clang-17 crashes in lld_main

[ldc31415]

Here is the backtrace. The project specific info was removed. What do I miss here? Thanks for your help.

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0. Program arguments: /usr/lib/llvm-17/bin/ld.lld -z relro --hash-style=gnu --build-id --eh-frame-hdr -m elf_x86_64 -dynamic-linker /lib64/ld-linux-x86-64.so.2 -o <my_project> /lib/x86_64-linux-gnu/crt1.o /lib/x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/13/crtbegin.o -L/usr/lib/gcc/x86_64-linux-gnu/13 -L/usr/lib/gcc/x86_64-linux-gnu/13/../../../../lib64 -L/lib/x86_64-linux-gnu -L/lib/../lib64 -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib64 -L/usr/lib/llvm-17/bin/../lib -L/lib -L/usr/lib -plugin-opt=mcpu=x86-64 -plugin-opt=O0 --whole-archive /usr/lib/llvm-17/lib/clang/17/lib/linux/libclang_rt.asan_static-x86_64.a --no-whole-archive --whole-archive /usr/lib/llvm-17/lib/clang/17/lib/linux/libclang_rt.asan-x86_64.a --no-whole-archive --dynamic-list=/usr/lib/llvm-17/lib/clang/17/lib/linux/libclang_rt.asan-x86_64.a.syms --load-pass-plugin=/path/to/AFLplusplus/SanitizerCoverageLTO.so --allow-multiple-definition --build-id=none lib/gnulib/libgnu.a /path/to/AFLplusplus/afl-compiler-rt.o /path/to/AFLplusplus/afl-llvm-rt-lto.o --dynamic-list=/path/to/AFLplusplus/dynamic_list.txt --no-as-needed -lpthread -lrt -lm -ldl -lresolv -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/x86_64-linux-gnu/13/crtend.o /lib/x86_64-linux-gnu/crtn.o
#0 0x00007f76c16d80ea llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xcd80ea)
#1 0x00007f76c16d6324 llvm::sys::RunSignalHandlers() (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xcd6324)
#2 0x00007f76c16d877b (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xcd877b)
#3 0x00007f76c0242910 (/lib/x86_64-linux-gnu/libc.so.6+0x42910)
#4 0x00007f76c172bbab llvm::BasicBlock::getFirstInsertionPt() const (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xd2bbab)
#5 0x00007f76bdb0312d llvm::ilist_detail::node_options<llvm::Instruction, false, false, void>::pointer llvm::ilist_detail::NodeAccess::getValuePtr<llvm::ilist_detail::node_options<llvm::Instruction, false, false, void>>(llvm::ilist_node_impl<llvm::ilist_detail::node_options<llvm::Instruction, false, false, void>>) /usr/lib/llvm-17/include/llvm/ADT/ilist_node.h:179:12
#6 0x00007f76bdb0312d llvm::ilist_detail::SpecificNodeAccess<llvm::ilist_detail::node_options<llvm::Instruction, false, false, void>>::getValuePtr(llvm::ilist_node_impl<llvm::ilist_detail::node_options<llvm::Instruction, false, false, void>>) /usr/lib/llvm-17/include/llvm/ADT/ilist_node.h:226:12
#7 0x00007f76bdb0312d llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::Instruction, false, false, void>, false, false>::operator*() const /usr/lib/llvm-17/include/llvm/ADT/ilist_iterator.h:139:13
#8 0x00007f76bdb0312d (anonymous namespace)::ModuleSanitizerCoverageLTO::instrumentModule(llvm::Module&, llvm::function_ref<llvm::DominatorTree const* (llvm::Function&)>, llvm::function_ref<llvm::PostDominatorTree const* (llvm::Function&)>) /path/to/AFLplusplus/instrumentation/SanitizerCoverageLTO.so.cc:1044:32
#9 0x00007f76bdafc1cb (anonymous namespace)::ModuleSanitizerCoverageLTO::run(llvm::Module&, llvm::AnalysisManagerllvm::Module&) /path/to/AFLplusplus/instrumentation/SanitizerCoverageLTO.so.cc:366:7
#10 0x00007f76bdafc1cb llvm::detail::PassModel<llvm::Module, (anonymous namespace)::ModuleSanitizerCoverageLTO, llvm::PreservedAnalyses, llvm::AnalysisManagerllvm::Module>::run(llvm::Module&, llvm::AnalysisManagerllvm::Module&) /usr/lib/llvm-17/include/llvm/IR/PassManagerInternal.h:89:17
#11 0x00007f76c1851644 llvm::PassManager<llvm::Module, llvm::AnalysisManagerllvm::Module>::run(llvm::Module&, llvm::AnalysisManagerllvm::Module&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xe51644)
#12 0x00007f76c2c78c01 llvm::lto::opt(llvm::lto::Config const&, llvm::TargetMachine*, unsigned int, llvm::Module&, bool, llvm::ModuleSummaryIndex*, llvm::ModuleSummaryIndex const*, std::vector<unsigned char, std::allocator> const&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0x2278c01)
#13 0x00007f76c2c791eb llvm::lto::backend(llvm::lto::Config const&, std::function<llvm::Expected<std::unique_ptr<llvm::CachedFileStream, std::default_deletellvm::CachedFileStream>> (unsigned int, llvm::Twine const&)>, unsigned int, llvm::Module&, llvm::ModuleSummaryIndex&) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0x22791eb)
#14 0x00007f76c2c6ddd5 llvm::lto::LTO::runRegularLTO(std::function<llvm::Expected<std::unique_ptr<llvm::CachedFileStream, std::default_deletellvm::CachedFileStream>> (unsigned int, llvm::Twine const&)>) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0x226ddd5)
#15 0x00007f76c2c6d629 llvm::lto::LTO::run(std::function<llvm::Expected<std::unique_ptr<llvm::CachedFileStream, std::default_deletellvm::CachedFileStream>> (unsigned int, llvm::Twine const&)>, std::function<llvm::Expected<std::function<llvm::Expected<std::unique_ptr<llvm::CachedFileStream, std::default_deletellvm::CachedFileStream>> (unsigned int, llvm::Twine const&)>> (unsigned int, llvm::StringRef, llvm::Twine const&)>) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0x226d629)
#16 0x00005596cec14a01 lld::elf::BitcodeCompiler::compile() (/usr/lib/llvm-17/bin/ld.lld+0x20ca01)
#17 0x00005596ceb9d186 void lld::elf::LinkerDriver::compileBitcodeFiles<llvm::object::ELFType<(llvm::support::endianness)1, true>>(bool) (/usr/lib/llvm-17/bin/ld.lld+0x195186)
#18 0x00005596ceb997e3 lld::elf::LinkerDriver::link(llvm::opt::InputArgList&) (/usr/lib/llvm-17/bin/ld.lld+0x1917e3)
#19 0x00005596ceb8f8e2 lld::elf::LinkerDriver::linkerMain(llvm::ArrayRef<char const*>) (/usr/lib/llvm-17/bin/ld.lld+0x1878e2)
#20 0x00005596ceb8e559 lld::elf::link(llvm::ArrayRef<char const*>, llvm::raw_ostream&, llvm::raw_ostream&, bool, bool) (/usr/lib/llvm-17/bin/ld.lld+0x186559)
#21 0x00005596ceae273b lld::unsafeLldMain(llvm::ArrayRef<char const*>, llvm::raw_ostream&, llvm::raw_ostream&, llvm::ArrayReflld::DriverDef, bool) (/usr/lib/llvm-17/bin/ld.lld+0xda73b)
#22 0x00005596ceae1817 lld_main(int, char**, llvm::ToolContext const&) (/usr/lib/llvm-17/bin/ld.lld+0xd9817)
#23 0x00005596ceae1d96 main (/usr/lib/llvm-17/bin/ld.lld+0xd9d96)
#24 0x00007f76c02280d0 (/lib/x86_64-linux-gnu/libc.so.6+0x280d0)
#25 0x00007f76c0228189 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x28189)
#26 0x00005596ceae1415 _start (/usr/lib/llvm-17/bin/ld.lld+0xd9415)
clang: error: unable to execute command: Segmentation fault
clang: error: linker command failed due to signal (use -v to see invocation)

