Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

A/F: "cannot get DomTreeNode of block with different parent" after 8101d18 #102784

Closed
dyung opened this issue Aug 11, 2024 · 0 comments · Fixed by #102782
Closed

A/F: "cannot get DomTreeNode of block with different parent" after 8101d18 #102784

dyung opened this issue Aug 11, 2024 · 0 comments · Fixed by #102782
Labels
crash Prefer [crash-on-valid] or [crash-on-invalid] llvm:support llvm:transforms

Comments

@dyung
Copy link
Collaborator

dyung commented Aug 11, 2024

After commit 8101d18 was merged into our downstream repo, we started to see assertion failures in many of our tests, and it seems many buildbots also hit the same assertion failure.

Here is a reduced version of one of our internal tests that hits the assertion failure:

/* repro.cpp */
#define a() struct
using b = float;
a() c { b d; };
using n = b;
void e(n *, long, long);
long f;
float *g;
void h(n *i, long j) {
  for (long k; f; ++k)
    for (long l = 0; l < j; ++l)
      g[l * k] = i[l];
  c input[]{{}, {}, {}, {}, {}, {}, {}, 15.1f, 16.1f};
  e(reinterpret_cast<b *>(input), 2, 6);
}
void m() {
  c input[]{16.1f};
  h(reinterpret_cast<b *>(input), 6);
}

When compiled with optimizations using a compiler built from 9bb7c11 (the change immediately preceding 8101d18) there is no assertion failure and it succeeds (although the assertion failure was added in the mentioned commit so it makes sense the previous commit would not hit it, but I digress):

$ ~/src/upstream/9bb7c11-linux/bin/clang -c -O2 repro.cpp
$

When compiled with optimizations using a compiler built from 8101d18, we see an assertion failure during the compilation:

