| Issue |
175882
|
| Summary |
[clang] Crash at -O3 with PGO: Assertion `!NodePtr->isKnownSentinel()' failed.
|
| Labels |
clang
|
| Assignees |
|
| Reporter |
zxt5
|
small.c:
```
long long c;
char d, k;
short e, l;
short f[];
#define g(a, b) \
{ \
__typeof__(a) h = a; \
__typeof__(b) i = b; \
h > i ? h : i; \
}
#define j(a, b) \
{ \
__typeof__(a) h = 0; \
__typeof__(b) i = b; \
h < i ? h : i; \
}
int m, q = 403137266536869, r;
short *n;
long *o;
char s[];
short t[8][18];
long long aa[][18][18];
int u[][18][18][18];
void test(long p, int q, int r, char s[], short t[][18], long long aa[][18][18],
int u[][18][18][18]) {
if (1) {
for (_Bool v = 0; v < 1; v = p)
;
for (int w = 0; w < 18; w += 3) {
for (char x = 0; x < 8; x += 3)
for (int y = 0; y < 8; y += 3)
;
for (short z = 0; z < 1; z += 0 ? 0 : 40 ? p : 0) {
for (long ab = 0; ab < 7; ab = 91)
for (char ac = 0; ac < 18; ac += 2) {
for (_Bool ad = t[1][ab] - 1; ad < 1; ad = 1)
c = l ? n[w] ? s[w] : 0 : u[w][z][w][1];
for (_Bool ae = q; ae < 1; ae = 1) {
if (k ? o[ab] : s[2])
f[ab + ae] &= d = (j(0, aa[1][ab][3]));
else
;
e = (g(e, (short)r));
}
}
j(0, 0 ? 0 : 0)
}
for (int af = 4; af < 6; af += 4)
;
for (int ag = 0; ag < 7; ag += 2)
2 == m ? 0 : !(0 ? 0 : 0);
for (int ah = 0 ? 0 < 0 : 0 ? 0 : 0; ah < 0;)
if (0 ? 0 : 0) {
if (0)
0 ? 0 : 0;
0 ? 0 : 0;
j(0, 0 > 0)
}
!0;
}
g(0, (g(0, 0)))
}
}
void main() { test(60386248197294407, q, r, s, t, aa, u); }
```
This code crashes when compiled at -O3 with PGO.
Steps to reproduce:
1. Generate the profile using [profile.txt](https://github.com/user-attachments/files/24604818/profile.txt):
```
llvm-profdata merge -o test.profdata profile.txt
```
2. Compile at -O3 with PGO:
```
clang-trunk -O3 -fprofile-instr-use=test.profdata small.c
```
Crash:
```
clang-22: /home/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/ilist_iterator.h:322: llvm::ilist_iterator_w_bits::reference llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>::operator*() const [OptionsT = llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, IsReverse = false, IsConst = false]: Assertion `!NodePtr->isKnownSentinel()' failed.
```
Backtrace:
```
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0. Program arguments: /home/x27zhou/compiler-nightly/install/llvm/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O3 -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name small.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/home/x27zhou/fuzz-pgo/outcome-2026-01-13-06-17-27/bug-exit-16-id-137261/reduction/reduce-profile -fprofile-instrument-use=clang -fprofile-instrument-use-path=test.profdata -fcoverage-compilation-dir=/home/x27zhou/fuzz-pgo/outcome-2026-01-13-06-17-27/bug-exit-16-id-137261/reduction/reduce-profile -resource-dir /home/x27zhou/compiler-nightly/install/llvm/lib/clang/22 -internal-isystem /home/x27zhou/compiler-nightly/install/llvm/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fmessage-length=259 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -faddrsig -fdwarf2-cfi-asm -o /tmp/small-147daf.o -x c small.c
1. <eof> parser at end of file
2. Optimizer
3. Running pass "function<eager-inv>(drop-unnecessary-assumes,float2int,lower-constant-intrinsics,chr,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,drop-unnecessary-assumes,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-arithmetic;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O3>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;switch-to-arithmetic;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "small.c"
4. Running pass "chr" on function "main"
#0 0x000055eecfa0cc1b backtrace (/home/x27zhou/compiler-nightly/install/llvm/bin/clang-22+0x4e63c1b)
#1 0x000055eed85ebe88 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:846:8
#2 0x000055eed85e3da0 llvm::sys::RunSignalHandlers() /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Signals.cpp:0:5
#3 0x000055eed85ef0b7 SignalHandler(int, siginfo_t*, void*) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:429:38
#4 0x00007f90b4604520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#5 0x00007f90b46589fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#6 0x00007f90b46589fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#7 0x00007f90b46589fc pthread_kill ./nptl/pthread_kill.c:89:10
#8 0x00007f90b4604476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#9 0x00007f90b45ea7f3 abort ./stdlib/abort.c:81:7
#10 0x00007f90b45ea71b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#11 0x00007f90b45fbe96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#12 0x000055eed6e600d9 llvm::BasicBlock::isInstrOrderValid() const /home/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/IR/BasicBlock.h:744:12
#13 0x000055eed6e600d9 llvm::BasicBlock::validateInstrOrdering() const /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/BasicBlock.cpp:1113:8
#14 0x000055eed6e600d9 llvm::BasicBlock::invalidateOrders() /home/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/IR/BasicBlock.h:749:5