[dtcxzyw]

Could you please provide some scripts to reproduce this issue?

[ldc31415]

Thank you for the reply.
I built AFL++ tools using llvm-17. When I used one of the AFL++ tool (e.g: afl-clang-lto) to build my project, I hit the crash.
I built AFL++ tool as following:
sudo ./llvm.sh 17
cd ~/AFLplusplus
export LLVM_CONFIG=llvm-config-17
make; sudo make install

then, I built my project:
./configure CC=clang; make CC=afl-clang-lto

https://github.com/AFLplusplus/AFLplusplus/blob/stable/instrumentation/README.lto.md

[dtcxzyw]

0x00007f76bdb0312d (anonymous namespace)::ModuleSanitizerCoverageLTO::instrumentModule(llvm::Module&, llvm::function_ref<llvm::DominatorTree const* (llvm::Function&)>, llvm::function_ref<llvm::PostDominatorTree const* (llvm::Function&)>) /path/to/AFLplusplus/instrumentation/SanitizerCoverageLTO.so.cc:1044:32

Looks like it is the problem of AFL++.
Could you please insert bb->getParent()->print(llvm::errs()); before this line?
https://github.com/AFLplusplus/AFLplusplus/blob/358cd1b062e58ce1d5c8efeef4789a5aca7ac5a9/instrumentation/SanitizerCoverageLTO.so.cc#L1043-L1044

Then recompile AFL++ and rebuild your application with afl-clang-lto.
I would like to see the LLVM IR of this function.

[ldc31415]

I inserted this linebb->getParent()->print(llvm::errs()); as suggested, and rebuilt AFL++ and
my app with afl-clang-lto. I still got the same crash.
I was not able to build the LLVM IR. I tried to add "-S -emit-llvm" and some other changes to the build system, but, the build still failed. It is a large app with a complex build system and I may miss something. What else should I try? Thanks.

[dtcxzyw]

I still got the same crash. I was not able to build the LLVM IR.

Didn't it print anything before the crash?

Looks like AFL++ is still in active development. You can file an issue at https://github.com/AFLplusplus/AFLplusplus.

[ldc31415]

The following was printed before the backtrace. I am not sure if it is relevant.
afl-llvm-lto++4.10a by Marc "vanHauser" Heuse mh@mh-sec.de
; Function Attrs: noinline nounwind optnone uwtable
define internal void @__afl_auto_init_globals() #0 !dbg !26 { %1 = call ptr @getenv(ptr noundef @.str) #3, !dbg !29
%2 = icmp ne ptr %1, null, !dbg !29
br i1 %2, label %3, label %6, !dbg !31

3: ; preds = %0
%4 = load ptr, ptr @stderr, align 8, !dbg !32
%5 = call i32 (ptr, ptr, ...) @fprintf(ptr noundef %4, ptr noundef @.str.1), !dbg !33
br label %6, !dbg !33

6: ; preds = %3, %0
ret void, !dbg !34
}
[!] WARNING: No instrumentation targets found.
#0 0x00007fa7c20d80ea llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm-17/bin/../lib/libLLVM-17.so.1+0xcd80ea)