crash bug with dynamic profiling

[regehr]

Does anyone have time to take a look at this one? This crash comes from compiling gcc from SPEC CPU 2006 with dynamic optimization profiling. The crash happens in InstCombine, not in Souper itself -- so this may not be our bug.

$ cat small.c
enum e { x1, x2, x3 } x4;

int x7(int);

void x5(void) {
  enum e x6 = x4 > 0;
  switch (x6) {
  case 1:
    x6 = x3;
    break;
  case 0:
    x6 = 1;
  }
  (x6 == 1 || x6 == x3) && (x6 == 1 || x6 == x3) && x4 && x7(x6);
}
$ /home/regehr/f/souper-regehr/third_party/llvm/Debug/bin/clang -c -w -O small.c -Xclang -load -Xclang /home/regehr/f/souper-regehr/build/libsouperPass.so -mllvm -z3-path=/usr/bin/z3 -mllvm -souper-exploit-ub=false -mllvm -souper-dynamic-profile
clang-3.7: ../include/llvm/Support/Casting.h:223: typename std::enable_if<!is_simple_type<Y>::value, typename cast_retty<X, const Y>::ret_type>::type llvm::cast(const Y &) [X = llvm::PHINode, Y = llvm::ilist_iterator<llvm::Instruction>]: Assertion `isa<X>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
#0 0x165cdce llvm::sys::PrintStackTrace(_IO_FILE*) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/Support/Unix/Signals.inc:422:15
#1 0x165db7b PrintStackTraceSignalHandler(void*) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/Support/Unix/Signals.inc:481:1
#2 0x1660143 SignalHandler(int) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/Support/Unix/Signals.inc:198:60
#3 0x7f233ae2b340 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x10340)
#4 0x7f233a041cc9 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x36cc9)
#5 0x7f233a0450d8 abort (/lib/x86_64-linux-gnu/libc.so.6+0x3a0d8)
#6 0x7f233a03ab86 (/lib/x86_64-linux-gnu/libc.so.6+0x2fb86)
#7 0x7f233a03ac32 (/lib/x86_64-linux-gnu/libc.so.6+0x2fc32)
#8 0xd92916 _ZN4llvm4castINS_7PHINodeENS_14ilist_iteratorINS_11InstructionEEEEENSt9enable_ifIXntsr14is_simple_typeIT0_EE5valueENS_10cast_rettyIT_KS6_E8ret_typeEE4typeERS9_ /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../include/llvm/Support/Casting.h:224:10
#9 0x139baf3 llvm::InstCombiner::visitPHINode(llvm::PHINode&) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/Transforms/InstCombine/InstCombinePHI.cpp:870:12
#10 0x13265d8 llvm::InstVisitor<llvm::InstCombiner, llvm::Instruction*>::visitPHI(llvm::PHINode&) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../include/llvm/IR/Instruction.def:164:1
#11 0x13252d7 llvm::InstVisitor<llvm::InstCombiner, llvm::Instruction*>::visit(llvm::Instruction&) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../include/llvm/IR/Instruction.def:164:1
#12 0x132476c llvm::InstCombiner::run() /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/Transforms/InstCombine/InstructionCombining.cpp:2695:22
#13 0x1325abc combineInstructionsOverFunction(llvm::Function&, llvm::InstCombineWorklist&, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::DominatorTree&, llvm::DataLayout const*, llvm::LoopInfo*) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/Transforms/InstCombine/InstructionCombining.cpp:2941:9
#14 0x132af3c (anonymous namespace)::InstructionCombiningPass::runOnFunction(llvm::Function&) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/Transforms/InstCombine/InstructionCombining.cpp:3015:3
#15 0x12203ed llvm::FPPassManager::runOnFunction(llvm::Function&) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/IR/LegacyPassManager.cpp:1538:23
#16 0x2151dac (anonymous namespace)::CGPassManager::RunPassOnSCC(llvm::Pass*, llvm::CallGraphSCC&, llvm::CallGraph&, bool&, bool&) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/Analysis/IPA/CallGraphSCCPass.cpp:151:20
#17 0x215174e (anonymous namespace)::CGPassManager::RunAllPassesOnSCC(llvm::CallGraphSCC&, llvm::CallGraph&, bool&) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/Analysis/IPA/CallGraphSCCPass.cpp:416:16
#18 0x215104b (anonymous namespace)::CGPassManager::runOnModule(llvm::Module&) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/Analysis/IPA/CallGraphSCCPass.cpp:472:18
#19 0x1220db9 (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/IR/LegacyPassManager.cpp:1616:23
