<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - DAGCombiner crashes with asan build after r303560"
href="https://bugs.llvm.org/show_bug.cgi?id=33172">33172</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>DAGCombiner crashes with asan build after r303560
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Common Code Generator Code
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>thegameg1@yahoo.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=18511" name="attach_18511" title="Reduced with bugpoint.">attachment 18511</a> <a href="attachment.cgi?id=18511&action=edit" title="Reduced with bugpoint.">[details]</a></span>
Reduced with bugpoint.
r303560 introduced a bug in asan builds. I reduced it to dag-combiner-crash.ll
(attached).
$ llc dag-combiner-crash.ll
=================================================================
==65971==ERROR: AddressSanitizer: use-after-poison on address 0x621000002f80 at
pc 0x00010ba2aebb bp 0x7fff568addb0 sp 0x7fff568adda8
READ of size 8 at 0x621000002f80 thread T0
#0 0x10ba2aeba in (anonymous
namespace)::DAGCombiner::visitSTORE(llvm::SDNode*) SelectionDAGNodes.h:1147
#1 0x10b982ca9 in (anonymous namespace)::DAGCombiner::visit(llvm::SDNode*)
DAGCombiner.cpp:1495
#2 0x10b971fad in (anonymous
namespace)::DAGCombiner::combine(llvm::SDNode*) DAGCombiner.cpp:1515
#3 0x10b96e6ac in llvm::SelectionDAG::Combine(llvm::CombineLevel,
llvm::AAResults*, llvm::CodeGenOpt::Level) DAGCombiner.cpp:1364
#4 0x10befd6f8 in llvm::SelectionDAGISel::CodeGenAndEmitDAG()
SelectionDAGISel.cpp:729
#5 0x10bef7b78 in
llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&)
SelectionDAGISel.cpp:1558
#6 0x10beefc53 in
llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&)
SelectionDAGISel.cpp:456
#7 0x10a953f4d in llvm::MachineFunctionPass::runOnFunction(llvm::Function&)
MachineFunctionPass.cpp:62
#8 0x10b1291e5 in llvm::FPPassManager::runOnFunction(llvm::Function&)
LegacyPassManager.cpp:1519
#9 0x10b1297a1 in llvm::FPPassManager::runOnModule(llvm::Module&)
LegacyPassManager.cpp:1540
#10 0x10b12a3dc in llvm::legacy::PassManagerImpl::run(llvm::Module&)
LegacyPassManager.cpp:1596
#11 0x10934d617 in compileModule(char**, llvm::LLVMContext&) llc.cpp:583
#12 0x1093467bb in main llc.cpp:338
#13 0x7fffb8750254 in start (libdyld.dylib:x86_64+0x5254)
0x621000002f80 is located 1664 bytes inside of 4096-byte region
[0x621000002900,0x621000003900)
allocated by thread T0 here:
#0 0x11034c18c in wrap_malloc
(libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x5618c)
#1 0x109a4cf8d in llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096ul,
4096ul>::Allocate(unsigned long, unsigned long) Allocator.h:97
#2 0x10be523de in llvm::GlobalAddressSDNode*
llvm::SelectionDAG::newSDNode<llvm::GlobalAddressSDNode, unsigned int&,
unsigned int, llvm::DebugLoc const&, llvm::GlobalValue const*&, llvm::EVT&,
long long&, unsigned char&>(unsigned int&&&, unsigned int&&, llvm::DebugLoc
const&&&, llvm::GlobalValue const*&&&, llvm::EVT&&&, long long&&&, unsigned
char&&&) Recycler.h:90
#3 0x10be51f8c in llvm::SelectionDAG::getGlobalAddress(llvm::GlobalValue
const*, llvm::SDLoc const&, llvm::EVT, long long, bool, unsigned char)
SelectionDAG.cpp:1251
#4 0x10bd7c9c7 in llvm::SelectionDAGBuilder::getValueImpl(llvm::Value
const*) SelectionDAGBuilder.cpp:1027
