| Issue |
186260
|
| Summary |
[VPlan] Crash at -Os when compiling with PGO: Assertion `!NodePtr->isKnownSentinel()' failed.
|
| Labels |
new issue
|
| Assignees |
|
| Reporter |
zxt5
|
small.c
```c
static int h = 1;
int *c[][0][0];
static int *b();
static unsigned int g() {
int *c = &h;
b(*c);
}
int *b(unsigned int a) {
int f = 1342177280;
int **b = &c[0][0][0];
int d, e;
int *g = &e;
for (;;) {
if (e)
c[a][a][a] = 0;
else
*g = a;
if (a) {
int c = 10, h = e;
for (; h < c; h++) {
*b = g;
for (d = 0; d != -10; --d) {
a = f + 1000000000;
for (int h = a; h < e; h++)
*b = &f;
}
}
} else
continue;
int *d = &h;
return d;
}
}
int main() { g(); }
```
Compiling the code with profile data generated by a single run triggers a crash:
```bash
$ clang-trunk -Os -fprofile-instr-generate small.c
$ LLVM_PROFILE_FILE="test.profraw" ./a.out
$ llvm-profdata merge -o test.profdata test.profraw
$ clang-trunk -Os -fprofile-instr-use=test.profdata small.c # crash
```
Crash:
```
clang-23: /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/ilist_iterator.h:168: llvm::ilist_iterator::reference llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::VPRecipeBase, true, false, void, false, void>, false, false>::operator*() const [OptionsT = llvm::ilist_detail::node_options<llvm::VPRecipeBase, true, false, void, false, void>, IsReverse = false, IsConst = false]: Assertion `!NodePtr->isKnownSentinel()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0. Program arguments: /data/x27zhou/compiler-nightly/install/llvm/bin/clang-23 -cc1 -triple aarch64-unknown-linux-gnu -Os -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name small.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=non-leaf-no-reserve -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -enable-tlsdesc -target-cpu generic -target-feature +v8a -target-feature +fp-armv8 -target-feature +neon -target-abi aapcs -debugger-tuning=gdb -fdebug-compilation-dir=/data/x27zhou/fuzz-pgo/PGOFuzz/pgofuzz2-output-2026-03-10-14-26-20/crash-clang-trunk-11221/reduction/perses_result_1 -fprofile-instrument-use=clang -fprofile-instrument-use-path=test.profdata -fcoverage-compilation-dir=/data/x27zhou/fuzz-pgo/PGOFuzz/pgofuzz2-output-2026-03-10-14-26-20/crash-clang-trunk-11221/reduction/perses_result_1 -resource-dir /data/x27zhou/compiler-nightly/install/llvm/lib/clang/23 -internal-isystem /data/x27zhou/compiler-nightly/install/llvm/lib/clang/23/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/include -internal-externc-isystem /usr/include/aarch64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fmessage-length=309 -fno-signed-char -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -target-feature +outline-atomics -target-feature -fmv -faddrsig -fdwarf2-cfi-asm -o /tmp/small-ab6c9f.o -x c small.c
1. <eof> parser at end of file
2. Optimizer
3. Running pass "function<eager-inv>(drop-unnecessary-assumes,float2int,lower-constant-intrinsics,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,drop-unnecessary-assumes,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-arithmetic;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O2>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;switch-to-arithmetic;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "small.c"
4. Running pass "loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>" on function "b"
#0 0x0000aaaad0e9581c backtrace (/data/x27zhou/compiler-nightly/install/llvm/bin/clang-23+0x4fc581c)
#1 0x0000aaaad80b8338 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:880:13
#2 0x0000aaaad80b1668 llvm::sys::RunSignalHandlers() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Signals.cpp:109:18
#3 0x0000aaaad80bab7c SignalHandler(int, siginfo_t*, void*) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:448:38
#4 0x0000aaaad80ba820 int const* std::__find_if<int const*, __gnu_cxx::__ops::_Iter_equals_val<int const>>(int const*, int const*, __gnu_cxx::__ops::_Iter_equals_val<int const>, std::random_access_iterator_tag) /usr/bin/../lib/gcc/aarch64-linux-gnu/11/../../../../include/c++/11/bits/stl_algobase.h:2069:8
