<html>
<head>
<base href="https://llvm.org/bugs/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - Crash when using metadata, label or token type for function parameter"
href="https://llvm.org/bugs/show_bug.cgi?id=31279">31279</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Crash when using metadata, label or token type for function parameter
</td>
</tr>
<tr>
<th>Product</th>
<td>tools
</td>
</tr>
<tr>
<th>Version</th>
<td>3.9
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>lli
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>mewbaz@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=17714" name="attach_17714" title="Crash dump of a.ll and b.ll running lli through GDB.">attachment 17714</a> <a href="attachment.cgi?id=17714&action=edit" title="Crash dump of a.ll and b.ll running lli through GDB.">[details]</a></span>
Crash dump of a.ll and b.ll running lli through GDB.
The following four LLVM IR programs causes lli to crash with a SIGSEGV.
See attached crash dumps with GDB output.
Note, it is possible to control the value of rax based on the length of the
register name in a.ll.
The three remaining crashes in b.ll, c.ll and d.ll are all based on NULL
pointer dereferences.
Contents of a.ll:
```
define i32 @main() {
call i32 @llvm.read_register.i32(metadata !"esi")
ret i32 42
}
declare i32 @llvm.read_register.i32(metadata)
```
Contents of b.ll:
```
define i32 @main() {
ret i32 42
}
define i32 @foo(metadata %x) {
ret i32 32
}
```
Contents of c.ll:
```
define i32 @main() {
ret i32 42
}
define i32 @foo(label %x) {
ret i32 32
}
```
Contents of d.ll:
```
define i32 @main() {
ret i32 42
}
define i32 @foo(token %x) {
ret i32 32
}
```</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>