#5 0x10bd7bd50 in llvm::SelectionDAGBuilder::getValue(llvm::Value const*)
SelectionDAGBuilder.cpp:980
#6 0x10bd5ebef in llvm::SelectionDAGBuilder::visitGetElementPtr(llvm::User
const&) SelectionDAGBuilder.cpp:3225
#7 0x10bd7d204 in llvm::SelectionDAGBuilder::getValueImpl(llvm::Value
const*) SelectionDAGBuilder.cpp:1042
#8 0x10bd7bd50 in llvm::SelectionDAGBuilder::getValue(llvm::Value const*)
SelectionDAGBuilder.cpp:980
#9 0x10bd67852 in llvm::SelectionDAGBuilder::visitBitCast(llvm::User
const&) SelectionDAGBuilder.cpp:2891
#10 0x10bd7d204 in llvm::SelectionDAGBuilder::getValueImpl(llvm::Value
const*) SelectionDAGBuilder.cpp:1042
#11 0x10bd7bd50 in llvm::SelectionDAGBuilder::getValue(llvm::Value const*)
SelectionDAGBuilder.cpp:980
#12 0x10bd5b68b in llvm::SelectionDAGBuilder::visitLoad(llvm::LoadInst
const&) SelectionDAGBuilder.cpp:3400
#13 0x10bd4b985 in llvm::SelectionDAGBuilder::visit(llvm::Instruction
const&) SelectionDAGBuilder.cpp:896
#14 0x10befc226 in
llvm::SelectionDAGISel::SelectBasicBlock(llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::Instruction,
true, false, void>, false, true>,
llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::Instruction, true,
false, void>, false, true>, bool&) SelectionDAGISel.cpp:641
#15 0x10bef7b78 in
llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&)
SelectionDAGISel.cpp:1558
#16 0x10beefc53 in
llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&)
SelectionDAGISel.cpp:456
#17 0x10a953f4d in
llvm::MachineFunctionPass::runOnFunction(llvm::Function&)
MachineFunctionPass.cpp:62
#18 0x10b1291e5 in llvm::FPPassManager::runOnFunction(llvm::Function&)
LegacyPassManager.cpp:1519
#19 0x10b1297a1 in llvm::FPPassManager::runOnModule(llvm::Module&)
LegacyPassManager.cpp:1540
#20 0x10b12a3dc in llvm::legacy::PassManagerImpl::run(llvm::Module&)
LegacyPassManager.cpp:1596
#21 0x10934d617 in compileModule(char**, llvm::LLVMContext&) llc.cpp:583
#22 0x1093467bb in main llc.cpp:338
#23 0x7fffb8750254 in start (libdyld.dylib:x86_64+0x5254)
SUMMARY: AddressSanitizer: use-after-poison SelectionDAGNodes.h:1147 in
(anonymous namespace)::DAGCombiner::visitSTORE(llvm::SDNode*)
Shadow bytes around the buggy address:
0x1c42000005a0: 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00
0x1c42000005b0: 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 00
0x1c42000005c0: 00 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00
0x1c42000005d0: 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00
0x1c42000005e0: 00 00 00 f7 f7 f7 f7 02 f7 f7 f7 f7 f7 f7 f7 f7
=>0x1c42000005f0:[f7]f7 00 00 00 00 00 00 00 00 00 00 00 00 00 f7
0x1c4200000600: 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 f7 f7
0x1c4200000610: f7 02 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 00 00
0x1c4200000620: 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 00
0x1c4200000630: 00 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00
0x1c4200000640: 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==65971==ABORTING
Stack dump:
0. Program arguments: ./build/bin/llc dag-combiner-crash.ll
1. Running pass 'Function Pass Manager' on module 'dag-combiner-crash.ll'.
2. Running pass 'AArch64 Instruction Selection' on function '@main'
[2] 65971 abort ./build/bin/llc dag-combiner-crash.ll</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>