[llvm-bugs] [Bug 33172] New: DAGCombiner crashes with asan build after r303560

via llvm-bugs llvm-bugs at lists.llvm.org
Thu May 25 10:14:06 PDT 2017 

https://bugs.llvm.org/show_bug.cgi?id=33172

            Bug ID: 33172
           Summary: DAGCombiner crashes with asan build after r303560
           Product: libraries
           Version: trunk
          Hardware: PC
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: Common Code Generator Code
          Assignee: unassignedbugs at nondot.org
          Reporter: thegameg1 at yahoo.com
                CC: llvm-bugs at lists.llvm.org

Created attachment 18511
  --> https://bugs.llvm.org/attachment.cgi?id=18511&action=edit
Reduced with bugpoint.

r303560 introduced a bug in asan builds. I reduced it to dag-combiner-crash.ll
(attached).

$ llc dag-combiner-crash.ll

=================================================================
==65971==ERROR: AddressSanitizer: use-after-poison on address 0x621000002f80 at
pc 0x00010ba2aebb bp 0x7fff568addb0 sp 0x7fff568adda8
READ of size 8 at 0x621000002f80 thread T0
    #0 0x10ba2aeba in (anonymous
namespace)::DAGCombiner::visitSTORE(llvm::SDNode*) SelectionDAGNodes.h:1147
    #1 0x10b982ca9 in (anonymous namespace)::DAGCombiner::visit(llvm::SDNode*)
DAGCombiner.cpp:1495
    #2 0x10b971fad in (anonymous
namespace)::DAGCombiner::combine(llvm::SDNode*) DAGCombiner.cpp:1515
    #3 0x10b96e6ac in llvm::SelectionDAG::Combine(llvm::CombineLevel,
llvm::AAResults*, llvm::CodeGenOpt::Level) DAGCombiner.cpp:1364
    #4 0x10befd6f8 in llvm::SelectionDAGISel::CodeGenAndEmitDAG()
SelectionDAGISel.cpp:729
    #5 0x10bef7b78 in
llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&)
SelectionDAGISel.cpp:1558
    #6 0x10beefc53 in
llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&)
SelectionDAGISel.cpp:456
    #7 0x10a953f4d in llvm::MachineFunctionPass::runOnFunction(llvm::Function&)
MachineFunctionPass.cpp:62
    #8 0x10b1291e5 in llvm::FPPassManager::runOnFunction(llvm::Function&)
LegacyPassManager.cpp:1519
    #9 0x10b1297a1 in llvm::FPPassManager::runOnModule(llvm::Module&)
LegacyPassManager.cpp:1540
    #10 0x10b12a3dc in llvm::legacy::PassManagerImpl::run(llvm::Module&)
LegacyPassManager.cpp:1596
    #11 0x10934d617 in compileModule(char**, llvm::LLVMContext&) llc.cpp:583
    #12 0x1093467bb in main llc.cpp:338
    #13 0x7fffb8750254 in start (libdyld.dylib:x86_64+0x5254)

