<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/55111>55111</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Regression: Commit e5822ded5 "[FunctionAttrs] Infer argmemonly ." causes a crash in WebAssembly linking
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          juj
      </td>
    </tr>
</table>

<pre>
    Observed a new regression crash on LLVM 15 tree when testing Unity WebAssembly compiler target against the latest compiler tree.

Cmdline:

```
wasm-ld.exe -o out.wasm 1.a 2.a --export-if-defined=main --no-entry
```

on inputs 1.a and 2.a from 

https://drive.google.com/file/d/1P9kKZgeINZF2f_vTKac7NEXAOcIJCCcC/view?usp=sharing

Produces crash log:

```
PLEASE submit a bug report to https://bugs.llvm.org/ and include the crash backtrace.
Stack dump:
0.      Program arguments: E:\\code\\emsdk\\llvm\\git\\build_main_vs2019_64\\RelWithDebInfo\\bin\\wasm-ld.exe -o out.wasm 1.a 2.a --export-if-defined=main --no-entry
 #0 0x00007ff71cb3d5a7 ::classof E:\code\emsdk\llvm\git\src\llvm\include\llvm\IR\Instructions.h:3212:0
 #1 0x00007ff71cb3d5a7 ::doit E:\code\emsdk\llvm\git\src\llvm\include\llvm\Support\Casting.h:58:0
 #2 0x00007ff71cb3d5a7 ::doit E:\code\emsdk\llvm\git\src\llvm\include\llvm\Support\Casting.h:105:0
 #3 0x00007ff71cb3d5a7 ::doit E:\code\emsdk\llvm\git\src\llvm\include\llvm\Support\Casting.h:131:0
 #4 0x00007ff71cb3d5a7 ::doit E:\code\emsdk\llvm\git\src\llvm\include\llvm\Support\Casting.h:121:0
 #5 0x00007ff71cb3d5a7 llvm::isa E:\code\emsdk\llvm\git\src\llvm\include\llvm\Support\Casting.h:142:0
 #6 0x00007ff71cb3d5a7 llvm::dyn_cast E:\code\emsdk\llvm\git\src\llvm\include\llvm\Support\Casting.h:345:0
 #7 0x00007ff71cb3d5a7 `anonymous namespace'::MergedLoadStoreMotion::isDiamondHead E:\code\emsdk\llvm\git\src\llvm\lib\Transforms\Scalar\MergedLoadStoreMotion.cpp:139:0
 #8 0x00007ff71cb3dd33 `anonymous namespace'::MergedLoadStoreMotion::run E:\code\emsdk\llvm\git\src\llvm\lib\Transforms\Scalar\MergedLoadStoreMotion.cpp:356:0
 #9 0x00007ff71cb3dded llvm::MergedLoadStoreMotionPass::run(class llvm::Function &, class llvm::AnalysisManager<class llvm::Function> &) E:\code\emsdk\llvm\git\src\llvm\lib\Transforms\Scalar\MergedLoadStoreMotion.cpp:411:0
#10 0x00007ff71c537332 llvm::detail::PassModel<class llvm::Function, class llvm::MergedLoadStoreMotionPass, class llvm::PreservedAnalyses, class llvm::AnalysisManager<class llvm::Function>>::run(class llvm::Function &, class llvm::AnalysisManager<class llvm::Function> &) E:\code\emsdk\llvm\git\src\llvm\include\llvm\IR\PassManagerInternal.h:88:0
#11 0x00007ff71c5363aa llvm::PassManager<class llvm::Function, class llvm::AnalysisManager<class llvm::Function>>::run(class llvm::Function &, class llvm::AnalysisManager<class llvm::Function> &) E:\code\emsdk\llvm\git\src\llvm\include\llvm\IR\PassManager.h:522:0
#12 0x00007ff71c536f12 llvm::detail::PassModel<class llvm::Function, class llvm::PassManager<class llvm::Function, class llvm::AnalysisManager<class llvm::Function>>, class llvm::PreservedAnalyses, class llvm::AnalysisManager<class llvm::Function>>::run(class llvm::Function &, class llvm::AnalysisManager<class llvm::Function> &) E:\code\emsdk\llvm\git\src\llvm\include\llvm\IR\PassManagerInternal.h:88:0
#13 0x00007ff71d5cd2de llvm::ModuleToFunctionPassAdaptor::run(class llvm::Module &, class llvm::AnalysisManager<class llvm::Module> &) E:\code\emsdk\llvm\git\src\llvm\lib\IR\PassManager.cpp:127:0
#14 0x00007ff71c537ec2 llvm::detail::PassModel<class llvm::Module, class llvm::ModuleToFunctionPassAdaptor, class llvm::PreservedAnalyses, class llvm::AnalysisManager<class llvm::Module>>::run(class llvm::Module &, class llvm::AnalysisManager<class llvm::Module> &) E:\code\emsdk\llvm\git\src\llvm\include\llvm\IR\PassManagerInternal.h:88:0
#15 0x00007ff71c07f453 llvm::PassManager<class llvm::Module, class llvm::AnalysisManager<class llvm::Module>>::run(class llvm::Module &, class llvm::AnalysisManager<class llvm::Module> &) E:\code\emsdk\llvm\git\src\llvm\include\llvm\IR\PassManager.h:522:0
#16 0x00007ff71c080651 runNewPMPasses E:\code\emsdk\llvm\git\src\llvm\lib\LTO\LTOBackend.cpp:310:0
#17 0x00007ff71c07edfd ::_Empty C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.28.29333\include\functional:1009:0
#18 0x00007ff71c07edfd ::operator bool C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.28.29333\include\functional:1253:0
#19 0x00007ff71c07edfd llvm::lto::opt(struct llvm::lto::Config const &, class llvm::TargetMachine *, unsigned int, class llvm::Module &, bool, class llvm::ModuleSummaryIndex *, class llvm::ModuleSummaryIndex const *, class std::vector<unsigned char, class std::allocator<unsigned char>> const &) E:\code\emsdk\llvm\git\src\llvm\lib\LTO\LTOBackend.cpp:374:0
#20 0x00007ff71c07b8ac ::_Tidy C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.28.29333\include\vector:1694:0
#21 0x00007ff71c07b8ac ::{dtor} C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.28.29333\include\vector:673:0
#22 0x00007ff71c07b8ac llvm::lto::backend(struct llvm::lto::Config const &, class std::function<(unsigned int)>, unsigned int, class llvm::Module &, class llvm::ModuleSummaryIndex &) E:\code\emsdk\llvm\git\src\llvm\lib\LTO\LTOBackend.cpp:520:0
#23 0x00007ff71c070a60 ::operator bool E:\code\emsdk\llvm\git\src\llvm\include\llvm\Support\Error.h:235:0
#24 0x00007ff71c070a60 llvm::lto::LTO::runRegularLTO(class std::function<(unsigned int)>) E:\code\emsdk\llvm\git\src\llvm\lib\LTO\LTO.cpp:1139:0
#25 0x00007ff71c06ff12 ::operator bool E:\code\emsdk\llvm\git\src\llvm\include\llvm\Support\Error.h:235:0
#26 0x00007ff71c06ff12 llvm::lto::LTO::run(class std::function<(unsigned int)>, class std::function<(unsigned int, class llvm::StringRef)>) E:\code\emsdk\llvm\git\src\llvm\lib\LTO\LTO.cpp:1039:0
#27 0x00007ff71b838f3a lld::wasm::BitcodeCompiler::compile(void) E:\code\emsdk\llvm\git\src\lld\wasm\LTO.cpp:138:0
#28 0x00007ff71b84082e lld::wasm::SymbolTable::compileBitcodeFiles(void) E:\code\emsdk\llvm\git\src\lld\wasm\SymbolTable.cpp:77:0
#29 0x00007ff71b80f16c lld::wasm::`anonymous namespace'::LinkerDriver::linkerMain E:\code\emsdk\llvm\git\src\lld\wasm\Driver.cpp:985:0
#30 0x00007ff71b80ddc8 ::{dtor} C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.28.29333\include\vector:673:0
#31 0x00007ff71b80ddc8 lld::wasm::link(class llvm::ArrayRef<char const *>, class llvm::raw_ostream &, class llvm::raw_ostream &, bool, bool) E:\code\emsdk\llvm\git\src\lld\wasm\Driver.cpp:98:0
#32 0x00007ff71b40ada8 lldMain E:\code\emsdk\llvm\git\src\lld\tools\lld\lld.cpp:164:0
#33 0x00007ff71b40b4a1 main E:\code\emsdk\llvm\git\src\lld\tools\lld\lld.cpp:220:0
#34 0x00007ff71d8bcd3c invoke_main d:\agent\_work\63\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78:0
#35 0x00007ff71d8bcd3c __scrt_common_main_seh d:\agent\_work\63\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288:0
#36 0x00007ffc268d6fd4 (C:\WINDOWS\System32\KERNEL32.DLL+0x16fd4)
#37 0x00007ffc2811cec1 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x4cec1)
```

