| Issue |
174070
|
| Summary |
[clang] Crash at -O3 with PGO: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed
|
| Labels |
clang
|
| Assignees |
|
| Reporter |
zxt5
|
test.c:
```
#include <stdint.h>
uint32_t a[];
int32_t b, al, ak, aj, m, o, k, j, l, i, p, g, e, d, c;
uint8_t f[][8];
static uint32_t n;
static int16_t func_6(int8_t, int8_t);
static int32_t aa(uint8_t, uint8_t, int16_t);
static uint16_t q() {
uint16_t r = 0;
int16_t s[7][5][7] = {};
if (func_6(aa(0, r, s[6][1][2]), n))
n = 8;
}
int16_t func_6(int8_t v, int8_t t) {
uint32_t u = 6;
int8_t ab[4][2] = {};
t && (1 < (0 == t) && t == 6) > ((0 > 0 != 9) < 5);
for (; g <= 0;) {
for (b = 0; b >= 0; b--)
for (l = 3; l >= 0; l--)
for (i = 2; i <= 7; i++) {
(f[0][i] >= ((l > g) > (((d || t) != u <= k) <= f[0][0]))) >= 3;
for (d = 0; d <= 0; d++) {
int32_t ag = 0;
int16_t ah = 0;
(ag >=
(0 >= (v || (c = 8 && 0 | (0 || ((0 != 1) <= 0) > t)) == v == d ||
ah) ==
4)) > v ||
v,
((v >= (0 > ((ab[0][1] >=
((t <= t) > ((t && c <= ((c = a[b]) < t && 0)) <
6))) <= ab[3][0]))) < 4) <= 0;
((((((e = ((9 || a) ^ v || t) > (v >= o == 0)) && v) >= j) <= t) <
ab[1][1]) > 4) > i;
}
if (v)
break;
}
for (p = 0; p >= 0;) {
for (; m <= 0;)
return v;
0 != j && 3;
}
}
return ab[0][1];
}
int32_t aa(uint8_t, uint8_t, int16_t) { a[0] = 5; }
int main() {
if (0 == 2 && 0 == 0)
;
q();
for (; aj < 1; aj++)
for (; ak < 5; ak++)
if (1)
;
for (; aj < 1;)
if (c)
;
for (; aj < 10; aj++)
for (; ak < 6; ak++)
for (; al < 1; al++)
if (1)
;
for (; aj < 8;)
for (; ak < 8;)
if (1)
;
for (; aj < 4;)
if (o)
;
return 0;
}
```
This code crashes when compiled at -O3 with PGO.
Steps to reproduce:
1. Generate the profile using [profile.txt](https://github.com/user-attachments/files/24391748/profile.txt)
```
llvm-profdata merge -o test.profdata profile.txt
```
2. Compile at -O3 with PGO:
```
clang-trunk -O3 -fprofile-instr-use=test.profdata test.c
```
Crash:
```
clang-22: /home/x27zhou/compilers/llvm-project/llvm/include/llvm/Support/Casting.h:572: decltype(auto) llvm::cast(From *) [To = llvm::Instruction, From = llvm::Value]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
```
Backtrace:
```
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0. Program arguments: /home/x27zhou/compilers/llvm-trunk-install/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O3 -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name test.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/home/x27zhou/outcome-2025-12-30-00-59-30/bug-exit-15-id-17128/reduction -fprofile-instrument-use=clang -fprofile-instrument-use-path=test.profdata -fcoverage-compilation-dir=/home/x27zhou/outcome-2025-12-30-00-59-30/bug-exit-15-id-17128/reduction -resource-dir /home/x27zhou/compilers/llvm-trunk-install/lib/clang/22 -internal-isystem /home/x27zhou/compilers/llvm-trunk-install/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fmessage-length=222 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -faddrsig -fdwarf2-cfi-asm -o /tmp/test-7f1c8b.o -x c test.c
1. <eof> parser at end of file
2. Optimizer
3. Running pass "function<eager-inv>(drop-unnecessary-assumes,float2int,lower-constant-intrinsics,chr,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,drop-unnecessary-assumes,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-arithmetic;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O3>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;switch-to-arithmetic;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "test.c"
4. Running pass "chr" on function "main"
#0 0x0000559c01831ddb backtrace (/home/x27zhou/compilers/llvm-trunk-install/bin/clang-22+0x4e72ddb)
#1 0x0000559c0a3a4af8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/x27zhou/compilers/llvm-project/llvm/lib/Support/Unix/Signals.inc:846:8
#2 0x0000559c0a39ca10 llvm::sys::RunSignalHandlers() /home/x27zhou/compilers/llvm-project/llvm/lib/Support/Signals.cpp:0:5
#3 0x0000559c0a3a7d27 SignalHandler(int, siginfo_t*, void*) /home/x27zhou/compilers/llvm-project/llvm/lib/Support/Unix/Signals.inc:429:38