#5 0x0000aaaad80ba820 int const* std::__find_if<int const*, __gnu_cxx::__ops::_Iter_equals_val<int const>>(int const*, int const*, __gnu_cxx::__ops::_Iter_equals_val<int const>) /usr/bin/../lib/gcc/aarch64-linux-gnu/11/../../../../include/c++/11/bits/stl_algobase.h:2114:14
#6 0x0000aaaad80ba820 int const* std::find<int const*, int>(int const*, int const*, int const&) /usr/bin/../lib/gcc/aarch64-linux-gnu/11/../../../../include/c++/11/bits/stl_algo.h:3884:14
#7 0x0000aaaad80ba820 bool llvm::is_contained<int const (&) [10], int>(int const (&) [10], int const&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/STLExtras.h:1953:12
#8 0x0000aaaad80ba820 SignalHandlerTerminate(int, siginfo_t*, void*) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:464:7
#9 0x0000ffffa61337dc (linux-vdso.so.1+0x7dc)
#10 0x0000ffffa5ca2008 (/lib/aarch64-linux-gnu/libc.so.6+0x82008)
#11 0x0000ffffa5c5a83c gsignal (/lib/aarch64-linux-gnu/libc.so.6+0x3a83c)
#12 0x0000ffffa5c47134 abort (/lib/aarch64-linux-gnu/libc.so.6+0x27134)
#13 0x0000ffffa5c54114 (/lib/aarch64-linux-gnu/libc.so.6+0x34114)
#14 0x0000ffffa5c5418c (/lib/aarch64-linux-gnu/libc.so.6+0x3418c)
#15 0x0000aaaad86b46dc llvm::isa_impl_cl<llvm::VPSingleDefRecipe, llvm::VPRecipeBase const*>::doit(llvm::VPRecipeBase const*) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/Support/Casting.h:109:5
#16 0x0000aaaad86b46dc llvm::isa_impl_wrap<llvm::VPSingleDefRecipe, llvm::VPRecipeBase const*, llvm::VPRecipeBase const*>::doit(llvm::VPRecipeBase const* const&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/Support/Casting.h:137:12
#17 0x0000aaaad86b46dc llvm::isa_impl_wrap<llvm::VPSingleDefRecipe, llvm::VPRecipeBase const* const, llvm::VPRecipeBase const*>::doit(llvm::VPRecipeBase const* const&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/Support/Casting.h:127:12
#18 0x0000aaaad86b46dc llvm::CastIsPossible<llvm::VPSingleDefRecipe, llvm::VPRecipeBase const*, void>::isPossible(llvm::VPRecipeBase const* const&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/Support/Casting.h:255:12
#19 0x0000aaaad86b46dc llvm::CastInfo<llvm::VPSingleDefRecipe, llvm::VPRecipeBase* const, void>::isPossible(llvm::VPRecipeBase* const&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/Support/Casting.h:509:12
#20 0x0000aaaad86b46dc bool llvm::isa<llvm::VPSingleDefRecipe, llvm::VPRecipeBase*>(llvm::VPRecipeBase* const&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/Support/Casting.h:548:11
#21 0x0000aaaad86b46dc decltype(auto) llvm::cast<llvm::VPSingleDefRecipe, llvm::VPRecipeBase>(llvm::VPRecipeBase*) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/Support/Casting.h:572:3
#22 0x0000aaaad86b46dc llvm::VPlanTransforms::handleFindLastReductions(llvm::VPlan&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Vectorize/VPlanConstruction.cpp:1506:9
#23 0x0000aaaad859f870 decltype(auto) llvm::VPlanTransforms::runPass<true, bool (&)(llvm::VPlan&)>(llvm::StringRef, bool (&)(llvm::VPlan&), llvm::VPlan&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Vectorize/VPlanTransforms.h:81:12
#24 0x0000aaaad859f870 llvm::LoopVectorizationPlanner::tryToBuildVPlanWithVPRecipes(std::unique_ptr<llvm::VPlan, std::default_delete<llvm::VPlan>>, llvm::VFRange&, llvm::LoopVersioning*) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp:8361:8
#25 0x0000aaaad8584784 std::unique_ptr<llvm::VPlan, std::default_delete<llvm::VPlan>>::~unique_ptr() /usr/bin/../lib/gcc/aarch64-linux-gnu/11/../../../../include/c++/11/bits/unique_ptr.h:360:6
#26 0x0000aaaad8584784 llvm::LoopVectorizationPlanner::buildVPlansWithVPRecipes(llvm::ElementCount, llvm::ElementCount) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp:8140:21
#27 0x0000aaaad85834a0 llvm::LoopVectorizationPlanner::plan(llvm::ElementCount, unsigned int) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp:6866:3