#15 0x000055eed6e600d9 void llvm::invalidateParentIListOrdering<llvm::BasicBlock>(llvm::BasicBlock*) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/BasicBlock.cpp:136:7
#16 0x000055eed6e600d9 llvm::SymbolTableListTraits<llvm::Instruction, llvm::ilist_iterator_bits<true>, llvm::ilist_parent<llvm::BasicBlock>>::transferNodesFromList(llvm::SymbolTableListTraits<llvm::Instruction, llvm::ilist_iterator_bits<true>, llvm::ilist_parent<llvm::BasicBlock>>&, llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>, llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/SymbolTableListTraitsImpl.h:93:3
#17 0x000055eed6e69792 llvm::iplist_impl<llvm::simple_ilist<llvm::Instruction, llvm::ilist_iterator_bits<true>, llvm::ilist_parent<llvm::BasicBlock>>, llvm::SymbolTableListTraits<llvm::Instruction, llvm::ilist_iterator_bits<true>, llvm::ilist_parent<llvm::BasicBlock>>>::transfer(llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>, llvm::iplist_impl<llvm::simple_ilist<llvm::Instruction, llvm::ilist_iterator_bits<true>, llvm::ilist_parent<llvm::BasicBlock>>, llvm::SymbolTableListTraits<llvm::Instruction, llvm::ilist_iterator_bits<true>, llvm::ilist_parent<llvm::BasicBlock>>>&, llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>, llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/ilist.h:0:11
#18 0x000055eed6e69792 llvm::iplist_impl<llvm::simple_ilist<llvm::Instruction, llvm::ilist_iterator_bits<true>, llvm::ilist_parent<llvm::BasicBlock>>, llvm::SymbolTableListTraits<llvm::Instruction, llvm::ilist_iterator_bits<true>, llvm::ilist_parent<llvm::BasicBlock>>>::splice(llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>, llvm::iplist_impl<llvm::simple_ilist<llvm::Instruction, llvm::ilist_iterator_bits<true>, llvm::ilist_parent<llvm::BasicBlock>>, llvm::SymbolTableListTraits<llvm::Instruction, llvm::ilist_iterator_bits<true>, llvm::ilist_parent<llvm::BasicBlock>>>&, llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>, llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/ilist.h:276:24
#19 0x000055eed6e69792 llvm::BasicBlock::splice(llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>, llvm::BasicBlock*, llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>, llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/BasicBlock.cpp:1022:17
#20 0x000055eed6e67f21 llvm::BasicBlock::splitBasicBlock(llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>, llvm::Twine const&, bool) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/BasicBlock.cpp:574:8
#21 0x000055eed86bb8cb SplitBlockImpl(llvm::BasicBlock*, llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>, llvm::DomTreeUpdater*, llvm::DominatorTree*, llvm::LoopInfo*, llvm::MemorySSAUpdater*, llvm::Twine const&, bool) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Utils/BasicBlockUtils.cpp:0:26
#22 0x000055eed86bb222 llvm::SplitBlock(llvm::BasicBlock*, llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>, llvm::DominatorTree*, llvm::LoopInfo*, llvm::MemorySSAUpdater*, llvm::Twine const&, bool) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Utils/BasicBlockUtils.cpp:1056:10
#23 0x000055eedcc4c5ff llvm::SplitBlock(llvm::BasicBlock*, llvm::Instruction*, llvm::DominatorTree*, llvm::LoopInfo*, llvm::MemorySSAUpdater*, llvm::Twine const&, bool) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/Transforms/Utils/BasicBlockUtils.h:334:10
#24 0x000055eedcc4c5ff (anonymous namespace)::CHR::transformScopes((anonymous namespace)::CHRScope*, llvm::DenseSet<llvm::PHINode*, llvm::DenseMapInfo<llvm::PHINode*, void>>&) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Instrumentation/ControlHeightReduction.cpp:1731:7
#25 0x000055eedcc18c5c (anonymous namespace)::CHR::transformScopes(llvm::SmallVectorImpl<(anonymous namespace)::CHRScope*>&) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Instrumentation/ControlHeightReduction.cpp:0:5
#26 0x000055eedcc18c5c (anonymous namespace)::CHR::run() /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Instrumentation/ControlHeightReduction.cpp:2076:7
#27 0x000055eedcc18c5c llvm::ControlHeightReductionPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Instrumentation/ControlHeightReduction.cpp:2114:48
#28 0x000055eedb536b62 llvm::detail::PassModel<llvm::Function, llvm::ControlHeightReductionPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:91:5
#29 0x000055eed72f53f8 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/IR/PassManagerImpl.h:80:8
#30 0x000055eed0823f82 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:91:5
#31 0x000055eed7301882 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/IR/PassManager.cpp:132:23
#32 0x000055eed0827592 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:91:5
#33 0x000055eed72f1ee8 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /home/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/IR/PassManagerImpl.h:80:8
#34 0x000055eed8c54373 llvm::SmallPtrSetImplBase::isSmall() const /home/x27zhou/comp<truncated>Please see the issue for the entire body.
![]()
_______________________________________________
llvm-bugs mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
