<html>
    <head>
      <base href="http://llvm.org/bugs/" />
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW --- - bad cast<> in slp vectorizer"
   href="http://llvm.org/bugs/show_bug.cgi?id=19621">19621</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>bad cast<> in slp vectorizer
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>libraries
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>trunk
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>PC
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>Linux
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>NEW
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>normal
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>P
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>Loop Optimizer
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>unassignedbugs@nondot.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>nlewycky@google.com
          </td>
        </tr>

        <tr>
          <th>CC</th>
          <td>llvmbugs@cs.uiuc.edu
          </td>
        </tr>

        <tr>
          <th>Classification</th>
          <td>Unclassified
          </td>
        </tr></table>
      <p>
        <div>
        <pre>Created <span class=""><a href="attachment.cgi?id=12462" name="attach_12462" title="testcase .ll">attachment 12462</a> <a href="attachment.cgi?id=12462&action=edit" title="testcase .ll">[details]</a></span>
testcase .ll

Testcase is 52 lines of IR, attached.

$ opt -slp-vectorizer b.ll

opt: /usr/local/google/home/nlewycky/llvm/include/llvm/Support/Casting.h:237:
typename llvm::cast_retty<X, Y*>::ret_type llvm::cast(Y*) [with X =
llvm::Instruction; Y = llvm::Value; typename llvm::cast_retty<X, Y*>::ret_type
= llvm::Instruction*]: Assertion `isa<X>(Val) && "cast<Ty>() argument of
incompatible type!"' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff6ced425 in __GI_raise (sig=<optimized out>) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
64      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff6ced425 in __GI_raise (sig=<optimized out>) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff6cf0b8b in __GI_abort () at abort.c:91
#2  0x00007ffff6ce60ee in __assert_fail_base (fmt=<optimized out>,
assertion=0x1d07660 "isa<X>(Val) && \"cast<Ty>() argument of incompatible
type!\"", 
    file=0x1d07618
"/usr/local/google/home/nlewycky/llvm/include/llvm/Support/Casting.h",
line=<optimized out>, function=<optimized out>) at assert.c:94
#3  0x00007ffff6ce6192 in __GI___assert_fail (assertion=0x1d07660 "isa<X>(Val)
&& \"cast<Ty>() argument of incompatible type!\"", file=0x1d07618
"/usr/local/google/home/nlewycky/llvm/include/llvm/Support/Casting.h", 
    line=237, 
    function=0x1d07f80 <llvm::cast_retty<llvm::Instruction,
llvm::Value*>::ret_type llvm::cast<llvm::Instruction,
llvm::Value>(llvm::Value*)::__PRETTY_FUNCTION__> "typename llvm::cast_retty<X,
Y*>::ret_type llvm::cast(Y*) [with X = llvm::Instruction; Y = llvm::Value;
typename llvm::cast_retty<X, Y*>::ret_type = llvm::Instruction*]") at
assert.c:103
#4  0x0000000000ab7092 in llvm::cast<llvm::Instruction, llvm::Value>
(Val=0x2ed5480) at
/usr/local/google/home/nlewycky/llvm/include/llvm/Support/Casting.h:237
#5  0x0000000001632d71 in (anonymous
namespace)::SLPVectorizer::tryToVectorizeList (this=0x2ebebb0, VL=..., R=...,
BuildVector=...) at SLPVectorizer.cpp:2204
#6  0x0000000001634ea5 in (anonymous
namespace)::SLPVectorizer::vectorizeChainsInBlock (this=0x2ebebb0,
BB=0x2eb4fb0, R=...) at SLPVectorizer.cpp:2762
#7  0x0000000001631c53 in (anonymous namespace)::SLPVectorizer::runOnFunction
(this=0x2ebebb0, F=...) at SLPVectorizer.cpp:1926
#8  0x0000000001c49958 in llvm::FPPassManager::runOnFunction (this=0x2ec8ed0,
F=...) at LegacyPassManager.cpp:1540
#9  0x0000000001c49ac8 in llvm::FPPassManager::runOnModule (this=0x2ec8ed0,
M=...) at LegacyPassManager.cpp:1560
#10 0x0000000001c49e1c in (anonymous namespace)::MPPassManager::runOnModule
(this=0x2eb3d30, M=...) at LegacyPassManager.cpp:1618
#11 0x0000000001c4a4c6 in llvm::legacy::PassManagerImpl::run (this=0x2eb3a40,
M=...) at LegacyPassManager.cpp:1725
#12 0x0000000001c4a6d1 in llvm::legacy::PassManager::run (this=0x7fffffffe1d0,
M=...) at LegacyPassManager.cpp:1760
#13 0x0000000000adc658 in main (argc=3, argv=0x7fffffffe488) at opt.cpp:631
(gdb) frame 5
#5  0x0000000001632d71 in (anonymous
namespace)::SLPVectorizer::tryToVectorizeList (this=0x2ebebb0, VL=..., R=...,
BuildVector=...) at SLPVectorizer.cpp:2204
2204            Instruction *InsertAfter = cast<Instruction>(VectorizedRoot);
(gdb) p VectorizedRoot
$1 = (llvm::Value *) 0x2ed5480
(gdb) call VectorizedRoot->dump()
<2 x float> undef
(gdb) p VL.size()
$3 = 2

Attempting to call VL[0]->dump() or VL[1]->dump() shows corrupt memory,
consistent with use-after-free.</pre>
        </div>
      </p>
      <hr>
      <span>You are receiving this mail because:</span>
      
      <ul>
          <li>You are on the CC list for the bug.</li>
      </ul>
    </body>
</html>