Bisected this issue to first fail on commit

```
commit e5822ded562fd233ff7468d88da9e2c4f1a96c70
Author: Florian Hahn <flo@fhahn.com>
Date:   Wed Mar 16 10:24:33 2022 +0000

    [FunctionAttrs] Infer argmemonly .

    This patch adds initial argmemonly inference, by checking the underlying
    objects of locations returned by MemoryLocation.

    I think this should cover most cases, except function calls to other
    argmemonly functions.

    I'm not sure if there's a reason why we don't infer those yet.

    Additional argmemonly can improve codegen in some cases. It also makes
    it easier to come up with a C reproducer for 7662d1687b09 (already fixed,
    but I'm trying to see if C/C++ fuzzing could help to uncover similar
    issues.)

    Compile-time impact:
    NewPM-O3: +0.01%
    NewPM-ReleaseThinLTO: +0.03%
    NewPM-ReleaseLTO+g: +0.05%

    https://llvm-compile-time-tracker.com/compare.php?from=067c035012fc061ad6378458774ac2df117283c6&to=fe209d4aab5b593bd62d18c0876732ddcca1614d&stat=instructions

    Reviewed By: nikic

    Differential Revision: https://reviews.llvm.org/D121415

 llvm/lib/Transforms/IPO/FunctionAttrs.cpp          | 97 +++++++++++++++-------
 .../TypeBasedAliasAnalysis/functionattrs.ll        |  6 +-
 llvm/test/CodeGen/AMDGPU/inline-attr.ll            |  6 +-
 llvm/test/Transforms/FunctionAttrs/argmemonly.ll   | 12 +--
 llvm/test/Transforms/FunctionAttrs/atomic.ll       |  2 +-
 llvm/test/Transforms/FunctionAttrs/nofree.ll       |  2 +-
 llvm/test/Transforms/FunctionAttrs/nosync.ll       | 26 +++---
 llvm/test/Transforms/FunctionAttrs/stats.ll        |  3 +-
 8 files changed, 95 insertions(+), 59 deletions(-)
```

Last good commit where the above cmdline does pass is the parent commit of the above, i.e.

```
commit 0aab344104034e6191114a74f0d9eb5129bf550d
Author: Simon Moll <simon.moll@emea.nec.com>
Date:   Wed Mar 16 11:10:11 2022 +0100
```

I don't know if the fail is anything WebAssembly specific (possibly not since the crash is in backend-general code), I just happen to observe this when working against WebAssembly target.

CC @fhahn @dschuff @sbc100 @kripken @aheejin 
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJztWltT47gS_jXhRZWU73YeeAgJ7HIWZihgd87ZF0qW5ESDbaUkG8j--tMt20kczOzAsDN7ak8qBF-k1tfd6oukThXfHH9MjdAPghNKSvFItFhqYYxUJWGamhWBi4uL3y6JG5JKC0EeV6IklTCVLJfk11JWG_JJpDNjRJHmG8JUsZa50KSieikqQpdUlqYi1UqQnGK_vSZAbzJyFiNn1vzOC57LUoz82f7TUeS0X3v7SE0xzvlEPAkyVkTV1QQfEXdCiQd_47F4WitdjWU25iIDenzkLwqAAa9KNRZlpTeDlJtfYFiW67oyliItuaWaaVWQ_WarqlobROqdwZdr-SAmS6WWuZgAg_AoAx7xDfy5V9P7X35fivMPv5952d3D7S-UxR9O_z37yM7_NZ-zObR5kOJx5J_VZg1ozYpqkO_-eFda8ZoJ06olV8svi-nq4nR2c0pMnRYS1EDSegnKRcGQSpE-enhnJnn-UEyUXsK95VqWLK-5sJprxkwpu680ZZ3Sbip4QHhdrLdQnAmxH0C71LQgMAnqAiSOY5FTbBbO4csUF82VKAy_by4RQHO1lFVzkdYy53eou7sH4znu9C4KmjfXIv8kq9VCpOdlptrWsmwu3nGKkJHnO8R5cuATZ1nsstTnIY0J8uLPWE6NUVnHWstXx1TLUcOO0Wz3qBXu7sH5Nf6ApeiaVWB9ZrICkr7nevDP2WFxX8bCFSj6m4Hc1GsUDVzNqTVyCyRM-jC8HwPDdcI-Dv8H4fDdPo7gB-HwDnCEQzgsCYtFGvqXQQkOZmr0ZSh8U94x6P9X4fGDg6kSD6oocmipyk2hakNKWgizBv828uIG5KWAIMYvFOU3ldLiUqFpdqJcSFqokv8sKH81E7lM4fdW09JkShcG2WA0pxouBgedsPXaTrxpn6vkkCsONvF2rnRdfjde_DDq8zJ9xgukJbsZM0jrCvzvFvrIS6xD3ut0VpfWnwL9aOTNyeH7WUnzjZHmkpZ0KfTIn79EYeSfNkSm301Cgbtn3uj8-5Eo9GMfPPGeTYmKyry5RsFcAsD8SywNCORlKQ80voJc0WaPjRjFYKNXidh-_-bqHA7eVuDNsOdlJTQgsY4oSfo6dA90GPmU7ot0R-aVmvvnyblJTTyvL2DvUMCZ-95G8h2V9H-rexer6yWKPGTcg6XNnteDxVUublWHE8nOOF2DC_ySYJpubxdL0_-bI8szu2iTBRvw94QQHIYPwd5iGS3qoeDxBTH-dRN5K8U_mcY_XFvfNoX7uT38C0L_q33Syzr7J8l3OGD0VypO4kShS4DFD-Lx6hJ7C_NGw7y4_dj8nlB2L0reZb6u00cQH6hW8Iy3y8e702Jdbci8Gb_bVzmTOYACHTwlKCnMIyXTyqisIr9JU9Oc3FQ1l7gzgvsmuDhSRVHjfh1c_4a7JLdK5ZiKXt7YWzeYeMnEm_q-3xNl1toyRc_gOs60Dz15GbpaC03B9EkKI_1tOPBCv8_BdIiD3azMK9WxUwHcZodm6P1clZlcEqZwv_MFI7i1u6KXlK1kiZYyw0Z1aeSyFLjlVr3sVTuSKMyXW93URUH15rzk4qmj_xUtO9B77U3Fm-YPgtkwON_iZCuqBxrSPFeMDrW1rmNfMm-NdC8ZVBz0dOo5BzpNE8o6g7qV_EfaUyfOmRtND1C7L6MexSccu8WLvwP0KO7bkOcNIR-wkbRR2xvtaDvTsm06OQdSffuZtlnz66zqq6zp_Sdu6PUjgecfCNKhkTPoTt9x2-xUa9WERs8P-3CCITgDOkP2uszgWizrnGp81OUIr1DcNwu4S357W2XIy0H-FGW4Lvxxoo2G4PyJaN8i0FcZz3NDuKnwJOpaZO-uIOdQQb0sKE38JPNxZ6SFjSc4zdWJrHDseXuO2DxsTxWBowcl-Sth8lFzaNQH6PcTcC_p4wucxBND-G42RaryW5rmooetxW0d9jfj3BukxRv3V3vetA_XydyIDcH9k93iC1neC73AA85W1Ll9conHZW_D