$ ~/src/upstream/8101d18-linux/bin/clang -c -O2 repro.cpp
clang: /home/dyung/src/upstream/llvm_clean_git/llvm/include/llvm/Support/GenericDomTree.h:400: llvm::DomTreeNodeBase<NodeT>* llvm::DominatorTreeBase<NodeT, IsPostDom>::getNode(const NodeT*) const [with NodeT = llvm::BasicBlock; bool IsPostDom = false]: Assertion `(!BB || Parent == NodeTrait::getParent(const_cast<NodeT *>(BB))) && "cannot get DomTreeNode of block with different parent"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: /home/dyung/src/upstream/8101d18-linux/bin/clang -c -O2 repro.cpp
1.      <eof> parser at end of file
2.      Optimizer
3.      Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-use-loop-info;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-use-loop-info;no-verify-fixpoint>,loop-unroll<O2>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-use-loop-info;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "repro.cpp"
4.      Running pass "slp-vectorizer" on function "_Z1hPfl"
 #0 0x000055dca663cc2f llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x421bc2f)
 #1 0x000055dca663a78c llvm::sys::CleanupOnSignal(unsigned long) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x421978c)
 #2 0x000055dca657e5b8 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007fc7a7875420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #4 0x00007fc7a734200b raise /build/glibc-LcI20x/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
 #5 0x00007fc7a7321859 abort /build/glibc-LcI20x/glibc-2.31/stdlib/abort.c:81:7
 #6 0x00007fc7a7321729 get_sysdep_segment_value /build/glibc-LcI20x/glibc-2.31/intl/loadmsgcat.c:509:8
 #7 0x00007fc7a7321729 _nl_load_domain /build/glibc-LcI20x/glibc-2.31/intl/loadmsgcat.c:970:34
 #8 0x00007fc7a7332fd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
 #9 0x000055dca5ee216f llvm::DominatorTreeBase<llvm::BasicBlock, false>::getNode(llvm::BasicBlock const*) const (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x3ac116f)
#10 0x000055dca565e011 llvm::ScalarEvolution::getOperandsToCreate(llvm::Value*, llvm::SmallVectorImpl<llvm::Value*>&) (.part.0) ScalarEvolution.cpp:0:0
#11 0x000055dca5674fd0 llvm::ScalarEvolution::createSCEVIter(llvm::Value*) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x3253fd0)
#12 0x000055dca559632e llvm::getPointersDiff(llvm::Type*, llvm::Value*, llvm::Type*, llvm::Value*, llvm::DataLayout const&, llvm::ScalarEvolution&, bool, bool) (.part.0) LoopAccessAnalysis.cpp:0:0
#13 0x000055dca7fba08c llvm::slpvectorizer::BoUpSLP::canFormVector(llvm::ArrayRef<llvm::StoreInst*>, llvm::SmallVector<unsigned int, 4u>&) const (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x5b9908c)
#14 0x000055dca7fba607 llvm::slpvectorizer::BoUpSLP::findExternalStoreUsersReorderIndices(llvm::slpvectorizer::BoUpSLP::TreeEntry*) const (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x5b99607)
#15 0x000055dca7ffce00 llvm::slpvectorizer::BoUpSLP::reorderTopToBottom() (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x5bdbe00)
#16 0x000055dca8019c10 llvm::SLPVectorizerPass::vectorizeStoreChain(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP&, unsigned int, unsigned int, unsigned int&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x5bf8c10)
#17 0x000055dca801b3f6 llvm::SLPVectorizerPass::vectorizeStores(llvm::ArrayRef<llvm::StoreInst*>, llvm::slpvectorizer::BoUpSLP&, llvm::DenseSet<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, llvm::DenseMapInfo<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, void>>&)::'lambda'(std::set<std::pair<unsigned int, int>, llvm::SLPVectorizerPass::vectorizeStores(llvm::ArrayRef<llvm::StoreInst*>, llvm::slpvectorizer::BoUpSLP&, llvm::DenseSet<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, llvm::DenseMapInfo<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, void>>&)::StoreDistCompare, std::allocator<std::pair<unsigned int, int>>> const&)::operator()(std::set<std::pair<unsigned int, int>, llvm::SLPVectorizerPass::vectorizeStores(llvm::ArrayRef<llvm::StoreInst*>, llvm::slpvectorizer::BoUpSLP&, llvm::DenseSet<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, llvm::DenseMapInfo<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, void>>&)::StoreDistCompare, std::allocator<std::pair<unsigned int, int>>> const&) const SLPVectorizer.cpp:0:0
#18 0x000055dca801d2c8 llvm::SLPVectorizerPass::vectorizeStores(llvm::ArrayRef<llvm::StoreInst*>, llvm::slpvectorizer::BoUpSLP&, llvm::DenseSet<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, llvm::DenseMapInfo<std::tuple<llvm::Value*, llvm::Value*, llvm::Value*, llvm::Value*, unsigned int>, void>>&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x5bfc2c8)
#19 0x000055dca801db51 llvm::SLPVectorizerPass::vectorizeStoreChains(llvm::slpvectorizer::BoUpSLP&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x5bfcb51)
#20 0x000055dca801f02d llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (.part.0) SLPVectorizer.cpp:0:0
#21 0x000055dca801fb23 llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x5bfeb23)
#22 0x000055dca7ad9906 llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x56b8906)
#23 0x000055dca5fdccb1 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x3bbbcb1)
#24 0x000055dca3b614b6 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x17404b6)
#25 0x000055dca5fdb5ed llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x3bba5ed)
#26 0x000055dca3b625a6 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x17415a6)
#27 0x000055dca5fd9751 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x3bb8751)
#28 0x000055dca68f1d00 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#29 0x000055dca68f506c (anonymous namespace)::EmitAssemblyHelper::EmitAssembly(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) BackendUtil.cpp:0:0
#30 0x000055dca68f56e6 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x44d46e6)
#31 0x000055dca6f921fc clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x4b711fc)
#32 0x000055dca8dcd5ec clang::ParseAST(clang::Sema&, bool, bool) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x69ac5ec)
#33 0x000055dca6f92608 clang::CodeGenAction::ExecuteAction() (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x4b71608)
#34 0x000055dca722a959 clang::FrontendAction::Execute() (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x4e09959)
#35 0x000055dca71ac7ce clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x4d8b7ce)
#36 0x000055dca73171a6 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x4ef61a6)
#37 0x000055dca37363a5 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x13153a5)
#38 0x000055dca372f39a ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#39 0x000055dca6fd780d void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#40 0x000055dca657eac0 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x415dac0)
#41 0x000055dca6fd7e2f clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#42 0x000055dca6f9c38c clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x4b7b38c)
#43 0x000055dca6f9ce1d clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x4b7be1d)
#44 0x000055dca6fa5125 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x4b84125)
#45 0x000055dca37335fb clang_main(int, char**, llvm::ToolContext const&) (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x13125fb)
#46 0x000055dca362305b main (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x120205b)
#47 0x00007fc7a7323083 __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/../csu/libc-start.c:342:3
#48 0x000055dca372ee2e _start (/home/dyung/src/upstream/8101d18-linux/bin/clang+0x130de2e)
clang: error: clang frontend command failed with exit code 134 (use -v to see invocation)
clang version 20.0.0 (https://github.com/llvm/llvm-project.git 8101d1863cc3a6ca0ca49962903f2d7651b25659)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/dyung/src/upstream/8101d18-linux/bin
Build config: +assertions
@EugeneZelenko EugeneZelenko added crash Prefer [crash-on-valid] or [crash-on-invalid] llvm:transforms and removed new issue labels Aug 11, 2024
bwendling pushed a commit to bwendling/llvm-project that referenced this issue Aug 15, 2024
A dominance query of a block that is in a different function is
ill-defined, so assert that getNode() is only called for blocks that are
in the same function.

There are three cases, where this behavior did occur. LoopFuse didn't
explicitly do this, but didn't invalidate the SCEV block dispositions,
leaving dangling pointers to free'ed basic blocks behind, causing
use-after-free. We do, however, want to be able to dereference basic
blocks inside the dominator tree, so that we can refer to them by a
number stored inside the basic block.

Reverts llvm#102780
Reland llvm#101198
Fixes llvm#102784

Co-authored-by: Alexis Engelke <engelke@in.tum.de>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
crash Prefer [crash-on-valid] or [crash-on-invalid] llvm:support llvm:transforms
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants