New user self-registration is disabled due to spam. For an account please email bugs-admin@lists.llvm.org with your e-mail address and full name.

Bug 28330 - crash at -O3 with -g on x86_64-linux-gnu in both 32-bit and 64-bit modes (Assertion `VectorizedValue && "Need to have a vectorized tree node"' failed.)
Summary: crash at -O3 with -g on x86_64-linux-gnu in both 32-bit and 64-bit modes (Ass...
Status: RESOLVED FIXED
Alias: None
Product: clang
Classification: Unclassified
Component: -New Bugs (show other bugs)
Version: trunk
Hardware: PC All
: P normal
Assignee: Unassigned Clang Bugs
URL:
Keywords:
Depends on:
Blocks: 28600
  Show dependency tree
 
Reported: 2016-06-27 09:38 PDT by Chengnian Sun
Modified: 2016-08-18 16:26 PDT (History)
6 users (show)

See Also:
Fixed By Commit(s):


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Chengnian Sun 2016-06-27 09:38:14 PDT
$ clang-trunk -v
clang version 3.9.0 (trunk 273815)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /usr/local/bin
Found candidate GCC installation: /usr/lib/gcc/i686-linux-gnu/5
Found candidate GCC installation: /usr/lib/gcc/i686-linux-gnu/5.3.0
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.8
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.8.5
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.9
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.9.2
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.9.3
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/5
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/5.3.0
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.8
Candidate multilib: .;@m64
Candidate multilib: 32;@m32
Candidate multilib: x32;@mx32
Selected multilib: .;@m64
$ 
$ clang-trunk -O3 small.c
$ clang-trunk -O3 -g small.c
clang-3.9: /tmp/llvm-builder/llvm-source-trunk/lib/Transforms/Vectorize/SLPVectorizer.cpp:4199: llvm::Value* HorizontalReduction::emitReduction(llvm::Value*, llvm::IRBuilder<>&): Assertion `VectorizedValue && "Need to have a vectorized tree node"' failed.
#0 0x0000000001b6f935 llvm::sys::PrintStackTrace(llvm::raw_ostream&) (/usr/local/clang-trunk/bin/clang-3.9+0x1b6f935)
#1 0x0000000001b6d596 llvm::sys::RunSignalHandlers() (/usr/local/clang-trunk/bin/clang-3.9+0x1b6d596)
#2 0x0000000001b6d7c1 SignalHandler(int) (/usr/local/clang-trunk/bin/clang-3.9+0x1b6d7c1)
#3 0x00007fdfdda79330 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x10330)
#4 0x00007fdfdc86ac37 gsignal /build/eglibc-oGUzwX/eglibc-2.19/signal/../nptl/sysdeps/unix/sysv/linux/raise.c:56:0
#5 0x00007fdfdc86e028 abort /build/eglibc-oGUzwX/eglibc-2.19/stdlib/abort.c:91:0
#6 0x00007fdfdc863bf6 __assert_fail_base /build/eglibc-oGUzwX/eglibc-2.19/assert/assert.c:92:0
#7 0x00007fdfdc863ca2 (/lib/x86_64-linux-gnu/libc.so.6+0x2fca2)
#8 0x0000000001c53501 HorizontalReduction::emitReduction(llvm::Value*, llvm::IRBuilder<llvm::ConstantFolder, llvm::IRBuilderDefaultInserter>&) (/usr/local/clang-trunk/bin/clang-3.9+0x1c53501)
#9 0x0000000001c634ac HorizontalReduction::tryToReduce(llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*) (/usr/local/clang-trunk/bin/clang-3.9+0x1c634ac)
#10 0x0000000001c63c3e canMatchHorizontalReduction(llvm::PHINode*, llvm::BinaryOperator*, llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*, unsigned int) [clone .part.1029] (/usr/local/clang-trunk/bin/clang-3.9+0x1c63c3e)
#11 0x0000000001c645be llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/usr/local/clang-trunk/bin/clang-3.9+0x1c645be)
#12 0x0000000001c68775 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*) [clone .part.1038] (/usr/local/clang-trunk/bin/clang-3.9+0x1c68775)
#13 0x0000000001c6946d SLPVectorizer::runOnFunction(llvm::Function&) (/usr/local/clang-trunk/bin/clang-3.9+0x1c6946d)
#14 0x0000000001804e23 llvm::FPPassManager::runOnFunction(llvm::Function&) (/usr/local/clang-trunk/bin/clang-3.9+0x1804e23)
#15 0x00000000018051db llvm::FPPassManager::runOnModule(llvm::Module&) (/usr/local/clang-trunk/bin/clang-3.9+0x18051db)
#16 0x00000000018054ef llvm::legacy::PassManagerImpl::run(llvm::Module&) (/usr/local/clang-trunk/bin/clang-3.9+0x18054ef)
#17 0x0000000001cac378 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::DataLayout const&, llvm::Module*, clang::BackendAction, llvm::raw_pwrite_stream*) (/usr/local/clang-trunk/bin/clang-3.9+0x1cac378)
#18 0x00000000022873a6 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/usr/local/clang-trunk/bin/clang-3.9+0x22873a6)
#19 0x00000000025c4dfb clang::ParseAST(clang::Sema&, bool, bool) (/usr/local/clang-trunk/bin/clang-3.9+0x25c4dfb)
#20 0x000000000228776e clang::CodeGenAction::ExecuteAction() (/usr/local/clang-trunk/bin/clang-3.9+0x228776e)
#21 0x0000000001fb1126 clang::FrontendAction::Execute() (/usr/local/clang-trunk/bin/clang-3.9+0x1fb1126)
#22 0x0000000001f8c4ce clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/usr/local/clang-trunk/bin/clang-3.9+0x1f8c4ce)
#23 0x00000000020360ec clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/usr/local/clang-trunk/bin/clang-3.9+0x20360ec)
#24 0x0000000000a1fd58 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/usr/local/clang-trunk/bin/clang-3.9+0xa1fd58)
#25 0x00000000009d2237 main (/usr/local/clang-trunk/bin/clang-3.9+0x9d2237)
#26 0x00007fdfdc855f45 __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:321:0
#27 0x0000000000a1bd24 _start (/usr/local/clang-trunk/bin/clang-3.9+0xa1bd24)
Stack dump:
0.	Program arguments: /usr/local/clang-trunk/bin/clang-3.9 -cc1 -triple x86_64-unknown-linux-gnu -emit-obj -disable-free -main-file-name small.c -mrelocation-model static -mthread-model posix -fmath-errno -masm-verbose -mconstructor-aliases -munwind-tables -fuse-init-array -target-cpu x86-64 -momit-leaf-frame-pointer -dwarf-column-info -debug-info-kind=limited -dwarf-version=4 -debugger-tuning=gdb -resource-dir /usr/local/clang-trunk/bin/../lib/clang/3.9.0 -c-isystem . -c-isystem /usr/local/include/csmith-2.2.0/ -internal-isystem /usr/local/include -internal-isystem /usr/local/clang-trunk/bin/../lib/clang/3.9.0/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -fdebug-compilation-dir /home/cnsun/ramdisk/reduction/20160626-clang-trunk-m32-g-O3-build-133308/delta -ferror-limit 19 -fmessage-length 238 -fobjc-runtime=gcc -fdiagnostics-show-option -fcolor-diagnostics -vectorize-loops -vectorize-slp -o /tmp/small-d22613.o -x c small.c 
1.	<eof> parser at end of file
2.	Per-module optimization passes
3.	Running pass 'Function Pass Manager' on module 'small.c'.
4.	Running pass 'SLP Vectorizer' on function '@main'
clang-3.9: error: unable to execute command: Aborted (core dumped)
clang-3.9: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 3.9.0 (trunk 273815)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /usr/local/bin
clang-3.9: note: diagnostic msg: PLEASE submit a bug report to http://llvm.org/bugs/ and include the crash backtrace, preprocessed source, and associated run script.
clang-3.9: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-3.9: note: diagnostic msg: /tmp/small-555624.c
clang-3.9: note: diagnostic msg: /tmp/small-555624.sh
clang-3.9: note: diagnostic msg: 

********************
$ 
$ cat small.c
char a, c;
char b[80];
int e, g, i;
short f, h, k;

void fn2() {
  for (; e; e++) {
    for (a = 0; a <= 7; a++)
      if (b[a])
        for (;;)
          ;
  }
}

void fn3() {
  int l, j;
  for (; i; i++) {
    for (h = 1; h <= 9; h++) {
      for (a = 2; a <= 9; a++) {
        for (k = 1; k <= 9; k++) {
          for (l = 0; l <= 9; l++) {
            int m = 1;
            int n[10] = {3, 0, 2, 2, 0, 3, 0, 2, 2};
            j = 1;
            if (f)
              continue;
            if (c)
              break;
            --g;
          }
          if (b[h])
            break;
        }
      }
    }
  }
}


static int fn1() {
  fn3();
  fn2();
  return 0;
}

static short fn4() { return fn1(); }

int main() {
  return fn4();
}
$
Comment 1 Hans Wennborg 2016-08-03 18:14:20 PDT
This is a regression from 3.8.
Comment 2 Hans Wennborg 2016-08-10 15:17:42 PDT
Bisection points to r264596:

Author: Hyojin Sung <hsung@us.ibm.com>
Date:   Tue Mar 29 04:08:57 2016 +0000

    [SimlifyCFG] Prevent passes from destroying canonical loop structure, especially for nested loops
    
    When eliminating or merging almost empty basic blocks, the existence of non-trivial PHI nodes
    is currently used to recognize potential loops of which the block is the header and keep the block.
    However, the current algorithm fails if the loops' exit condition is evaluated only with volatile
    values hence no PHI nodes in the header. Especially when such a loop is an outer loop of a nested
    loop, the loop is collapsed into a single loop which prevent later optimizations from being
    applied (e.g., transforming nested loops into simplified forms and loop vectorization).
    
    The patch augments the existing PHI node-based check by adding a pre-test if the BB actually
    belongs to a set of loop headers and not eliminating it if yes.
Comment 3 Hans Wennborg 2016-08-10 15:20:49 PDT
(In reply to comment #2)
> Bisection points to r264596:

That's the same as for PR28541, but I don't think this is a duplicate since this crash is in the SLP vectorizer rather than the loop vectorizer.
Comment 4 Michael Kuperstein 2016-08-10 17:58:13 PDT
Interestingly enough, by the time we reach the SLP vectorizer, main has ~120000 llvm.dbg.value intrinsic calls, and ~6000 llvm.dbg.declare intrinsic calls.

Admittedly, this should not cause SLP to crash, but that still looks rather fishy.
Comment 5 Michael Kuperstein 2016-08-10 19:34:29 PDT
And now, with a sane-sized reproducer:

; ModuleID = 'bugpoint-reduced-simplified.bc'
target datalayout = "e-m:e-i64:64-i128:128-n32:64-S128"
target triple = "aarch64--linux"

define void @test_unrolled_select() {
entry:
  br label %for.body

for.body:                                         ; preds = %for.body, %entry
  %s.047 = phi i32 [ 0, %entry ], [ %add82, %for.body ]
  %sub5.sub = select i1 undef, i32 undef, i32 undef
  %add = add nsw i32 %sub5.sub, %s.047
  %v.1 = select i1 undef, i32 undef, i32 undef
  %add16 = add nsw i32 %add, %v.1
  %sub25.sub21 = select i1 undef, i32 undef, i32 undef
  %add27 = add nsw i32 %add16, %sub25.sub21
  %v.3 = select i1 undef, i32 undef, i32 undef
  %add38 = add nsw i32 %add27, %v.3
  %sub47.sub43 = select i1 undef, i32 undef, i32 undef
  %add49 = add nsw i32 %add38, %sub47.sub43
  %v.5 = select i1 undef, i32 undef, i32 undef
  %add60 = add nsw i32 %add49, %v.5
  %sub69.sub65 = select i1 undef, i32 undef, i32 undef
  %add71 = add nsw i32 %add60, %sub69.sub65
  %v.7 = select i1 undef, i32 undef, i32 undef
  %add82 = add nsw i32 %add71, %v.7
  br label %for.body
}


This crashes with "opt -slp-vectorizer -slp-schedule-budget=1"
The default schedule budget is 100000, explaining the ridiculous original testcase.
Comment 6 Matthew Simpson 2016-08-11 12:36:33 PDT
Michael,

I agree that the number of debug intrinsics looks strange and is probably worth further investigation. I just submitted a patch to keep SLP from crashing.

https://reviews.llvm.org/D20685
Comment 7 Hans Wennborg 2016-08-11 12:38:09 PDT
(In reply to comment #6)
> I just submitted a patch to keep SLP from
> crashing.
> 
> https://reviews.llvm.org/D20685

I assume you mean https://reviews.llvm.org/D23410 :-)
Comment 8 Matthew Simpson 2016-08-11 12:46:31 PDT
Ha! Yes, copy-paste problems...

https://reviews.llvm.org/D23410
Comment 9 Michael Kuperstein 2016-08-18 16:15:35 PDT
Fixed by mssimpson in r279125.
Comment 10 Matthew Simpson 2016-08-18 16:26:28 PDT
Thanks, Michael!