Mikael Holmén via llvm-dev
2015-Aug-18 07:10 UTC
[llvm-dev] Running -jump-threading twice crashes opt in ValueHandleBase::ValueIsDeleted
Hi,
Running
build-all/bin/opt -S ./bugpoint-reduced-simplified.ll -jump-threading
-jump-threading
on the attached bugpoint-reduced ll-file ends with
While deleting: label %bb1
An asserting value handle still pointed to this value!
UNREACHABLE executed at ../lib/IR/Value.cpp:686!
It's on the second invocation of jump-threading that it breaks, when it
calls llvm::removeUnreachableBlocks:
0 opt 0x000000000163806a
llvm::sys::PrintStackTrace(llvm::raw_ostream&) + 42
1 opt 0x0000000001637576 llvm::sys::RunSignalHandlers() + 86
2 opt 0x0000000001639893
3 libpthread.so.0 0x00007f57baa72340
4 libc.so.6 0x00007f57b9c9acc9 gsignal + 57
5 libc.so.6 0x00007f57b9c9e0d8 abort + 328
6 opt 0x00000000015f874d
llvm::llvm_unreachable_internal(char const*, char const*, unsigned int)
+ 461
7 opt 0x00000000012a2ebb
llvm::ValueHandleBase::ValueIsDeleted(llvm::Value*) + 1051
8 opt 0x00000000012a282b llvm::Value::~Value() + 43
9 opt 0x0000000001164cf9 llvm::BasicBlock::~BasicBlock() + 9
10 opt 0x00000000016749ec
llvm::removeUnreachableBlocks(llvm::Function&) + 2956
11 opt 0x00000000014c2be7
12 opt 0x00000000012727ec
llvm::FPPassManager::runOnFunction(llvm::Function&) + 524
13 opt 0x0000000001272a2b
llvm::FPPassManager::runOnModule(llvm::Module&) + 43
14 opt 0x0000000001272f27
llvm::legacy::PassManagerImpl::run(llvm::Module&) + 935
15 opt 0x0000000000602304 main + 8164
16 libc.so.6 0x00007f57b9c85ec5 __libc_start_main + 245
17 opt 0x00000000005f3882
The code looks like this when jump-threading is invoked the second time:
*** IR Dump Before Jump Threading ***
define void @fn1() {
.split.us:
br label %bb2.us.us
bb2.us.us: ; preds = %bb2.us.us,
%.split.us
br label %bb2.us.us
bb1.us: ; preds = %bb1.us
br label %bb1.us
bb2.us4: ; preds = %bb2.us4
br label %bb2.us4
bb2: ; preds = %bb1
%_tmp3 = icmp slt i16 %_tmp18, 2
br i1 %_tmp3, label %bb1, label %bb1
bb1: ; preds = %bb2, %bb2
%_tmp18 = load i16, i16* @c
%_tmp20 = icmp ne i16 %_tmp18, 0
br i1 %_tmp20, label %bb2, label %bb6
bb6: ; preds = %bb1
ret void
}
And when it tries to delete bb1 it crashes.
(We're not really that interested in running -jump-threading twice, but
our test runs randomizes the opt flags and stumbled upon this.)
Should I write a TR on this or is this the expected outcome?
Regards,
Mikael
-------------- next part --------------
; ModuleID = 'bugpoint-reduced-simplified.bc'
target triple = "x86_64-unknown-linux-gnu"
@c = external global i16
define void @fn1() {
br i1 undef, label %.split.us, label %.split
.split.us: ; preds = %0
br i1 undef, label %bb1.us.us, label %bb1.us
bb1.us.us: ; preds = %bb2.us.us,
%.split.us
br i1 undef, label %bb2.us.us, label %bb6
bb2.us.us: ; preds = %bb1.us.us
br label %bb1.us.us
bb1.us: ; preds = %bb2.us, %.split.us
br i1 undef, label %bb2.us, label %bb6
bb2.us: ; preds = %bb1.us
br label %bb1.us
.split: ; preds = %0
br i1 undef, label %bb1.us1, label %bb1
bb1.us1: ; preds = %bb5.us12, %.split
br i1 undef, label %bb2.us4, label %bb6
bb2.us4: ; preds = %bb1.us1
br i1 undef, label %bb4.us7, label %bb5.us12
bb4.us7: ; preds = %bb2.us4
br label %bb5.us12
bb5.us12: ; preds = %bb4.us7, %bb2.us4
br label %bb1.us1
bb2: ; preds = %bb1
%_tmp3 = icmp slt i16 %_tmp18, 2
br i1 %_tmp3, label %bb4, label %bb5
bb4: ; preds = %bb2
br label %bb5
bb5: ; preds = %bb4, %bb2
br label %bb1
bb1: ; preds = %bb5, %.split
%_tmp18 = load i16, i16* @c
%_tmp20 = icmp ne i16 %_tmp18, 0
br i1 %_tmp20, label %bb2, label %bb6
bb6: ; preds = %bb1, %bb1.us1,
%bb1.us, %bb1.us.us
ret void
}