| Issue |
202560
|
| Summary |
[CodeGen] Crash at -O2/3 with PGO: Assertion `(MDT->dominates(Save, Restore) && MPDT->dominates(Restore, Save)) && "Incorrect save or restore point due to dominance relations"' failed.
|
| Labels |
new issue
|
| Assignees |
|
| Reporter |
zxt5
|
Compiler Explorer: https://godbolt.org/z/EnWh3on36
small.ll
```
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128-Fn32"
target triple = "aarch64-unknown-linux-gnu"
define fastcc void @func_1(i1 %tobool1.not.i, ptr %r.0.i) {
entry:
%0 = load i32, ptr null, align 4
%tobool.not.i10 = icmp eq i32 %0, 0
br i1 %tobool.not.i10, label %h.exit, label %for.cond.i
for.cond.i: ; preds = %for.cond.i, %entry
br i1 %tobool1.not.i, label %if.then9.i, label %for.cond.i
if.then9.i: ; preds = %for.cond.i
%tobool10.not.i = icmp eq i32 0, 0
br i1 %tobool10.not.i, label %for.cond12.preheader.i, label %if.then11.i
for.cond12.preheader.i: ; preds = %if.then9.i
%1 = load i64, ptr null, align 8
%tobool16.not.i = icmp eq i64 %1, 0
br i1 %tobool16.not.i, label %if.end20.i, label %if.then17.i
if.then11.i: ; preds = %if.then9.i
store i32 0, ptr %r.0.i, align 4
br label %if.end20.i
if.then17.i: ; preds = %for.cond12.preheader.i
%2 = load ptr, ptr null, align 8
store i64 0, ptr %2, align 8
br label %if.end20.i
if.end20.i: ; preds = %if.end20.i, %if.then17.i, %if.then11.i, %for.cond12.preheader.i
br label %if.end20.i
h.exit: ; preds = %entry
ret void
}
```
Reproduce:
```
$ llc -O2 small.ll
llc: /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/CodeGen/ShrinkWrap.cpp:689: bool {anonymous}::ShrinkWrapImpl::postShrinkWrapping(bool, llvm::MachineFunction&, llvm::RegScavenger*): Assertion `(MDT->dominates(Save, Restore) && MPDT->dominates(Restore, Save)) && "Incorrect save or restore point due to dominance relations"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: llc -O2 small.ll
1. Running pass 'Function Pass Manager' on module 'small.ll'.
2. Running pass 'Shrink Wrapping analysis' on function '@func_1'
#0 0x0000aaaae9aab7b8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:885:3
#1 0x0000aaaae9aa8d6c llvm::sys::RunSignalHandlers() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Signals.cpp:109:18
#2 0x0000aaaae9aa9430 SignalHandler(int, siginfo_t*, void*) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:448:14
#3 0x0000ffff86ef37dc (linux-vdso.so.1+0x7dc)
#4 0x0000ffff86a52008 (/lib/aarch64-linux-gnu/libc.so.6+0x82008)
#5 0x0000ffff86a0a83c gsignal (/lib/aarch64-linux-gnu/libc.so.6+0x3a83c)
#6 0x0000ffff869f7134 abort (/lib/aarch64-linux-gnu/libc.so.6+0x27134)
#7 0x0000ffff86a04114 (/lib/aarch64-linux-gnu/libc.so.6+0x34114)
#8 0x0000ffff86a0418c (/lib/aarch64-linux-gnu/libc.so.6+0x3418c)
#9 0x0000aaaae8ce4194 (anonymous namespace)::ShrinkWrapImpl::postShrinkWrapping(bool, llvm::MachineFunction&, llvm::RegScavenger*) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/CodeGen/ShrinkWrap.cpp:678:29
#10 0x0000aaaae8ce5d04 (anonymous namespace)::ShrinkWrapImpl::run(llvm::MachineFunction&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/CodeGen/ShrinkWrap.cpp:973:31
#11 0x0000aaaae8ce63f8 llvm::SmallVectorTemplateCommon<unsigned long, void>::begin() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/SmallVector.h:276:45
#12 0x0000aaaae8ce63f8 llvm::SmallVector<unsigned long, 6u>::~SmallVector() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/SmallVector.h:1231:24
#13 0x0000aaaae8ce63f8 llvm::BitVector::~BitVector() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/BitVector.h:101:7
#14 0x0000aaaae8ce63f8 ~ShrinkWrapImpl /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/CodeGen/ShrinkWrap.cpp:114:7
#15 0x0000aaaae8ce63f8 (anonymous namespace)::ShrinkWrapLegacy::runOnMachineFunction(llvm::MachineFunction&) (.part.0) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/CodeGen/ShrinkWrap.cpp:1011:10
#16 0x0000aaaae8a626d4 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/CodeGen/MachineFunctionPass.cpp:112:30
#17 0x0000aaaae8ff5cc0 llvm::FPPassManager::runOnFunction(llvm::Function&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1390:40
#18 0x0000aaaae8ff5f20 llvm::FPPassManager::runOnModule(llvm::Module&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1436:29
#19 0x0000aaaae8ff66f4 runOnModule /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1505:38
#20 0x0000aaaae8ff66f4 llvm::legacy::PassManagerImpl::run(llvm::Module&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:531:55
#21 0x0000aaaae6766f7c compileModule(char**, llvm::SmallVectorImpl<llvm::PassPlugin>&, llvm::LLVMContext&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/tools/llc/llc.cpp:882:34
#22 0x0000aaaae6689960 main /data/x27zhou/compiler-nightly/src/llvm-project/llvm/tools/llc/llc.cpp:460:35
#23 0x0000ffff869f7400 (/lib/aarch64-linux-gnu/libc.so.6+0x27400)
#24 0x0000ffff869f74d8 __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x274d8)
#25 0x0000aaaae675d3f0 _start (/data/x27zhou/compiler-nightly/install/llvm/bin/llc+0x7bd3f0)
zsh: abort (core dumped) llc -O2 small.ll
```
## C Reproducer:
small.c
```c
#include <stdint.h>
int64_t a, n, f;
int64_t *b, *d, *c;
uint8_t e[][1][1];
int32_t g;
int16_t(u)(int16_t v, int16_t w) { return w == 0 ?: v % w; }
int16_t(x)(int16_t ab, int) { return ab; }
uint8_t(y)(uint8_t ab, int) { return ab; }
int16_t(ac)(int16_t v, int16_t) { return v; }
static void transparent_crc() {}
static int32_t h(int32_t, int16_t, int32_t);
static int8_t j();
static uint32_t func_1() {
int32_t k[6];
int i;
switch (-1307784481)
case -1307784481: {
int l = -1307784481 + 1307784484;
for (int m = 0; m < l; m = 3) {
for (i = 0; i < 2; i++)
k[i] = 2;
h(k[0], j(), 6);
}
}
}
int32_t h(int32_t o, int16_t p, int32_t q) {
int32_t *r = &g;
int32_t *s;
int32_t t;
int i;
if (*r) {
uint16_t *aa;
for (; n;)
for (; c;)
ad:;
if (u(q, o) != o) {
int32_t ae;
if (t) {
*r = q;
s = &q;
} else {
for (; i; i++)
;
if (*b)
t = *d = *aa;
af:;
}
int32_t *ag = &ae;
if (ac(a ^ y(1 == x(*s, p), 0 == (r = ag)) & o, 5) || q)
;
else
goto ad;
}
*r = 0;
goto af;
}
}
int8_t j() {
for (; f;)
*c = e[0][3][6];
}
int main() {
func_1();
transparent_crc;
}
```
profile.txt
```
small.c:func_1
# Func Hash:
31340830504017
# Num Counters:
4
# Counter Values:
1
0
0
1
small.c:transparent_crc
# Func Hash:
0
# Num Counters:
1
# Counter Values:
128
```
Reproduce at -O2 with PGO:
```
$ llvm-profdata merge -o test.profdata profile.txt
$
$ clang-trunk -O2 -fprofile-instr-use=test.profdata small.c
clang-23: /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/CodeGen/ShrinkWrap.cpp:689: bool {anonymous}::ShrinkWrapImpl::postShrinkWrapping(bool, llvm::MachineFunction&, llvm::RegScavenger*): Assertion `(MDT->dominates(Save, Restore) && MPDT->dominates(Restore, Save)) && "Incorrect save or restore point due to dominance relations"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /data/x27zhou/compiler-nightly/install/llvm/bin/clang-23 -cc1 -triple aarch64-unknown-linux-gnu -O2 -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name small.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=non-leaf-no-reserve -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -enable-tlsdesc -target-cpu generic -target-feature +v8a -target-feature +fp-armv8 -target-feature +neon -target-abi aapcs -debugger-tuning=gdb -fdebug-compilation-dir=/data/x27zhou/fuzz-pgo/PGOFuzz/pgofuzz2-output-2026-06-07-23-52-29-j72/crash-clang-trunk-87870 -fprofile-instrument-use=clang -fprofile-instrument-use-path=test.profdata -fcoverage-compilation-dir=/data/x27zhou/fuzz-pgo/PGOFuzz/pgofuzz2-output-2026-06-07-23-52-29-j72/crash-clang-trunk-87870 -resource-dir /data/x27zhou/compiler-nightly/install/llvm/lib/clang/23 -internal-isystem /data/x27zhou/compiler-nightly/install/llvm/lib/clang/23/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/include -internal-externc-isystem /usr/include/aarch64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fmessage-length=246 -fno-signed-char -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -target-feature +outline-atomics -target-feature -fmv -faddrsig -fdwarf2-cfi-asm -o /tmp/small-364e7c.o -x c small.c
1. <eof> parser at end of file
2. Code generation
3. Running pass 'Function Pass Manager' on module 'small.c'.
4. Running pass 'Shrink Wrapping analysis' on function '@func_1'
#0 0x0000aaaadbc838d8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:885:3
#1 0x0000aaaadbc80e8c llvm::sys::RunSignalHandlers() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Signals.cpp:109:18
#2 0x0000aaaadbc81550 SignalHandler(int, siginfo_t*, void*) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:448:14
#3 0x0000aaaadbc81648 int const* std::__find_if<int const*, __gnu_cxx::__ops::_Iter_equals_val<int const>>(int const*, int const*, __gnu_cxx::__ops::_Iter_equals_val<int const>) /usr/include/c++/11/bits/stl_algobase.h:2114:23
#4 0x0000aaaadbc81648 int const* std::find<int const*, int>(int const*, int const*, int const&) /usr/include/c++/11/bits/stl_algo.h:3884:28
#5 0x0000aaaadbc81648 bool llvm::is_contained<int const (&) [10], int>(int const (&) [10], int const&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/STLExtras.h:1952:21
#6 0x0000aaaadbc81648 SignalHandlerTerminate(int, siginfo_t*, void*) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:464:25
#7 0x0000ffffa04067dc (linux-vdso.so.1+0x7dc)
#8 0x0000ffff9ff72008 (/lib/aarch64-linux-gnu/libc.so.6+0x82008)
#9 0x0000ffff9ff2a83c gsignal (/lib/aarch64-linux-gnu/libc.so.6+0x3a83c)
#10 0x0000ffff9ff17134 abort (/lib/aarch64-linux-gnu/libc.so.6+0x27134)
#11 0x0000ffff9ff24114 (/lib/aarch64-linux-gnu/libc.so.6+0x34114)
#12 0x0000ffff9ff2418c (/lib/aarch64-linux-gnu/libc.so.6+0x3418c)
#13 0x0000aaaadb2bad54 (anonymous namespace)::ShrinkWrapImpl::postShrinkWrapping(bool, llvm::MachineFunction&, llvm::RegScavenger*) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/CodeGen/ShrinkWrap.cpp:678:29
#14 0x0000aaaadb2bc8c4 (anonymous namespace)::ShrinkWrapImpl::run(llvm::MachineFunction&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/CodeGen/ShrinkWrap.cpp:973:31
#15 0x0000aaaadb2bcfb8 llvm::SmallVectorTemplateCommon<unsigned long, void>::begin() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/SmallVector.h:276:45
#16 0x0000aaaadb2bcfb8 llvm::SmallVector<unsigned long, 6u>::~SmallVector() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/SmallVector.h:1231:24
#17 0x0000aaaadb2bcfb8 llvm::BitVector::~BitVector() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/BitVector.h:101:7
#18 0x0000aaaadb2bcfb8 ~ShrinkWrapImpl /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/CodeGen/ShrinkWrap.cpp:114:7
#19 0x0000aaaadb2bcfb8 (anonymous namespace)::ShrinkWrapLegacy::runOnMachineFunction(llvm::MachineFunction&) (.part.0) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/CodeGen/ShrinkWrap.cpp:1011:10
#20 0x0000aaaadb07ae84 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/CodeGen/MachineFunctionPass.cpp:112:30
#21 0x0000aaaadb602ff0 llvm::FPPassManager::runOnFunction(llvm::Function&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1390:40
#22 0x0000aaaadb603250 llvm::FPPassManager::runOnModule(llvm::Module&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1436:29
#23 0x0000aaaadb603a24 runOnModule /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1505:38
#24 0x0000aaaadb603a24 llvm::legacy::PassManagerImpl::run(llvm::Module&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:531:55
#25 0x0000aaaadc036b20 RunCodegenPipeline /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/CodeGen/BackendUtil.cpp:1279:9
#26 0x0000aaaadc036b20 emitAssembly /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/CodeGen/BackendUtil.cpp:1302:21
#27 0x0000aaaadc036b20 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/CodeGen/BackendUtil.cpp:1478:25
#28 0x0000aaaadc6308a4 std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>::~unique_ptr() /usr/include/c++/11/bits/unique_ptr.h:360:12
#29 0x0000aaaadc6308a4 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/CodeGen/CodeGenAction.cpp:322:20
#30 0x0000aaaaddccb730 clang::ParseAST(clang::Sema&, bool, bool) /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/Parse/ParseAST.cpp:183:34
#31 0x0000aaaadc8cdc4c clang::FrontendAction::Execute() /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/Frontend/FrontendAction.cpp:1346:38
#32 0x0000aaaadc86ce4c llvm::Error::getPtr() const /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/Support/Error.h:278:51
#33 0x0000aaaadc86ce4c llvm::Error::operator bool() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/Support/Error.h:241:22
#34 0x0000aaaadc86ce4c clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) /data/x27zhou/compiler-nightly/src/llvm-project/clang/lib/Frontend/CompilerInstance.cpp:1027:42
#35 0x00<truncated>Please see the issue for the entire body.
![]()
_______________________________________________
llvm-bugs mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
