<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - MemorySSA crashes when using ADCE preserved dominators. Assertion `dominates(MP, U) && "Memory PHI does not dominate it's uses"' failed."
href="https://bugs.llvm.org/show_bug.cgi?id=34345">34345</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>MemorySSA crashes when using ADCE preserved dominators. Assertion `dominates(MP, U) && "Memory PHI does not dominate it's uses"' failed.
</td>
</tr>
<tr>
<th>Product</th>
<td>new-bugs
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>new bugs
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>david.stenberg@ericsson.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=19052" name="attach_19052" title="Reduced reproducer.">attachment 19052</a> <a href="attachment.cgi?id=19052&action=edit" title="Reduced reproducer.">[details]</a></span>
Reduced reproducer.
When running the following command-line using a debug-built opt from trunk
(r311862):
opt -loops -adce -early-cse-memssa -o /dev/null
bugpoint-reduced-simplified.ll
opt crashes with the following failed assertion:
opt: ../lib/Analysis/MemorySSA.cpp:1707: void
llvm::MemorySSA::verifyDomination(llvm::Function &) const: Assertion
`dominates(MP, U) && "Memory PHI does not dominate it's uses"' failed.
#0 0x00007ffff6d7a875 in raise () from /lib64/libc.so.6
#1 0x00007ffff6d7be51 in abort () from /lib64/libc.so.6
#2 0x00007ffff6d73740 in __assert_fail () from /lib64/libc.so.6
#3 0x0000000000fef1ce in llvm::MemorySSA::verifyDomination
(this=0x3e50520, F=...) at ../lib/Analysis/MemorySSA.cpp:1707
#4 0x0000000000feee3e in llvm::MemorySSA::verifyMemorySSA (this=0x3e50520)
at ../lib/Analysis/MemorySSA.cpp:1631
#5 0x0000000000ff0904 in llvm::MemorySSAWrapperPass::verifyAnalysis
(this=0x3e4ba60) at ../lib/Analysis/MemorySSA.cpp:1972
#6 0x0000000001822d37 in llvm::PMDataManager::verifyPreservedAnalysis
(this=0x3e4b880, P=0x3e49510) at ../lib/IR/LegacyPassManager.cpp:863
#7 0x0000000001825b87 in llvm::FPPassManager::runOnFunction
(this=0x3e4b860, F=...) at ../lib/IR/LegacyPassManager.cpp:1523
#8 0x0000000001825da5 in llvm::FPPassManager::runOnModule (this=0x3e4b860,
M=...) at ../lib/IR/LegacyPassManager.cpp:1535
#9 0x000000000182658e in (anonymous namespace)::MPPassManager::runOnModule
(this=0x3e49660, M=...) at ../lib/IR/LegacyPassManager.cpp:1591
#10 0x000000000182608b in llvm::legacy::PassManagerImpl::run
(this=0x3e4b370, M=...) at ../lib/IR/LegacyPassManager.cpp:1694
#11 0x0000000001826ad1 in llvm::legacy::PassManager::run
(this=0x7fffffffc460, M=...) at ../lib/IR/LegacyPassManager.cpp:1725
#12 0x00000000009a9115 in main (argc=9, argv=0x7fffffffcbb8) at
../tools/opt/opt.cpp:757
The pass crashes as it asserts that `for.cond32':
for.cond32: ; preds = %for.end73,
%if.then31
br i1 true, label %for.body33, label %for.end74
dominates `if.end79':
if.end79: ; preds = %if.end78,
%for.end74
br label %for.inc
which is a BB with an unreachable predecessor, if.end78:
for.end74: ; preds = %for.cond32
br label %if.end79
if.end78: ; No predecessors!
br label %if.end79
We started seeing the crash with the introduction of "Teach ADCE to preserve
dominators" (r311467 and earlier versions).
With the preserved dominator tree from ADCE, for.cond32 is not considered a
dominator of if.end78, whereas dominatedBySlowTreeWalk() considers it that.
This can be seen with EXPENSIVE_CHECKS enabled:
opt: ../include/llvm/Support/GenericDomTree.h:436: bool
llvm::DominatorTreeBase<llvm::BasicBlock, false>::dominates(const
DomTreeNodeBase<NodeT> *, const DomTreeNodeBase<NodeT> *) const [NodeT =
llvm::BasicBlock, IsPostDom = false]: Assertion `(!DFSInfoValid ||
(dominatedBySlowTreeWalk(A, B) == B->DominatedBy(A))) && "Tree walk disagrees
with dfs numbers!"' failed.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>