b913.sh
clang-13: note: diagnostic msg: 

********************

$clang -v
clang version 13.0.0 (https://github.com/llvm/llvm-project f7c9de0de5804498085af973dc6bfc934a18f000)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/haoxin/haoxin-data/dut-research/compilers/llvm-project/build-20210416/bin
Found candidate GCC installation: /usr/lib/gcc/i686-linux-gnu/6
Found candidate GCC installation: /usr/lib/gcc/i686-linux-gnu/6.5.0
Found candidate GCC installation: /usr/lib/gcc/i686-linux-gnu/7
Found candidate GCC installation: /usr/lib/gcc/i686-linux-gnu/7.5.0
Found candidate GCC installation: /usr/lib/gcc/i686-linux-gnu/8
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/7
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/7.5.0
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/8
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/8
Candidate multilib: .;@m64
Selected multilib: .;@m64

Thanks,
Haoxin

Comment 1 Sanjay Patel 2021-04-21 12:36:43 PDT

bugpoint reduced IR that crashes with "opt -indvars":

target datalayout = "e-m:o-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"

define void @a() {
entry:
  br label %if.end

d:                                                
  %c.0 = phi i32 [ %add, %d ], [ %rem.45, %if.end ]
  %add = add nsw i32 %c.0, 1
  %cmp = icmp slt i32 %c.0, 6
  br i1 %cmp, label %d, label %if.end.loopexit

if.end.loopexit:                                  
  unreachable

if.end:                                           
  %rem.38 = urem i32 undef, undef
  %add5.39 = add i32 %rem.38, -792612127
  %rem.39 = urem i32 %rem.38, %add5.39
  %add5.40 = add i32 %rem.39, -792612127
  %rem.40 = urem i32 %rem.39, %add5.40
  %rem.41 = urem i32 %rem.40, undef
  %rem.42 = urem i32 %rem.41, undef
  %rem.43 = urem i32 %rem.42, undef
  %rem.44 = urem i32 %rem.43, undef
  %rem.45 = urem i32 %rem.44, undef
  br label %d
}

Comment 2 Sanjay Patel 2021-04-26 06:02:42 PDT

https://reviews.llvm.org/D101291

Comment 3 Sanjay Patel 2021-04-27 05:37:48 PDT

https://reviews.llvm.org/rGe808289fe643