#4 0x00007f7d074de520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#5 0x00007f7d075329fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#6 0x00007f7d075329fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#7 0x00007f7d075329fc pthread_kill ./nptl/pthread_kill.c:89:10
#8 0x00007f7d074de476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#9 0x00007f7d074c47f3 abort ./stdlib/abort.c:81:7
#10 0x00007f7d074c471b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#11 0x00007f7d074d5e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#12 0x0000559c0e9e1c4b llvm::Value::getSubclassDataFromValue() const /home/x27zhou/compilers/llvm-project/llvm/include/llvm/IR/Value.h:889:60
#13 0x0000559c0e9e1c4b llvm::Instruction::getSubclassDataFromValue() const /home/x27zhou/compilers/llvm-project/llvm/include/llvm/IR/Instruction.h:1051:19
#14 0x0000559c0e9e1c4b llvm::Bitfield::Element<llvm::CmpInst::Predicate, 0u, 6u, (llvm::CmpInst::Predicate)41>::Type llvm::Instruction::getSubclassData<llvm::Bitfield::Element<llvm::CmpInst::Predicate, 0u, 6u, (llvm::CmpInst::Predicate)41>>() const /home/x27zhou/compilers/llvm-project/llvm/include/llvm/IR/Instruction.h:1064:43
#15 0x0000559c0e9e1c4b llvm::CmpInst::getPredicate() const /home/x27zhou/compilers/llvm-project/llvm/include/llvm/IR/InstrTypes.h:765:43
#16 0x0000559c0e9e1c4b negateICmpIfUsedByBranchOrSelectOnly(llvm::ICmpInst*, llvm::Instruction*, (anonymous namespace)::CHRScope*) /home/x27zhou/compilers/llvm-project/llvm/lib/Transforms/Instrumentation/ControlHeightReduction.cpp:1538:57
#17 0x0000559c0e9e1c4b (anonymous namespace)::CHR::addToMergedCondition(bool, llvm::Value*, llvm::Instruction*, (anonymous namespace)::CHRScope*, llvm::IRBuilder<llvm::ConstantFolder, llvm::IRBuilderDefaultInserter>&, llvm::Value*&) /home/x27zhou/compilers/llvm-project/llvm/lib/Transforms/Instrumentation/ControlHeightReduction.cpp:1985:10
#18 0x0000559c0e9dbf9f (anonymous namespace)::CHR::fixupSelect(llvm::SelectInst*, (anonymous namespace)::CHRScope*, llvm::IRBuilder<llvm::ConstantFolder, llvm::IRBuilderDefaultInserter>&, llvm::Value*&, llvm::BranchProbability&) /home/x27zhou/compilers/llvm-project/llvm/lib/Transforms/Instrumentation/ControlHeightReduction.cpp:1966:3
#19 0x0000559c0e9dbf9f (anonymous namespace)::CHR::fixupBranchesAndSelects((anonymous namespace)::CHRScope*, llvm::BasicBlock*, llvm::BranchInst*, unsigned long) /home/x27zhou/compilers/llvm-project/llvm/lib/Transforms/Instrumentation/ControlHeightReduction.cpp:1882:7
#20 0x0000559c0e9dbf9f (anonymous namespace)::CHR::transformScopes((anonymous namespace)::CHRScope*, llvm::DenseSet<llvm::PHINode*, llvm::DenseMapInfo<llvm::PHINode*, void>>&) /home/x27zhou/compilers/llvm-project/llvm/lib/Transforms/Instrumentation/ControlHeightReduction.cpp:1775:3
#21 0x0000559c0e9a128c (anonymous namespace)::CHR::transformScopes(llvm::SmallVectorImpl<(anonymous namespace)::CHRScope*>&) /home/x27zhou/compilers/llvm-project/llvm/lib/Transforms/Instrumentation/ControlHeightReduction.cpp:0:5
#22 0x0000559c0e9a128c (anonymous namespace)::CHR::run() /home/x27zhou/compilers/llvm-project/llvm/lib/Transforms/Instrumentation/ControlHeightReduction.cpp:2076:7
#23 0x0000559c0e9a128c llvm::ControlHeightReductionPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /home/x27zhou/compilers/llvm-project/llvm/lib/Transforms/Instrumentation/ControlHeightReduction.cpp:2114:48
#24 0x0000559c0d2cf3a2 llvm::detail::PassModel<llvm::Function, llvm::ControlHeightReductionPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /home/x27zhou/compilers/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:91:5
#25 0x0000559c090bc5e8 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /home/x27zhou/compilers/llvm-project/llvm/include/llvm/IR/PassManagerImpl.h:80:8
#26 0x0000559c02640312 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /home/x27zhou/compilers/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:91:5
