Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[LLVM-Reduce] Assertion `CI->getCalledFunction() == OldF' failed. #100880

Closed
patrick-rivos opened this issue Jul 27, 2024 · 2 comments · Fixed by #131981
Closed

[LLVM-Reduce] Assertion `CI->getCalledFunction() == OldF' failed. #100880

patrick-rivos opened this issue Jul 27, 2024 · 2 comments · Fixed by #131981
Labels
crash Prefer [crash-on-valid] or [crash-on-invalid] llvm-reduce

Comments

@patrick-rivos
Copy link
Contributor

patrick-rivos commented Jul 27, 2024

reduced.ll:

; ModuleID = 'red.ll'
source_filename = "red.c"
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"

; Function Attrs: noinline nounwind optnone uwtable
define void @c() #0 {
entry:
  %0 = load i8, ptr null, align 1
  %conv = zext i8 %0 to i32
  %1 = load i16, ptr null, align 2
  %conv1 = sext i16 %1 to i32
  %cmp = icmp sge i32 %conv, %conv1
  %conv2 = zext i1 %cmp to i32
  call void @c(i32 noundef signext %conv2)
  ret void
}

attributes #0 = { noinline nounwind optnone uwtable "frame-pointer"="all" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="generic-rv64" "target-features"="+64bit,+relax,+xcvalu,-a,-b,-c,-d,-e,-experimental-smmpm,-experimental-smnpm,-experimental-ssnpm,-experimental-sspm,-experimental-ssqosid,-experimental-supm,-experimental-zacas,-experimental-zalasr,-experimental-zicfilp,-experimental-zicfiss,-f,-h,-m,-shcounterenw,-shgatpa,-shtvala,-shvsatpa,-shvstvala,-shvstvecd,-smaia,-smcdeleg,-smcsrind,-smepmp,-smstateen,-ssaia,-ssccfg,-ssccptr,-sscofpmf,-sscounterenw,-sscsrind,-ssstateen,-ssstrict,-sstc,-sstvala,-sstvecd,-ssu64xl,-svade,-svadu,-svbare,-svinval,-svnapot,-svpbmt,-v,-xcvbi,-xcvbitmanip,-xcvelw,-xcvmac,-xcvmem,-xcvsimd,-xsfcease,-xsfvcp,-xsfvfnrclipxfqf,-xsfvfwmaccqqq,-xsfvqmaccdod,-xsfvqmaccqoq,-xsifivecdiscarddlone,-xsifivecflushdlone,-xtheadba,-xtheadbb,-xtheadbs,-xtheadcmo,-xtheadcondmov,-xtheadfmemidx,-xtheadmac,-xtheadmemidx,-xtheadmempair,-xtheadsync,-xtheadvdot,-xventanacondops,-xwchc,-za128rs,-za64rs,-zaamo,-zabha,-zalrsc,-zama16b,-zawrs,-zba,-zbb,-zbc,-zbkb,-zbkc,-zbkx,-zbs,-zca,-zcb,-zcd,-zce,-zcf,-zcmop,-zcmp,-zcmt,-zdinx,-zfa,-zfbfmin,-zfh,-zfhmin,-zfinx,-zhinx,-zhinxmin,-zic64b,-zicbom,-zicbop,-zicboz,-ziccamoa,-ziccif,-zicclsm,-ziccrse,-zicntr,-zicond,-zicsr,-zifencei,-zihintntl,-zihintpause,-zihpm,-zimop,-zk,-zkn,-zknd,-zkne,-zknh,-zkr,-zks,-zksed,-zksh,-zkt,-zmmul,-ztso,-zvbb,-zvbc,-zve32f,-zve32x,-zve64d,-zve64f,-zve64x,-zvfbfmin,-zvfbfwma,-zvfh,-zvfhmin,-zvkb,-zvkg,-zvkn,-zvknc,-zvkned,-zvkng,-zvknha,-zvknhb,-zvks,-zvksc,-zvksed,-zvksg,-zvksh,-zvkt,-zvl1024b,-zvl128b,-zvl16384b,-zvl2048b,-zvl256b,-zvl32768b,-zvl32b,-zvl4096b,-zvl512b,-zvl64b,-zvl65536b,-zvl8192b" }

min_ir.sh:

#!/bin/bash
/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llc $1 2>&1 | grep "LLVM ERROR"

Command/backtrace:

> /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llvm-reduce --delta-passes=operands-to-args --test min_ir.sh reduced.ll
LLVM ERROR: Cannot select: t35: i64 = setcc t26, t27, setle:ch
*** Converting operands to function arguments...
LLVM ERROR: Cannot select: t35: i64 = setcc t26, t27, setle:ch
llvm-reduce: /scratch/tc-testing/tc-compiler-fuzz-trunk/llvm/llvm/tools/llvm-reduce/deltas/ReduceOperandsToArgs.cpp:64: void replaceFunctionCalls(llvm::Function*, llvm::Function*): Assertion `CI->getCalledFunction() == OldF' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/llvm-reduce --delta-passes=operands-to-args --test min_ir.sh reduced.ll
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0  llvm-reduce 0x00005abc508324e0
1  llvm-reduce 0x00005abc5082fadf
2  llvm-reduce 0x00005abc5082fc35
3  libc.so.6   0x0000794c4a842520
4  libc.so.6   0x0000794c4a8969fc pthread_kill + 300
5  libc.so.6   0x0000794c4a842476 raise + 22
6  libc.so.6   0x0000794c4a8287f3 abort + 211
7  libc.so.6   0x0000794c4a82871b
8  libc.so.6   0x0000794c4a839e96
9  llvm-reduce 0x00005abc4f800f6e
10 llvm-reduce 0x00005abc4f802f5c
11 llvm-reduce 0x00005abc4f804561
12 llvm-reduce 0x00005abc4f7dcea7
13 llvm-reduce 0x00005abc4f7de930
14 llvm-reduce 0x00005abc4f7c9e04
15 llvm-reduce 0x00005abc4f713a83
16 libc.so.6   0x0000794c4a829d90
17 libc.so.6   0x0000794c4a829e40 __libc_start_main + 128
18 llvm-reduce 0x00005abc4f7c3175
zsh: IOT instruction   --delta-passes=operands-to-args --test min_ir.sh reduced.ll

Assertion:

assert(CI->getCalledFunction() == OldF);

Looks related to/duplicate of #69312, however that issue was missing a reproducer.

@patrick-rivos
Copy link
Contributor Author

Unreduced testcase (eventually triggers assert with plain llvm-reduce and the min_ir.sh testcase above.):

; ModuleID = 'red.bc'
source_filename = "red.c"
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"

@a = dso_local global i8 0, align 1
@b = dso_local global i16 0, align 2

; Function Attrs: noinline nounwind optnone uwtable
define dso_local void @c() #0 {
entry:
  %0 = load i8, ptr @a, align 1
  %conv = zext i8 %0 to i32
  %1 = load i16, ptr @b, align 2
  %conv1 = sext i16 %1 to i32
  %cmp = icmp sge i32 %conv, %conv1
  %conv2 = zext i1 %cmp to i32
  call void @c(i32 noundef signext %conv2)
  ret void
}

