<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Issue</th>
<td>
<a href=https://github.com/llvm/llvm-project/issues/57406>57406</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>
[AMDGPU] GlobalIsel AMDGPUPreLegalizerCombiner double frees on release build, OOB on debug build.
</td>
</tr>
<tr>
<th>Labels</th>
<td>
new issue
</td>
</tr>
<tr>
<th>Assignees</th>
<td>
</td>
</tr>
<tr>
<th>Reporter</th>
<td>
DataCorrupted
</td>
</tr>
</table>
<pre>
When compiling the following piece of code, AMDGPUPreLegalizerCombiner double frees.
The bug can be reproduced from LLVM14 or latest commit `e723c69b94`
In release build, it shows as a double, in debug build, it is a index OOB. The stack trace seems the same.
You can quick reproduce it here:
- Debug, OOB: https://llvm.godbolt.org/z/fGGfzhh8v
- Release, double free: https://llvm.godbolt.org/z/d41eT6zxd
```
; ModuleID = 'double-free.bc'
source_filename = "M"
define void @f(<16 x float>* %A) {
%L = load <16 x float>, <16 x float>* %A, align 64
%I = insertelement <16 x float> %L, float 0x36A0000000000000, i1 true
store <16 x float> %I, <16 x float>* %A, align 64
ret void
}
```
Release trace:
```
double free or corruption (out)
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0. Program arguments: /home/peter/aflplusplus-isel/llvm-project/build-release/bin/llc -mtriple=amdgcn -global-isel double-free.ll
1. Running pass 'CallGraph Pass Manager' on module 'double-free.ll'.
2. Running pass 'AMDGPUPreLegalizerCombiner' on function '@f'
#0 0x0000000001dc4c43 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/peter/aflplusplus-isel/llvm-project/build-release/bin/llc+0x1dc4c43)
#1 0x0000000001dc2b9e llvm::sys::RunSignalHandlers() (/home/peter/aflplusplus-isel/llvm-project/build-release/bin/llc+0x1dc2b9e)
#2 0x0000000001dc4fcf SignalHandler(int) Signals.cpp:0:0
#3 0x00007f68ed46e980 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x12980)
#4 0x00007f68ec35ee87 raise /build/glibc-uZu3wS/glibc-2.27/signal/../sysdeps/unix/sysv/linux/raise.c:51:0
#5 0x00007f68ec3607f1 abort /build/glibc-uZu3wS/glibc-2.27/stdlib/abort.c:81:0
#6 0x00007f68ec3a9837 __libc_message /build/glibc-uZu3wS/glibc-2.27/libio/../sysdeps/posix/libc_fatal.c:181:0
#7 0x00007f68ec3b08ba /build/glibc-uZu3wS/glibc-2.27/malloc/malloc.c:5342:0
#8 0x00007f68ec3b7e4a _int_free /build/glibc-uZu3wS/glibc-2.27/malloc/malloc.c:4308:0
#9 0x00007f68ec3b7e4a free /build/glibc-uZu3wS/glibc-2.27/malloc/malloc.c:3134:0
#10 0x0000000000df0b7a (anonymous namespace)::AMDGPUGenPreLegalizerCombinerHelper::tryCombineAll(llvm::GISelChangeObserver&, llvm::MachineInstr&, llvm::MachineIRBuilder&) const AMDGPUPreLegalizerCombiner.cpp:0:0
#11 0x0000000000ded5cd (anonymous namespace)::AMDGPUPreLegalizerCombinerInfo::combine(llvm::GISelChangeObserver&, llvm::MachineInstr&, llvm::MachineIRBuilder&) const AMDGPUPreLegalizerCombiner.cpp:0:0
#12 0x0000000002029472 llvm::Combiner::combineMachineInstrs(llvm::MachineFunction&, llvm::GISelCSEInfo*) (/home/peter/aflplusplus-isel/llvm-project/build-release/bin/llc+0x2029472)
#13 0x0000000000ded151 (anonymous namespace)::AMDGPUPreLegalizerCombiner::runOnMachineFunction(llvm::MachineFunction&) AMDGPUPreLegalizerCombiner.cpp:0:0
#14 0x00000000013a82a1 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (/home/peter/aflplusplus-isel/llvm-project/build-release/bin/llc+0x13a82a1)
#15 0x000000000175fbad llvm::FPPassManager::runOnFunction(llvm::Function&) (/home/peter/aflplusplus-isel/llvm-project/build-release/bin/llc+0x175fbad)
#16 0x0000000001043a72 (anonymous namespace)::CGPassManager::runOnModule(llvm::Module&) CallGraphSCCPass.cpp:0:0
#17 0x0000000001760780 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/home/peter/aflplusplus-isel/llvm-project/build-release/bin/llc+0x1760780)
#18 0x00000000006b09e0 main (/home/peter/aflplusplus-isel/llvm-project/build-release/bin/llc+0x6b09e0)
#19 0x00007f68ec341c87 __libc_start_main /build/glibc-uZu3wS/glibc-2.27/csu/../csu/libc-start.c:344:0
#20 0x00000000006ab4ea _start (/home/peter/aflplusplus-isel/llvm-project/build-release/bin/llc+0x6ab4ea)
Abortet
```
Debug trace:
```
llc: /home/peter/aflplusplus-isel/llvm-project/llvm/include/llvm/ADT/SmallVector.h:280: llvm::SmallVectorTemplateCommon::reference llvm::SmallVectorTemplateCommon<llvm::Register>::operator[](llvm::SmallVectorTemplateCommon::size_type) [T = llvm::Register]: Assertion `idx < size()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0. Program arguments: /home/peter/aflplusplus-isel/llvm-project/build-debug/bin/llc -mtriple=amdgcn -global-isel double-free.ll
1. Running pass 'CallGraph Pass Manager' on module 'double-free.ll'.
2. Running pass 'AMDGPUPreLegalizerCombiner' on function '@f'
#0 0x0000000003a45a1a llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Support/Unix/Signals.inc:569:11
#1 0x0000000003a45bcb PrintStackTraceSignalHandler(void*) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Support/Unix/Signals.inc:636:1
#2 0x0000000003a44216 llvm::sys::RunSignalHandlers() /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Support/Signals.cpp:103:5
#3 0x0000000003a462f5 SignalHandler(int) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Support/Unix/Signals.inc:407:1
#4 0x00007f3a67d99980 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x12980)
#5 0x00007f3a66c89e87 raise /build/glibc-uZu3wS/glibc-2.27/signal/../sysdeps/unix/sysv/linux/raise.c:51:0
#6 0x00007f3a66c8b7f1 abort /build/glibc-uZu3wS/glibc-2.27/stdlib/abort.c:81:0
#7 0x00007f3a66c7b3fa __assert_fail_base /build/glibc-uZu3wS/glibc-2.27/assert/assert.c:89:0
#8 0x00007f3a66c7b472 (/lib/x86_64-linux-gnu/libc.so.6+0x30472)
#9 0x0000000000f848c9 llvm::SmallVectorTemplateCommon<llvm::Register, void>::operator[](unsigned long) /home/peter/aflplusplus-isel/llvm-project/llvm/include/llvm/ADT/SmallVector.h:0:5
#10 0x0000000003ea7faf llvm::CombinerHelper::matchCombineInsertVecElts(llvm::MachineInstr&, llvm::SmallVectorImpl<llvm::Register>&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/CodeGen/GlobalISel/CombinerHelper.cpp:2584:10
#11 0x0000000001c06d32 (anonymous namespace)::AMDGPUGenPreLegalizerCombinerHelper::tryCombineAll(llvm::GISelChangeObserver&, llvm::MachineInstr&, llvm::MachineIRBuilder&) const::$_17::operator()() const /home/peter/aflplusplus-isel/llvm-project/build-debug/lib/Target/AMDGPU/AMDGPUGenPreLegalizeGICombiner.inc:1067:12
#12 0x0000000001bfe935 (anonymous namespace)::AMDGPUGenPreLegalizerCombinerHelper::tryCombineAll(llvm::GISelChangeObserver&, llvm::MachineInstr&, llvm::MachineIRBuilder&) const /home/peter/aflplusplus-isel/llvm-project/build-debug/lib/Target/AMDGPU/AMDGPUGenPreLegalizeGICombiner.inc:1065:11
#13 0x0000000001bfa772 (anonymous namespace)::AMDGPUPreLegalizerCombinerInfo::combine(llvm::GISelChangeObserver&, llvm::MachineInstr&, llvm::MachineIRBuilder&) const /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Target/AMDGPU/AMDGPUPreLegalizerCombiner.cpp:206:7
#14 0x0000000003e98c5c llvm::Combiner::combineMachineInstrs(llvm::MachineFunction&, llvm::GISelCSEInfo*) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/CodeGen/GlobalISel/Combiner.cpp:147:18
#15 0x0000000001bfa431 (anonymous namespace)::AMDGPUPreLegalizerCombiner::runOnMachineFunction(llvm::MachineFunction&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Target/AMDGPU/AMDGPUPreLegalizerCombiner.cpp:284:3
#16 0x000000000281fadd llvm::MachineFunctionPass::runOnFunction(llvm::Function&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/CodeGen/MachineFunctionPass.cpp:85:8
#17 0x0000000002ef9146 llvm::FPPassManager::runOnFunction(llvm::Function&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1430:23
#18 0x00000000020b6ded (anonymous namespace)::CGPassManager::RunPassOnSCC(llvm::Pass*, llvm::CallGraphSCC&, llvm::CallGraph&, bool&, bool&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Analysis/CallGraphSCCPass.cpp:179:20
#19 0x00000000020b677e (anonymous namespace)::CGPassManager::RunAllPassesOnSCC(llvm::CallGraphSCC&, llvm::CallGraph&, bool&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Analysis/CallGraphSCCPass.cpp:476:10
#20 0x00000000020b60ff (anonymous namespace)::CGPassManager::runOnModule(llvm::Module&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Analysis/CallGraphSCCPass.cpp:542:18
#21 0x0000000002ef9a19 (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1545:23
#22 0x0000000002ef958d llvm::legacy::PassManagerImpl::run(llvm::Module&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:535:16
#23 0x0000000002efe251 llvm::legacy::PassManager::run(llvm::Module&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1672:3
#24 0x0000000000d1ad70 compileModule(char**, llvm::LLVMContext&) /home/peter/aflplusplus-isel/llvm-project/llvm/tools/llc/llc.cpp:737:41
#25 0x0000000000d190f2 main /home/peter/aflplusplus-isel/llvm-project/llvm/tools/llc/llc.cpp:418:13
#26 0x00007f3a66c6cc87 __libc_start_main /build/glibc-uZu3wS/glibc-2.27/csu/../csu/libc-start.c:344:0
#27 0x0000000000d188fa _start (/home/peter/aflplusplus-isel/llvm-project/build-debug/bin/llc+0xd188fa)
Aborted
```
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzlWl9T6zoO_zTlxUMncf4_8FBa4HYGBubAvTu7Lx0nUdrspnE3djhwPv3KdtomaQscoOewcxmapo4j_SRLsqQk5unz2T8WUJKEL1d5kZdzIhdAMl4U_Lv6tcohAcIznJDCgI7J6GZydffnXQXXMGdF_gOqMV_GeQkVSXkdF3hzBSCGA2sysEYPSCyu5yRhJYmBVLCqeFonkOIsviTX13_d2C7hFSmYBCEVjGUuycC3IKBO4kdx5OIPQ2xaIoECmFA08yJVcHCyWPDvgjD8bxDo8ZKkoDi3Z-ZqTl6m8ERub8-HRKETkiX_IbJiKKYAWAqtAMGW0Ihgjv_ktRbiv3WO0zdyKKoLqGDgjIiZeEomiq_iiDzU-ELKlcCTAb3E_6J4XA7nPI15IYe8womXP_CTXV1lPxaL8HFN5ZuRVNFp6VXRexvB1LXhwf_xlLalUKo0_-anc05uUI4CphMycPBDA8PsVDEbxgkOmKmC11UCsywvoETdNLPpDX7aDFLI0BTII89TMnCtbEDDgTO2ffJEsoIzOXAuBhRVRT1EH5FBcG7uI2roWlPFaXjvzk3jPWNrQmOCljgvie-2qE01tbwUUEnU5RJKuUNCc1X36wFiPTn-yGr_acOx0TxqWJMWklewl9L0Z1FWILWqGg0Gk_2rpI-NPRhLVYu_b2rLUpRTJbyq6pXMeYkQQl5L1LmZeHd9Mbq_IKKOlbsx7aNo1LySRPKegc1zuajjIbpmY23N1yn6wL8hQaKXuRA1CDwhrExR50lRp6AdKamYWJAYfUwDb3zqXjtdWi9XG0msIdF_dxWfV2xJWDWv1ZoJ7Vr0csGX6AyXK5BQ4TfLilVRC_U5zQUUu5i0459Waze6xBilJyXkdCmrfIVxwpmwZTpPSnI6L3jMCk2JtD2gKAw6u0H3rS5LHRaZEMpbxqworiq2WpA7NXLDSjZX-AKCOl9q1-o7FZKkQaMHeoDs4SDbkM7qMmnWNTB-1vgpDjgWGvLGgu00cRPXIXrhUNnOSDwLc3JX5aXUS_GgjYqG20kV-z7jQlbAcLl9E1Gldln06M9cjQE9t54akBvzVFLYPSloHME-KVB39-hWrPgDba-ASmiExwOqcHSA0r66syQjHUgIpdGeGRbDZKUs39KfDSGnIRRkfgip60MUWmQ2q0CHnBn6ppGpyGM8PoX-zHdPcc-un07nZW0urOQC1ywdCj60DGKKVDp43TabxPEAwoBUDNVB1vIrr0diyWn9r9r5fr_5SYdoZ_RSaCnwZDhUv55FCivl_XWZP5mBR40GkeG3Jj1MUFbP7grsdZH4eGITFnMt6duQyNRoQ9-lmYQ9Jn6XCYtCJ0CtKiqzJQiBDvtWbnie812xV1xouTXJjElWaCB2H0nQRRJbYczeynqJgYYnmxOjTselXQ5hj0MALiMztL2Z3hI-wMt1rLDLK9rH66NsHNtxt2xUFOgEMyvNrDhQSgtZycvnJa8FUfmIWOkAFpmQYMLnFZT7IugfUKzQJfVEWT03wyMVllvx72p6D8V4wco53MaYQjwqL9ZxcDvnhiULvHVaYpw8ePHbuVJFc3eEWzLOfiGJ3o0MSgl2VwmQekn6NiXs4zEtM27mJGbkC0veCa7UopEb0BavzbbYFqeNTnRka65cNrvnDnQj-_2F1hAdHW0baQTZhGUlqdNfY9uz37_GzS5el7fljtCvKCT66UVyOzugw0LK7F2DWDNRmVIL3l5cPUDH2csN0M4ieB1JAi-LsRhpwbpT4NdZ3leQwUDsyOB3ZLBch6HLvGJI46v9gpnqsGsyzZAWapP_3o_HisJ--wi6WsV9HhObLcUCrSx5bnLSLYzpclVsoByGcCS9apAdvYYdB_VjKwKLLFleHgeCYdBB0NtyXTsJN6mMkKySswbOm_bfRNTrXMac6ouajtmL3e5WTLtbsc9iFzC70DccSQWaxUYFI5XjgXyhSG4fdRvm5XJZ8XlnddnUwU2pux0YTR7weK9Smr9wJq-GC2RBQ-URLZNvTXgAtHMmAUPsEoOFMXjIoIIygbfdMt7O-gbzXCghnAszwDHZYXjPwDsfeJOOG70CQmDgn8nnFWgv884fTHtmlxWSReFGQnVadE3qW3n6pDohRNEw9ZgqXDOWF5AO_2YtiNT0A_-uDQiHuR6z2Sc2IN7traZUvK9Xysrw7E9Tr66LcjQaVVX5ak-07QOdCCVOnMSkh71f7-u23jqDPC5g3_EV4AMNCcTrUswJfqpz8mmAu_0O23KUgnc7HmukPs28Q62TY6vRtYKuGrd9Eof5QRpFx2nHeG02fhJGv60d4_eQxMdoxwRdJkHsZJhEzJjePWZqh5jF7O2ym_s2J4ZldKgr0rB0TUL8ytolatV8vWqO1a7W2t0P85eFbphE79-sMbrpgHFw065LtciAtQgv5x_0hjfmLNbWVXf6MA6wIGPZnkK83V1ZMpksmgtT_RwGyV8Ucm9Nvr-X0AJlyoEDqc66FPhgiBjzFK5AbdNXej9W7QA93BauCWbUC10d0w60aezE8lPn1crrq_eqzIwBdWd20DPOJq8Lt92djydJZh0eMPUCddFoZ3PSVdPVdNOWMCHctnwdw-l2SbrN-TiDCAPu__mSfAE1e60Uaad5hWpmwes9h6_ZoPxwDDmk1BfaadRSGVxwoKHmQBQmXvKLu57HjaTrhNDV_hoeasChIbnO7-qC_hZL0HuKc6CZR0M7Y2n6ya3VT1vpPWAasUIVL1qr3GkIUsgi2_U_rc36QXmm3_BwrVuSLRQbg3VUXkRbKxR2n1DEfgqvPpvZ027FYkyN3Zb343FHPr2mdNR12XbfdcefNxebKzHnRf_0ExQ1wqLjWeSq0jjQBraDSEe33Q7mRllBAO9TFu64ahj2aOx9yvklGnEDv5szdpuqSiNWlh2rW_8LBPT0I-lWRKd239eZHb0m4M2BAHB0AV92fs_1us5PaV84L0w_8cnGMaXxHJ3E-VthnJ4wQD37dWF-uyC2H9DOpknd7qNUm6WB1bzhChsTShas0nG1F1rVO6ljXkp4kh-HLzG6iEHzREMdG8yBoxIfd5tBU6-HObIyun669OnsXVu9zGG3VNbr_fjJr320FPSkD8Pscx4t7TTfdT_HMOg9WFq_htl7sLT-eQJntu_bvhtYlJ6kZ04aORE7kbks4GzgnTdJnjchTcarWvlvfFtaddR3Xm2-vT1X463XmIcndVWcvf_RiBe4ln-yOPN8O0oymlEKMYshdGPHC7OY-W6cOV5gnRQ4Wggl1YDSEr4TTUK96-tNTvIzihqwQhpibRJY9jByfSt1syBgMUtD2xu4FqC1FEP9ajKv5ifVmYaEggi8WORCiu1FdGjV29JKVPRZLRe8OpswycbmBVZITzSAMy3A_wC6hmtl">