0x621000002f80 is located 1664 bytes inside of 4096-byte region
[0x621000002900,0x621000003900)
allocated by thread T0 here:
    #0 0x11034c18c in wrap_malloc
(libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x5618c)
    #1 0x109a4cf8d in llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096ul,
4096ul>::Allocate(unsigned long, unsigned long) Allocator.h:97
    #2 0x10be523de in llvm::GlobalAddressSDNode*
llvm::SelectionDAG::newSDNode<llvm::GlobalAddressSDNode, unsigned int&,
unsigned int, llvm::DebugLoc const&, llvm::GlobalValue const*&, llvm::EVT&,
long long&, unsigned char&>(unsigned int&&&, unsigned int&&, llvm::DebugLoc
const&&&, llvm::GlobalValue const*&&&, llvm::EVT&&&, long long&&&, unsigned
char&&&) Recycler.h:90
    #3 0x10be51f8c in llvm::SelectionDAG::getGlobalAddress(llvm::GlobalValue
const*, llvm::SDLoc const&, llvm::EVT, long long, bool, unsigned char)
SelectionDAG.cpp:1251
    #4 0x10bd7c9c7 in llvm::SelectionDAGBuilder::getValueImpl(llvm::Value
const*) SelectionDAGBuilder.cpp:1027
    #5 0x10bd7bd50 in llvm::SelectionDAGBuilder::getValue(llvm::Value const*)
SelectionDAGBuilder.cpp:980
    #6 0x10bd5ebef in llvm::SelectionDAGBuilder::visitGetElementPtr(llvm::User
const&) SelectionDAGBuilder.cpp:3225
    #7 0x10bd7d204 in llvm::SelectionDAGBuilder::getValueImpl(llvm::Value
const*) SelectionDAGBuilder.cpp:1042
    #8 0x10bd7bd50 in llvm::SelectionDAGBuilder::getValue(llvm::Value const*)
SelectionDAGBuilder.cpp:980
    #9 0x10bd67852 in llvm::SelectionDAGBuilder::visitBitCast(llvm::User
const&) SelectionDAGBuilder.cpp:2891
    #10 0x10bd7d204 in llvm::SelectionDAGBuilder::getValueImpl(llvm::Value
const*) SelectionDAGBuilder.cpp:1042
    #11 0x10bd7bd50 in llvm::SelectionDAGBuilder::getValue(llvm::Value const*)
SelectionDAGBuilder.cpp:980
    #12 0x10bd5b68b in llvm::SelectionDAGBuilder::visitLoad(llvm::LoadInst
const&) SelectionDAGBuilder.cpp:3400
    #13 0x10bd4b985 in llvm::SelectionDAGBuilder::visit(llvm::Instruction
const&) SelectionDAGBuilder.cpp:896
    #14 0x10befc226 in
llvm::SelectionDAGISel::SelectBasicBlock(llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::Instruction,
true, false, void>, false, true>,
llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::Instruction, true,
false, void>, false, true>, bool&) SelectionDAGISel.cpp:641
    #15 0x10bef7b78 in
llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&)
SelectionDAGISel.cpp:1558
    #16 0x10beefc53 in
llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&)
SelectionDAGISel.cpp:456
    #17 0x10a953f4d in
llvm::MachineFunctionPass::runOnFunction(llvm::Function&)
MachineFunctionPass.cpp:62
    #18 0x10b1291e5 in llvm::FPPassManager::runOnFunction(llvm::Function&)
LegacyPassManager.cpp:1519
    #19 0x10b1297a1 in llvm::FPPassManager::runOnModule(llvm::Module&)
LegacyPassManager.cpp:1540
    #20 0x10b12a3dc in llvm::legacy::PassManagerImpl::run(llvm::Module&)
LegacyPassManager.cpp:1596
    #21 0x10934d617 in compileModule(char**, llvm::LLVMContext&) llc.cpp:583
    #22 0x1093467bb in main llc.cpp:338
    #23 0x7fffb8750254 in start (libdyld.dylib:x86_64+0x5254)

SUMMARY: AddressSanitizer: use-after-poison SelectionDAGNodes.h:1147 in
(anonymous namespace)::DAGCombiner::visitSTORE(llvm::SDNode*)
Shadow bytes around the buggy address:
  0x1c42000005a0: 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00
  0x1c42000005b0: 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 00
  0x1c42000005c0: 00 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00
  0x1c42000005d0: 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00
  0x1c42000005e0: 00 00 00 f7 f7 f7 f7 02 f7 f7 f7 f7 f7 f7 f7 f7
=>0x1c42000005f0:[f7]f7 00 00 00 00 00 00 00 00 00 00 00 00 00 f7
  0x1c4200000600: 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 f7 f7
  0x1c4200000610: f7 02 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 00 00
  0x1c4200000620: 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 00
  0x1c4200000630: 00 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00
  0x1c4200000640: 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==65971==ABORTING
Stack dump:
0.      Program arguments: ./build/bin/llc dag-combiner-crash.ll
1.      Running pass 'Function Pass Manager' on module 'dag-combiner-crash.ll'.
2.      Running pass 'AArch64 Instruction Selection' on function '@main'
[2]    65971 abort      ./build/bin/llc dag-combiner-crash.ll

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20170525/999eb564/attachment.html>

More information about the llvm-bugs mailing list