Bounds error in compiler

[maleadt]

The following fun repro crashes the compiler (tested on 1.0.2 and master):

for a = 1 end, b += 2

   _       _ _(_)_     |  Documentation: https://docs.julialang.org
  (_)     | (_) (_)    |
   _ _   _| |_  __ _   |  Type "?" for help, "]?" for Pkg help.
  | | | | | | |/ _` |  |
  | | |_| | | | (_| |  |  Version 1.0.2 (2018-11-08)
 _/ |\__'_|_|_|\__'_|  |  
|__/                   |

julia> for a = 1 end, b += 2
Internal error: encountered unexpected error in runtime:
BoundsError(a=Array{Core.Compiler.NewNode, (0,)}[], i=(2,))
unknown function (ip: 0x7f8441291348)
unknown function (ip: 0x7f84412623e3)
jl_throw at /usr/bin/../lib/libjulia.so.1 (unknown line)
jl_bounds_error_ints at /usr/bin/../lib/libjulia.so.1 (unknown line)
unknown function (ip: 0x7f84387541d9)
unknown function (ip: 0x7f84387a3faf)
unknown function (ip: 0x7f84387ae95f)
unknown function (ip: 0x7f84387af898)
unknown function (ip: 0x7f84387b0ba1)
unknown function (ip: 0x7f84387b20e1)
unknown function (ip: 0x7f84387b2330)
jl_apply_generic at /usr/bin/../lib/libjulia.so.1 (unknown line)
jl_apply_with_saved_exception_state at /usr/bin/../lib/libjulia.so.1 (unknown line)
unknown function (ip: 0x7f8441245c96)
unknown function (ip: 0x7f844127c4f9)
jl_toplevel_eval_in at /usr/bin/../lib/libjulia.so.1 (unknown line)
unknown function (ip: 0x7f84387ec161)
jl_apply_generic at /usr/bin/../lib/libjulia.so.1 (unknown line)
unknown function (ip: 0x7f843895d6ba)
unknown function (ip: 0x7f843895d92b)
jl_apply_generic at /usr/bin/../lib/libjulia.so.1 (unknown line)
unknown function (ip: 0x7f8441262d8d)
unknown function (ip: 0xffffffffffffffff)
Unreachable reached at 0x7f8423fad3c8

signal (4): Illegal instruction
in expression starting at no file:0
top-level scope at ./REPL[0]:2 [inlined]
top-level scope at ./none:0
jl_fptr_trampoline at /usr/bin/../lib/libjulia.so.1 (unknown line)
unknown function (ip: 0x7f844127c497)
jl_toplevel_eval_in at /usr/bin/../lib/libjulia.so.1 (unknown line)
unknown function (ip: 0x7f84387ec161)
jl_apply_generic at /usr/bin/../lib/libjulia.so.1 (unknown line)
unknown function (ip: 0x7f843895d6ba)
unknown function (ip: 0x7f843895d92b)
jl_apply_generic at /usr/bin/../lib/libjulia.so.1 (unknown line)
unknown function (ip: 0x7f8441262d8d)
unknown function (ip: 0xffffffffffffffff)
Allocations: 96127 (Pool: 96058; Big: 69); GC: 0
zsh: illegal hardware instruction (core dumped)  julia --depwarn=no --color=yes

FWIW, didn't crash on 0.6.

[chethega]

Alternative reproduction:

julia> function f()
       b=0
       for a = 1  end, b += 2
       end
f (generic function with 1 method)

julia> @code_lowered f()
CodeInfo(
2 1 ─       Core.NewvarNode(:(#temp#@_3))                                                                                         │
  │         b = 0                                                                                                                 │
3 │   %3  = 1                                                                                                                     │
  │         #temp#@_2 = (Base.iterate)(%3)                                                                                        │
  │   %5  = #temp#@_2 === nothing                                                                                                 │
  │   %6  = (Base.not_int)(%5)                                                                                                    │
  └──       goto #4 if not %6                                                                                                     │
  2 ┄ %8  = #temp#@_2                                                                                                             │
  │         a = (Core.getfield)(%8, 1)                                                                                            │
  │   %10 = (Core.getfield)(%8, 2)                                                                                                │
  │         #temp#@_2 = (Base.iterate)(%3, %10)                                                                                   │
  │   %12 = #temp#@_2 === nothing                                                                                                 │
  │   %13 = (Base.not_int)(%12)                                                                                                   │
  └──       goto #4 if not %13                                                                                                    │
  3 ─       goto #2                                                                                                               │
  4 ┄       nothing                                                                                                               │
  │   %17 = (Core.tuple)(%20, b)                                                                                                  │
  │   %18 = %17 + 2                                                                                                               │
  │   %19 = (Base.indexed_iterate)(%18, 1)                                                                                        │
  │   %20 = (Core.getfield)(%19, 1)                                                                                               │
  │         #temp#@_3 = (Core.getfield)(%19, 2)                                                                                   │
  │   %22 = (Base.indexed_iterate)(%18, 2, #temp#@_3)                                                                             │
  │         b = (Core.getfield)(%22, 1)                                                                                           │
  └──       return %18                                                                                                            │
)

The line %17 = (Core.tuple)(%20, b) is clearly impossible, so the problem appears during lowering (dom-tree is wrong?). Then

julia> @code_typed f()
ERROR: UndefRefError: access to undefined reference
Stacktrace:
 [1] getindex at ./array.jl:739 [inlined]
 [2] renumber_ssa at ./compiler/ssair/slot2ssa.jl:65 [inlined]
 [3] #239 at ./compiler/ssair/slot2ssa.jl:74 [inlined]
 [4] ssamap(::getfield(Core.Compiler, Symbol("##239#240")){Array{Any,1},Bool,Nothing}, ::Any) at ./compiler/ssair/ir.jl:429
 [5] renumber_ssa! at ./compiler/ssair/slot2ssa.jl:74 [inlined]
 [6] renumber_ssa! at ./compiler/ssair/slot2ssa.jl:73 [inlined]
 [7] domsort_ssa!(::Core.Compiler.IRCode, ::Core.Compiler.DomTree) at ./compiler/ssair/slot2ssa.jl:495
 [8] construct_ssa!(::Core.CodeInfo, ::Array{Any,1}, ::Core.Compiler.IRCode, ::Core.Compiler.DomTree, ::Array{Core.Compiler.SlotInfo,1}, ::Int64, ::Core.SimpleVector, ::Array{Any,1}) at ./compiler/ssair/slot2ssa.jl:866
 [9] just_construct_ssa(::Core.CodeInfo, ::Array{Any,1}, ::Int64, ::Core.Compiler.OptimizationState) at ./compiler/ssair/driver.jl:109
 [10] run_passes(::Core.CodeInfo, ::Int64, ::Core.Compiler.OptimizationState) at ./compiler/ssair/driver.jl:114
 [11] optimize(::Core.Compiler.OptimizationState, ::Any) at ./compiler/optimize.jl:164
 [12] typeinf_code(::Method, ::Any, ::Core.SimpleVector, ::Bool, ::Core.Compiler.Params) at ./compiler/typeinfer.jl:522
 [13] #code_typed#20(::Bool, ::Function, ::Any, ::Any) at ./reflection.jl:904
 [14] code_typed(::Any, ::Any) at ./reflection.jl:894

The same issue appears for

julia> function g()
       b=0
       if false end,b += 2
       end

[JeffBezanson]

The lowering for this is also invalid in 0.6; we were just able to run a bit longer before hitting an error.