attributes #0 = { noinline nounwind optnone uwtable "frame-pointer"="all" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="generic-rv64" "target-features"="+64bit,+relax,+xcvalu,-a,-b,-c,-d,-e,-experimental-smmpm,-experimental-smnpm,-experimental-ssnpm,-experimental-sspm,-experimental-ssqosid,-experimental-supm,-experimental-zacas,-experimental-zalasr,-experimental-zicfilp,-experimental-zicfiss,-f,-h,-m,-shcounterenw,-shgatpa,-shtvala,-shvsatpa,-shvstvala,-shvstvecd,-smaia,-smcdeleg,-smcsrind,-smepmp,-smstateen,-ssaia,-ssccfg,-ssccptr,-sscofpmf,-sscounterenw,-sscsrind,-ssstateen,-ssstrict,-sstc,-sstvala,-sstvecd,-ssu64xl,-svade,-svadu,-svbare,-svinval,-svnapot,-svpbmt,-v,-xcvbi,-xcvbitmanip,-xcvelw,-xcvmac,-xcvmem,-xcvsimd,-xsfcease,-xsfvcp,-xsfvfnrclipxfqf,-xsfvfwmaccqqq,-xsfvqmaccdod,-xsfvqmaccqoq,-xsifivecdiscarddlone,-xsifivecflushdlone,-xtheadba,-xtheadbb,-xtheadbs,-xtheadcmo,-xtheadcondmov,-xtheadfmemidx,-xtheadmac,-xtheadmemidx,-xtheadmempair,-xtheadsync,-xtheadvdot,-xventanacondops,-xwchc,-za128rs,-za64rs,-zaamo,-zabha,-zalrsc,-zama16b,-zawrs,-zba,-zbb,-zbc,-zbkb,-zbkc,-zbkx,-zbs,-zca,-zcb,-zcd,-zce,-zcf,-zcmop,-zcmp,-zcmt,-zdinx,-zfa,-zfbfmin,-zfh,-zfhmin,-zfinx,-zhinx,-zhinxmin,-zic64b,-zicbom,-zicbop,-zicboz,-ziccamoa,-ziccif,-zicclsm,-ziccrse,-zicntr,-zicond,-zicsr,-zifencei,-zihintntl,-zihintpause,-zihpm,-zimop,-zk,-zkn,-zknd,-zkne,-zknh,-zkr,-zks,-zksed,-zksh,-zkt,-zmmul,-ztso,-zvbb,-zvbc,-zve32f,-zve32x,-zve64d,-zve64f,-zve64x,-zvfbfmin,-zvfbfwma,-zvfh,-zvfhmin,-zvkb,-zvkg,-zvkn,-zvknc,-zvkned,-zvkng,-zvknha,-zvknhb,-zvks,-zvksc,-zvksed,-zvksg,-zvksh,-zvkt,-zvl1024b,-zvl128b,-zvl16384b,-zvl2048b,-zvl256b,-zvl32768b,-zvl32b,-zvl4096b,-zvl512b,-zvl64b,-zvl65536b,-zvl8192b" }

!llvm.module.flags = !{!0, !1, !2, !4, !5, !6, !7, !8}
!llvm.ident = !{!9}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 1, !"target-abi", !"lp64"}
!2 = !{i32 6, !"riscv-isa", !3}
!3 = !{!"rv64i2p1_xcvalu1p0"}
!4 = !{i32 8, !"PIC Level", i32 2}
!5 = !{i32 7, !"PIE Level", i32 2}
!6 = !{i32 7, !"uwtable", i32 2}
!7 = !{i32 7, !"frame-pointer", i32 2}
!8 = !{i32 8, !"SmallDataLimit", i32 8}
!9 = !{!"clang version 20.0.0git (https://github.com/llvm/llvm-project.git 299c700a22460edb7bb6fe937cd23a5b823d4081)"}

@dtcxzyw dtcxzyw added crash Prefer [crash-on-valid] or [crash-on-invalid] llvm-reduce and removed new issue labels Jul 27, 2024
@arsenm
Copy link
Contributor

arsenm commented Mar 19, 2025

Duplicate of #69312, which has a patch at #131981. I'm going to try turning this into a second testcase

arsenm added a commit that referenced this issue Mar 19, 2025
This fixes asserting on IR with undefined behavior from calls
with a type that does not match the type of the target function.

Just ignore callsites which already didn't match the function
signature. This is the most straightforward fix, the reference
to the global will be replaced later anyway. A better implementation
would try to pad out unused arguments, particularly in the cases where
the signatures only differ in type and not count.

Fixes #69312, fixes #100880
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
crash Prefer [crash-on-valid] or [crash-on-invalid] llvm-reduce
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants