<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Segmentation fault: loop-unroller and instcombiner cause stack overflow during isel"
href="https://bugs.llvm.org/show_bug.cgi?id=52076">52076</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Segmentation fault: loop-unroller and instcombiner cause stack overflow during isel
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Common Code Generator Code
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>paulsson@linux.vnet.ibm.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>This simple (reduced) program causes clang to crash:
int a, d;
long b, e;
short c;
int f[2];
void g() {
e = 0;
for (; e >= -23; e--) {
int *h = &d;
c = 24;
for (; c; --c) {
int *i = &f[1];
b = 0;
for (; b != 17; b++)
a ^= h == i;
}
}
}
int main() {}
, when compiled with these options:
clang -O3 -march=arch13 crash0_aftercreduce.c -o a.out -mllvm
-unroll-allow-remainder=false -mllvm -unroll-count=2
I see that the loop-unroller passes now create a huge amount of identical xor
instructions:
%xor.1 = xor i32 %xor, zext (i1 icmp eq (i32* getelementptr inbounds ([2 x
i32], [2 x i32]* @f, i64 0, i64 1), i32* @d) to i32)
%xor.2 = xor i32 %xor.1, zext (i1 icmp eq (i32* getelementptr inbounds ([2 x
i32], [2 x i32]* @f, i64 0, i64 1), i32* @d) to i32)
%xor.3 = xor i32 %xor.2, zext (i1 icmp eq (i32* getelementptr inbounds ([2 x
i32], [2 x i32]* @f, i64 0, i64 1), i32* @d) to i32)
...
After GVN, these now lie in the same BB, also meaning the same DAG later on...
It looks like there are now about ~10k of them! These are all the same, and it
seems to me they could be eliminated more or less down to just 1 or 2, since
they seem to "toggle" the icmp result over and over...
InstCombine however does not remove any of them (maybe it really can't, not
sure), but instead inlines them all into one instruction like (i32 xor (i32 xor
(i32 xor...
SelectionDAGBuilder then crashes during DAG construction. If InstCombine relies
on DAGCombiner to optimize the xor sequence, it shouldn't have as the DAG can't
even be built with this amount of them...</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>