#28 0x0000aaaad85ad0ac llvm::LoopVectorizePass::processLoop(llvm::Loop*) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp:0:7
#29 0x0000aaaad85c84e0 llvm::LoopVectorizePass::runImpl(llvm::Function&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp:9919:27
#30 0x0000aaaad85c9b0c llvm::LoopVectorizePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp:9958:7
#31 0x0000aaaad70b4c04 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/IR/PassManagerImpl.h:80:8
#32 0x0000aaaad70bf568 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/PassManager.cpp:0:38
#33 0x0000aaaad70b216c llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/IR/PassManagerImpl.h:80:8
#34 0x0000aaaad894511c llvm::SmallPtrSetImplBase::isSmall() const /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/SmallPtrSet.h:248:33
#35 0x0000aaaad894511c llvm::SmallPtrSetImplBase::~SmallPtrSetImplBase() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/SmallPtrSet.h:89:10
#36 0x0000aaaad894511c llvm::PreservedAnalyses::~PreservedAnalyses() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/IR/Analysis.h:112:7
#37 0x0000aaaad894511c (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/CodeGen/BackendUtil.cpp:1209:5
#38 0x0000aaaad892f3a0 (anonymous namespace)::EmitAssemblyHelper::emitAssembly(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/CodeGen/BackendUtil.cpp:0:3
#39 0x0000aaaad892f3a0 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/CodeGen/BackendUtil.cpp:1475:13
#40 0x0000aaaad9710314 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/CodeGen/CodeGenAction.cpp:312:3
#41 0x0000aaaadd1b3764 clang::ParseAST(clang::Sema&, bool, bool) /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/Parse/ParseAST.cpp:0:13
#42 0x0000aaaad971c548 clang::CodeGenAction::ExecuteAction() /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/CodeGen/CodeGenAction.cpp:0:30
#43 0x0000aaaad9e664fc clang::FrontendAction::Execute() /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/Frontend/FrontendAction.cpp:1327:10
#44 0x0000aaaad9cbd994 llvm::Error::getPtr() const /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/Support/Error.h:278:42
#45 0x0000aaaad9cbd994 llvm::Error::operator bool() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/Support/Error.h:241:16
#46 0x0000aaaad9cbd994 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/Frontend/CompilerInstance.cpp:1002:23
#47 0x0000aaaada123978 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:0:25
#48 0x0000aaaad0f1d740 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) /data/x27zhou/compiler-nightly/src/llvm-project/clang/tools/driver/cc1_main.cpp:302:15
#49 0x0000aaaad0f15140 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>) /data/x27zhou/compiler-nightly/src/llvm-project/clang/tools/driver/driver.cpp:229:12
#50 0x0000aaaad0f12c80 std::__atomic_base<int>::fetch_sub(int, std::memory_order) /usr/bin/../lib/gcc/aarch64-linux-gnu/11/../../../../include/c++/11/bits/atomic_base.h:628:16
#51 0x0000aaaad0f12c80 llvm::ThreadSafeRefCountedBase<llvm::vfs::FileSystem>::Release() const /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/IntrusiveRefCntPtr.h:134:32
#52 0x0000aaaad0f12c80 llvm::IntrusiveRefCntPtrInfo<llvm::vfs::FileSystem>::release(llvm::vfs::FileSystem*) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/IntrusiveRefCntPtr.h:164:38
#53 0x0000aaaad0f12c80 llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>::release() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/IntrusiveRefCntPtr.h:233:7
#54 0x0000aaaad0f12c80 llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>::~IntrusiveRefCntPtr() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/IntrusiveRefCnt<truncated>Please see the issue for the entire body.
![]()
_______________________________________________
llvm-bugs mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