3hBrYU-TvmH0j9sAN-cs-Z-Igv3DuQ75gMRRgAPrp5nWdIOWBksjyJr2krLhfSBNH-8UxFEB_L8QxgaadPlj8_-t0-9AhX059LKBNHAop1YOb5kyVauU5g5-O-uM-slT_ygQBk0D6pLiHUf0DmJ1_9CPJynjPgM3-qDuhT2zJrwZGFaeJQ5y96g0jhzhfDLbUR9YNyKzMeOBmYrqql5vW-zuxZO4A29SqHIiS1zOxAeiD4cw3d0ZIN12bI7TjVh9D3jewSbG_qkg86KERxkP0Gxbc_50_mHx8dON9W-mEoXvweUvp9cfTi98b7K4uBh5J86Ti73Qyrdk432yiesywdxhsv-5uT29tGTLiuf5BP4szQC77GgOVYacSAOmD6GyWklDpDG1wFqKTGow04zKHItlkH2YUi8XZjQNiAgTz-OCh5GXceAA9BWAPJKE06nwWJC5dBqxuO00q6uV9TnkLFda0pL8TFcleMV5lqtR4GQruLWFJ-AqbI8FrTD6EEI-AeJLcCduROy-g4eGA-biOZC2I-_w2ceL9Ruj8KTbw5tVlQbtL8h5mQmNFR2FAAXnGzI57HWLclnTiq0I5RxEBN5Vgufd6yORiCiZ3YpKN7A8FOweS4mwzKSGPFvnm23lC9JU6WcQuiEqI3Z1ibURRIuq1pi0AIVLoKw3F-27Z5jOUVvlfaMzs1J1DmtSBb6LFAqLkWi77SiemFiDGrutbgarWYPqVYBM7-jt8dK1Nc8HhehZkFJVxNRaEJkhexpjqiEU0FMDIzyuNuRREI4HBXHVSAbaKSPIRlTPaM44l80uxj4GBlNBFmsNHBF0cGDLQIkYVYiGtwk5rwjNjQJfeA-sbunhHKRG4pgKZy2If00eZQW6I3MsFWoKjjTJIC-Oo8jjbpTEqTNFu6I5MAHL6Ew-CUhi5juyaV217Fd6YxWriBFWBljmBH8n8AXZ_fEHvmVWISuRr7EhCNSqxshC4vHoDiwaG8h5a5_bN20WOK4kcACSoKxCm9--t5t4448Yqe1knzhg5eHh-2uRgzAETOCyybfbtv7Lbe365mS5axtu2-569OusMOSM2R7gMZZT3WMctSVj-IpqMVmvIN6cYcnZyF84UcwcP3RcL4NVgkt55MdJECZxHFDm8cx1Yy_xGcT2CJcMi0x4zpQHlKZhGk79lKPmEuYkMeQrHqQkjLqRG4DWInDcIKyF3Cs7OmTgWmBhGljayQY5LeW9ZIdtFjKzRm1tHTuYpp7ggHttSfUKzRau5wZuX2o2LoOsYNHgne2dmXtn51cg8bOeX8LQTLafUTwn05g0U-wrv-Pm0w4-mUxw1M1anICKOWRq1HQb11jT1-0k2rHzfH9gEuHA4z4XWPCIsx4s8ycBdn42u1z8dPUrXEB8lKUYI6U9Ql9DrCeTvpf2znauoaGKxFzr5sdvoVapQrIdPgvNeyO0UmVY8PlexMymPEDmRWRfra8nivbwTK3-PsKEZHahAfl5ubSej0xDcLhG6MZ8vMSOP8U34ZRw8BXdi_GXs4sLLIZaKsXbFAIrbXVTfklT696b6lgIGAKjrMEUxL5Gn1FWXTeV7fogCjnpF9kOpyMO-As_CFwncPxARO7Udd2AxkHm8KlIQ9ebplkYOvwwHbmRMNnIpQKhQTJi8G5SwB3kJKIQdFIK9hVpiWv3A-yuzS4tcbdpyZC4zreB875Uj22IbbIwEAstNxj2l73aZLMWTGaSYQBbK2MkPrRBGhZ3-4WumN2VpN2rHENIFRo8m10_NJo9J59r0NaKrtdYDQ1JQlNF3WQZtkQak2kE0BVA7wNpaqP7pc9z0qVxeMENW9VZhpcmZSAJvLrXcg2I8JKuhPgMGI_4sc-n_pQeVbLKxfH1tnwbhTw_SDWBce8rMzvQAaM1nnzRTihljwdcwwJ_R7XOj_t-HlZUqzptQ1rnzTHyQUaBuRw6PxvO4SIMYZ4drY4Dj_kOi5w0yVLHd10IdFMMUzSGuRcHyVFOU5GbY0AP0LBQ3ZKw_CyO5DFOGifwIjf0oe8EJOILFgTZlLkhFmvibISpsY09R_rYQsLKZ3iZS1PtAtMR2BbuiQk7HNCndroff64_H9lhjy3s_wK4KmL2">