illegal instruction crash

[mlubin]

I've run into an Illegal instruction (core dumped) crash by trying to run some old code. I can reproduce the crash on two linux 64-bit machines using 1613b3b.

I've removed much of the surrounding code to get a 150-line test case which always crashes: https://gist.github.com/mlubin/6095957. JuMP must be installed. Unfortunately I couldn't simplify it any more than this.

The GDB backtrace isn't very helpful:

Program received signal SIGILL, Illegal instruction.
0x00007ffff33061fa in ?? ()
(gdb) backtrace
#0  0x00007ffff33061fa in ?? ()
#1  0x0000000004886cb0 in ?? ()
#2  0x0000000000000040 in ?? ()
#3  0x00007fffffffd360 in ?? ()
#4  0x0000000004db4700 in ?? ()
#5  0x0000000004db4670 in ?? ()
#6  0x00000000028f4140 in ?? ()
#7  0x0000000004db45b0 in ?? ()
#8  0x0000000002320a40 in ?? ()
#9  0x00000000068502d0 in ?? ()
#10 0x0000000002bbde40 in ?? ()
#11 0x0000000000000000 in ?? ()

[vtjnash]

llvm is generating an instruction there defined to be undefined.
If we turn on the function verifier, we can almost see why:

julia> disassemble(dobench,())
Instruction does not dominate all uses!
  %142 = load %jl_value_t** %58, !dbg !8625
  %185 = bitcast %jl_value_t* %142 to %jl_value_t**, !dbg !8630
Instruction does not dominate all uses!
  %142 = load %jl_value_t** %58, !dbg !8625
  call void @jl_type_error_rt(i8* getelementptr inbounds ([8 x i8]* @_j_str301, i32 0, i32 0), i8* getelementptr inbounds ([6 x i8]* @_j_str19, i32 0, i32 0), %jl_value_t* inttoptr (i64 4328618496 to %jl_value_t*), %jl_value_t* %142), !dbg !8630
Instruction does not dominate all uses!
  %142 = load %jl_value_t** %58, !dbg !8625
  %191 = bitcast %jl_value_t* %142 to %jl_value_t**, !dbg !8630
Instruction does not dominate all uses!
  %142 = load %jl_value_t** %58, !dbg !8625
  %202 = call %jl_value_t* %194(%jl_value_t* %142, %jl_value_t** %201, i32 2), !dbg !8630
Broken module found, compilation aborted!
Stack dump:
0.  Running pass 'Module Verifier' on function '@julia_dobench'
Illegal instruction: 4
~/Documents/no-backup/julia$ 

Doing some manual digging, the fault is in line 138, which is finfer'd as follows:

        elts::Union(Undef,Function)(xval::Union(AbstractArray{T,N},Undef),nzval::Union(Undef,Array{Float64,1}))

[vtjnash]

simplified test-case:

julia> function f()
         local x     
         for i = 1:10
           x = println
         end
         x("hi")
       end
# methods for generic function f
f() at none:2

verifier on:

julia> f()
Instruction does not dominate all uses!
  %12 = load %jl_value_t** inttoptr (i64 4357935664 to %jl_value_t**), !dbg !4985
  %15 = bitcast %jl_value_t* %12 to %jl_value_t**, !dbg !4986
Instruction does not dominate all uses!
  %12 = load %jl_value_t** inttoptr (i64 4357935664 to %jl_value_t**), !dbg !4985
  call void @jl_type_error_rt(i8* getelementptr inbounds ([2 x i8]* @_j_str209, i32 0, i32 0), i8* getelementptr inbounds ([6 x i8]* @_j_str19, i32 0, i32 0), %jl_value_t* inttoptr (i64 4328618496 to %jl_value_t*), %jl_value_t* %12), !dbg !4986
Instruction does not dominate all uses!
  %12 = load %jl_value_t** inttoptr (i64 4357935664 to %jl_value_t**), !dbg !4985
  %21 = bitcast %jl_value_t* %12 to %jl_value_t**, !dbg !4986
Instruction does not dominate all uses!
  %12 = load %jl_value_t** inttoptr (i64 4357935664 to %jl_value_t**), !dbg !4985
  %27 = call %jl_value_t* %24(%jl_value_t* %12, %jl_value_t** %26, i32 1), !dbg !4986
Broken module found, compilation aborted!
Stack dump:
0.  Running pass 'Module Verifier' on function '@julia_f'
Illegal instruction: 4

verifier off (assertions on):

julia> f()
Assertion failed: (L->isLCSSAForm(*DT)), function runOnLoop, file /Users/jameson/Documents/no-backup/julia/deps/llvm-3.2/lib/Transforms/Utils/LCSSA.cpp, line 170.
Stack dump:
0.  Running pass 'Loop Pass Manager' on function '@julia_f1142'
1.  Running pass 'Loop-Closed SSA Form Pass' on basic block '%L'
Illegal instruction: 4

[mlubin]

Nice digging!