#20 0x12209ae llvm::legacy::PassManagerImpl::run(llvm::Module&) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/IR/LegacyPassManager.cpp:1723:16
#21 0x1221381 llvm::legacy::PassManager::run(llvm::Module&) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../lib/IR/LegacyPassManager.cpp:1756:3
#22 0x1cd1f75 (anonymous namespace)::EmitAssemblyHelper::EmitAssembly(clang::BackendAction, llvm::raw_ostream*) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../tools/clang/lib/CodeGen/BackendUtil.cpp:635:5
#23 0x1cd1902 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::raw_ostream*) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../tools/clang/lib/CodeGen/BackendUtil.cpp:652:3
#24 0x1cb81f3 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../tools/clang/lib/CodeGen/CodeGenAction.cpp:178:7
#25 0x2984eeb clang::ParseAST(clang::Sema&, bool, bool) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../tools/clang/lib/Parse/ParseAST.cpp:151:3
#26 0x188d489 clang::ASTFrontendAction::ExecuteAction() /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../tools/clang/lib/Frontend/FrontendAction.cpp:537:1
#27 0x1cb770d clang::CodeGenAction::ExecuteAction() /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../tools/clang/lib/CodeGen/CodeGenAction.cpp:726:1
#28 0x188cc40 clang::FrontendAction::Execute() /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../tools/clang/lib/Frontend/FrontendAction.cpp:441:7
#29 0x184bebb clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../tools/clang/lib/Frontend/CompilerInstance.cpp:803:7
#30 0x19df998 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../tools/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:222:8
#31 0x9460f7 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../tools/clang/tools/driver/cc1_main.cpp:110:3
#32 0x93ba43 ExecuteCC1Tool(llvm::ArrayRef<char const*>, llvm::StringRef) /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../tools/clang/tools/driver/driver.cpp:369:5
#33 0x93aa17 main /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/../tools/clang/tools/driver/driver.cpp:415:5
#34 0x7f233a02cec5 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec5)
#35 0x93a4c4 _start (/mnt/ssd/f/souper-regehr/third_party/llvm/Debug/bin/clang-3.7+0x93a4c4)
Stack dump:
0.  Program arguments: /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/bin/clang-3.7 -cc1 -triple x86_64-unknown-linux-gnu -emit-obj -disable-free -main-file-name small.c -mrelocation-model static -mthread-model posix -fmath-errno -masm-verbose -mconstructor-aliases -munwind-tables -fuse-init-array -target-cpu x86-64 -momit-leaf-frame-pointer -dwarf-column-info -coverage-file /home/regehr/tmp/build_base_gcc43-64bit.0000/small.c -resource-dir /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/bin/../lib/clang/3.7.0 -internal-isystem /usr/local/include -internal-isystem /mnt/ssd/f/souper-regehr/third_party/llvm/Debug/bin/../lib/clang/3.7.0/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -w -fdebug-compilation-dir /home/regehr/tmp/build_base_gcc43-64bit.0000 -ferror-limit 19 -fmessage-length 100 -mstackrealign -fobjc-runtime=gcc -fdiagnostics-show-option -fcolor-diagnostics -vectorize-loops -vectorize-slp -load /home/regehr/f/souper-regehr/build/libsouperPass.so -mllvm -z3-path=/usr/bin/z3 -mllvm -souper-exploit-ub=false -mllvm -souper-dynamic-profile -o small.o -x c small.c 
1.  <eof> parser at end of file
2.  Per-module optimization passes
3.  Running pass 'CallGraph Pass Manager' on module 'small.c'.
4.  Running pass 'Combine redundant instructions' on function '@x5'
clang-3.7: error: unable to execute command: Aborted
clang-3.7: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 3.7.0 (trunk 228761)
Target: x86_64-unknown-linux-gnu
Thread model: posix
clang-3.7: note: diagnostic msg: PLEASE submit a bug report to http://llvm.org/bugs/ and include the crash backtrace, preprocessed source, and associated run script.
clang-3.7: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-3.7: note: diagnostic msg: /tmp/small-3cf596.c
clang-3.7: note: diagnostic msg: /tmp/small-3cf596.sh
clang-3.7: note: diagnostic msg: 

********************
$