#27 0x0000559c090c8a72 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /home/x27zhou/compilers/llvm-project/llvm/lib/IR/PassManager.cpp:132:23
#28 0x0000559c02643922 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /home/x27zhou/compilers/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:91:5
#29 0x0000559c090b90d8 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /home/x27zhou/compilers/llvm-project/llvm/include/llvm/IR/PassManagerImpl.h:80:8
#30 0x0000559c0aa0c76d llvm::SmallPtrSetImplBase::isSmall() const /home/x27zhou/compilers/llvm-project/llvm/include/llvm/ADT/SmallPtrSet.h:248:33
#31 0x0000559c0aa0c76d llvm::SmallPtrSetImplBase::~SmallPtrSetImplBase() /home/x27zhou/compilers/llvm-project/llvm/include/llvm/ADT/SmallPtrSet.h:89:10
#32 0x0000559c0aa0c76d llvm::PreservedAnalyses::~PreservedAnalyses() /home/x27zhou/compilers/llvm-project/llvm/include/llvm/IR/Analysis.h:112:7
#33 0x0000559c0aa0c76d (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) /home/x27zhou/compilers/llvm-project/clang/lib/CodeGen/BackendUtil.cpp:1221:5
#34 0x0000559c0a9eece4 (anonymous namespace)::EmitAssemblyHelper::RunCodegenPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&) /home/x27zhou/compilers/llvm-project/clang/lib/CodeGen/BackendUtil.cpp:0:0
#35 0x0000559c0a9eece4 (anonymous namespace)::EmitAssemblyHelper::emitAssembly(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) /home/x27zhou/compilers/llvm-project/clang/lib/CodeGen/BackendUtil.cpp:1313:3
#36 0x0000559c0a9eece4 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) /home/x27zhou/compilers/llvm-project/clang/lib/CodeGen/BackendUtil.cpp:1485:13
#37 0x0000559c0baa7b1f clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) /home/x27zhou/compilers/llvm-project/clang/lib/CodeGen/CodeGenAction.cpp:312:3
#38 0x0000559c10648666 clang::ParseAST(clang::Sema&, bool, bool) /home/x27zhou/compilers/llvm-project/clang/lib/Parse/ParseAST.cpp:0:13
#39 0x0000559c0bab7d41 clang::CodeGenAction::ExecuteAction() /home/x27zhou/compilers/llvm-project/clang/lib/CodeGen/CodeGenAction.cpp:0:30
#40 0x0000559c0c36e1d5 clang::FrontendAction::Execute() /home/x27zhou/compilers/llvm-project/clang/lib/Frontend/FrontendAction.cpp:1316:10
#41 0x0000559c0c15e106 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) /home/x27zhou/compilers/llvm-project/clang/lib/Frontend/CompilerInstance.cpp:0:33
#42 0x0000559c0c6b31b8 std::__shared_ptr<clang::CompilerInvocation, (__gnu_cxx::_Lock_policy)2>::get() const /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/shared_ptr_base.h:1666:16
#43 0x0000559c0c6b31b8 std::__shared_ptr_access<clang::CompilerInvocation, (__gnu_cxx::_Lock_policy)2, false, false>::_M_get() const /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/shared_ptr_base.h:1363:66
#44 0x0000559c0c6b31b8 std::__shared_ptr_access<clang::CompilerInvocation, (__gnu_cxx::_Lock_policy)2, false, false>::operator->() const /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/shared_ptr_base.h:1357:9
#45 0x0000559c0c6b31b8 clang::CompilerInstance::getFrontendOpts() /home/x27zhou/compilers/llvm-project/clang/include/clang/Frontend/CompilerInstance.h:301:12
#46 0x0000559c0c6b31b8 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) /home/x27zhou/compilers/llvm-project/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:311:14
#47 0x0000559c018c818f cc1_main(llvm::ArrayRef<char const*>, char const*, void*) /home/x27zhou/compilers/llvm-project/clang/tools/driver/cc1_main.cpp:0:15
#48 0x0000559c018bd712 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>) /home/x27zhou/compilers/llvm-project/clang/tools/driver/driver.cpp:225:12
#49 0x0000559c018ba418 clang_main(int, char**, llvm::ToolContext const&) /home/x27zhou/compilers/llvm-project/clang/tools/driver/driver.cpp:0:12
#50 0x0000559c018edbe0 main /home/x27zhou/compilers/llvm-trunk-build/tools/clang/tools/driver/clang-driver.cpp:17:10
#<truncated>Please see the issue for the entire body.
![]()
_______________________________________________
llvm-bugs mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
