<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/58759>58759</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Compiler crash due to a corrupted/invalid DominatorTree
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            llvm:crash
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          momchil-velikov
      </td>
    </tr>
</table>

<pre>
    This program

```
__attribute__((noinline)) static int f(int x, int (*p)(int)) { return x + p(x); }

int p0(int), p1(int);

int g0(int x) { return f(x, p0); }

int g1(int x) { return f(x, p1); }

```

when compiled with `-O3 -mllvm -enable-function-specialization` crashes. (https://gcc.godbolt.org/z/be1xrjczG)

(same with LLVM IR and `opt`:  https://gcc.godbolt.org/z/7en14f8a1)

The immediate reason is that `MemorySSA` gets an invalid/corrupted `DominatorTree` for `f.2` (one of the specialized functions).

It seems that the corruption happens somewhere in the `ArgumentPromotion` pass.
Looking at the pass manager debug output we get:

```...
Clearing all analysis results for:                 <- should be f.2, a small bug passing a zero-length string
Running pass: OpenMPOptCGSCCPass on (f.2) (1 node)
Running pass: SROAPass on f.2 (3 instructions)
Running pass: EarlyCSEPass on f.2 (3 instructions)
...
```
That "Clearing all analysis ..." refers to the old `f.2`, before argument promotion.

A quick hack to invalidate analyses, for the sake of experiment:
```
diff --git a/llvm/lib/Transforms/IPO/ArgumentPromotion.cpp b/llvm/lib/Transforms/IPO/ArgumentPromotion.cpp
index 8c77b6937737..cce08a35350b 100644
--- a/llvm/lib/Transforms/IPO/ArgumentPromotion.cpp
+++ b/llvm/lib/Transforms/IPO/ArgumentPromotion.cpp
@@ -828,7 +828,7 @@ PreservedAnalyses ArgumentPromotionPass::run(LazyCallGraph::SCC &C,
       // swaps out the particular function mapped to a particular node in the
       // graph.
       C.getOuterRefSCC().replaceNodeFunction(N, *NewF);
-      FAM.clear(OldF, OldF.getName());
+      FAM.clear(OldF, NewF->getName());                                              // <-- Fix for the zero-length name
       OldF.eraseFromParent();
 
       PreservedAnalyses FuncPA;
@@ -849,6 +849,6 @@ PreservedAnalyses ArgumentPromotionPass::run(LazyCallGraph::SCC &C,
   // We've cleared out analyses for deleted functions.
   PA.preserve<FunctionAnalysisManagerCGSCCProxy>();
   // We've manually invalidated analyses for functions we've modified.
-  PA.preserveSet<AllAnalysesOn<Function>>();
+  //PA.preserveSet<AllAnalysesOn<Function>>();                                        // <- add invalidation to see what happens
   return PA;
 }
```
and we get
```
...
Running pass: ArgumentPromotionPass on (f.2) (1 node)
Clearing all analysis results for: f.2                          <-- this is for the old function
+ Invalidating analysis: DominatorTreeAnalysis on f.2           <-- this is for the new function with the same name
+ Invalidating analysis: LoopAnalysis on f.2
Running pass: OpenMPOptCGSCCPass on (f.2) (1 node)
Running analysis: PreservedCFGCheckerAnalysis on f.2
Running pass: SROAPass on f.2 (3 instructions)
+ Running analysis: DominatorTreeAnalysis on f.2
Running pass: EarlyCSEPass on f.2 (3 instructions)
Running analysis: MemorySSAAnalysis on f.2
Running analysis: AAManager on f.2
Running analysis: BasicAA on f.2
Running analysis: ScopedNoAliasAA on f.2
...
```

The three extra lines show invalidating analyses for the new `f.2` function (after argument promotion). But it's not entirely clear
if these analysis were run at all for the new function. These observations are consistent with a hypothesis that after `ArgumentPrompotion` the pass manager somehow contains invalid analyses results for `f.2` which later trigger a crash in `MemorySSA` (the compiler does not crash with this hack).

</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJy1V1tP4zgU_jXti5WoaWjTPvQhhOlopAGqAe0-Ijc5aTwkcdZ2KPDr9xzn0rR0BsTOotCbfS7-_J3bViYvq_tMaFYpuVO8GE2uRpOwfZ1P2sd-fXjgxiixrQ08PIymC3xKKcpclDCaLvFh2nAjYiZKw1Jcpffn0TSyP1iBsLI7aaUVGQWXTIGpVcmecc8lwx2LZ1r0L3HxaugPqakmA_GIVd7hq395unk3OXhxZCptjERW3a9M7bx3pb3z0ifANa_7DEoWy6ISOSRsL0zGcIdz6zOnyPOngjlQ8m0OTlqXsRGydHQFseC5eOX0FTezWHGdgXYJzcyYSo_8cDRd47OLY3cnk63MjSvVDn95xf8teM_qZ_z6lfwcOjhdaF5A48X3739ds28_GC8T8khWhjz3Q8Y-YiKA0rtIF9w7MXGfARNFAYngBhA5rmXJkGcm44bMXEMh1cvdHYHFdmA02keiPOF5E1QbS6XqyoB16UoWouRGqnsFQPtTqej31J3SNzyNLIHJFJUD61FD2Q5Kjc65Q---GaYBitYdEmsN4maW8aqCUjMtC8BbU3iQ0u5BY6Ha1QWUZqNkIbtrqbjWrfrvUj6KcsdarbTCCl7yHSiWwLbeMVmbqjZsD3RqAvcccVy31RflwJVVmOeIEM9fNIKoQNc5QoY42Is6-Rv5kcN0Jus8YVtgBBOylTNdkBZygvyyWtkrKOnkUO6QCdqQqcbwj7osaQftJBu3CMn15rYy0de7KNrQuRAqhN5qX9Inj5UygZ4HpxruftyGnRwKkYSPyKLRur-k85JfuMpforsvH5PusTsJw3vLvOn0PKQkNZ0isikopIW01yfz5MAzwnALCDkw3rKAsmZDgyN2heyfWsSPSCR8QVUtrSkQGnugSRmx2DKWP1r2wnMFSpDeAy2Oj5CINGWOsxOGcQwSShv0Jrb4eq94qVFlgbrX3za3-PqGrG5cVWz7WckuNSbwzBZxEGznSz8I_MB14xgmC-7P_Nlky7zJZH5x0Wx2HOfznna56rJ5_qvjo4sJPsxZUCWKAqo2_cdmaYNxBeoJkrC9JfZG3aahJD6qLpGD3_nrS4RE-qp4lTULGB6oex6h5sZwF5U2izK955WmLNAmCIUls8656pMV5gvMPwkRhw_XKbjaTHRO7448cI9WIhdTzC3Wa_UDUnTL1uClq6DKeQw3qG_d2sSVG6Iklugb2K-H5dRpdK3DazemyMGtt3mypt30TiZusJY0uo_qMF7ZL0XJijPyv5yRfpPOfvvXnp5SnsPW4rmPqmFiK8nEEBnrOWA1hTXe7IYrCrrGh859diTwlhoE3SY8nLZj1wU1JnPLru7j_82uFoO_EcbgCUsZYY0EIo51-cbCkkAOZlgWD3TZhG7V-odQdrQI2-x43VSwJvUr-fyCN3cK1xs3sOzV6PvLIP0lx_70fmA1bGUkpjgBidtzb-DYHdXLKMzzDsDbcuArufTGK8vBxq_PKvoEERlPksOpKaQxlrHfYHsqQW170cPWdpUDLg36yeP8Ty1a2zicW-4r32kBPUu09-r3h1oPKsW_hsQGpaHxQug-MKmodjd_uKVvPVxksbVGFo6av46QXRfwnq0S9oe8arvdpuBi73vICb81jw1ddWL1TzdIQ3N9kojWX6MM4kdQH7L-8eaKTnvO8u9w_hNt2Tmb_RDwW3tDiTBsc9G7Oy-5FjG2Yu_tu4slVtsbGeaC65P9v2olDyOOyRAt7NyM4owmYU19934Q_L01OGblYXzp-YnY8RSL9Zn2kso2u8R8LrBMBRp5ZBhuEAowvza1tWnO7Ayk4RCve5pfsJrQREKBfC4yXHZvheSWuMeblIwlBIeiEnUYcsUGD2fZSyXJQjfJNQ6fDEZVPxm9mYFopiKAULPhyJMOqQNIgwQzAGmfiThjOSdrOKXsSBdv5mHqiU4HSoSyGersuI2VT0IDWiPRZgI8BLXoh-FwDCtvPg_8xcz3gnGy8pOlv-RjI0wOq6hT1uhIamhatH5UxfTfneYomMa1ylcnszQ6UG9d9G_Q0-Kbgzf-E2JDqrSuaU5YzxbBbDnOVmm6SNPJNliAN4_nF5O5dzHx4zQNZqk3Wy7n45xvIder0Qy75alV6ofWV_w6ml2NxWo6mU49bzL1Jv7MC9zlMllg_x7MYz_h3nKJXQoUXOQuCdOMP1Yr6xWOjBoXc-SCPizSDLkrAaxF1M9rk0m1KmQRZyJ3niAXj_JpbA-ysqf4F-TMsDM">