<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/64242>64242</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Segfault in LLVMContextImpl / ValueAsMetadata
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          wsmoses
      </td>
    </tr>
</table>

<pre>
    I have some code using LLVM as an API which segfaults, though have been having trouble reproducing externally as the issue is nondeterminstic otherwise.

The code runs IPSCCPPass on a module, then runs the ModuleInliner pass. This results in the LLVMContextImpl in an invalid state, such that a later call to LCSSA will segfault, though LCSSA is not the cause: https://github.com/EnzymeAD/Enzyme/issues/1361

Specifically, it appears that `IPSCCPPass` causes some ValueAsMetadata to be created, which is stored in a DenseMap<Value, ValueAsMetadata> inside the LLVMContextImpl.

The moduleInliner removes the function (and thus instruction) which is the key to that map via a dropAllReferences here: https://github.com/llvm/llvm-project/blob/09b6765e7d278a08ceece8a1e3a24fa37a35f46e/llvm/lib/Transforms/IPO/ModuleInliner.cpp#L268

Subsequent code (in my case LCSSA) that iterates through that map to lookup metadata gets bad data.

In my case, to minimize and find the source of the error I did the following:

```
+++ b/llvm/lib/Transforms/IPO/ModuleInliner.cpp
@@ -48,6 +48,17 @@ using namespace llvm;
 STATISTIC(NumInlined, "Number of functions inlined");
 STATISTIC(NumDeleted, "Number of functions deleted because all callers found");
 
+#include "/home/wmoses/llvms/llvm16/llvm/lib/IR/LLVMContextImpl.h"
+void err2(llvm::LLVMContext* C, const char* A) {
+    llvm::errs() << " <" << A << ">\n";
+  for (auto &P : C->pImpl->ValuesAsMetadata) {
+ llvm::errs() << " 0: " << *P.first << " 1: " << *P.second << "\n";
+      for (auto u: P.second->getAllArgListUsers ())
+ llvm::errs() << " + " << *u << "\n";
+  }
+    llvm::errs() << " </" << A << ">\n";
+}
+
 /// Return true if the specified inline history ID
 /// indicates an inline history that includes the specified function.
 static bool inlineHistoryIncludes(
@@ -102,6 +113,7 @@ static bool isKnownLibFunction(Function &F, TargetLibraryInfo &TLI) {
 
 PreservedAnalyses ModuleInlinerPass::run(Module &M,
 ModuleAnalysisManager &MAM) {
+ err2(&M.getContext(), "inliner pass");
   LLVM_DEBUG(dbgs() << "---- Module Inliner is Running ---- \n");
 
   auto &IAA = MAM.getResult<InlineAdvisorAnalysis>(M);
@@ -217,9 +229,11 @@ PreservedAnalyses ModuleInlinerPass::run(Module &M,
 &FAM.getResult<BlockFrequencyAnalysis>(*(CB->getCaller())),
 &FAM.getResult<BlockFrequencyAnalysis>(Callee));
 
+ err2(&M.getContext(), "preinl");
     InlineResult IR =
 InlineFunction(*CB, IFI, /*MergeAttributes=*/true,
 &FAM.getResult<AAManager>(*CB->getCaller()));
+    err2(&M.getContext(), "postinl");
     if (!IR.isSuccess()) {
 Advice->recordUnsuccessfulInlining(IR);
       continue;
@@ -258,6 +272,7 @@ PreservedAnalyses ModuleInlinerPass::run(Module &M,
     // changing inline cost thresholds.
     bool CalleeWasDeleted = false;
 if (Callee.hasLocalLinkage()) {
+      err2(&M.getContext(), "prelocalrem");
       // To check this we also need to nuke any dead constant uses (perhaps
       // made dead by this operation on other functions).
       Callee.removeDeadConstantUsers();
@@ -276,6 +291,7 @@ PreservedAnalyses ModuleInlinerPass::run(Module &M,
 DeadFunctions.push_back(&Callee);
         CalleeWasDeleted = true;
 }
+      err2(&M.getContext(), "postlocalrem");
     }
     if (CalleeWasDeleted)
       Advice->recordInliningWithCalleeDeleted();
@@ -293,8 +309,10 @@ PreservedAnalyses ModuleInlinerPass::run(Module &M,
 // Clear out any cached analyses.
     FAM.clear(*DeadF, DeadF->getName());
 
+      err2(&M.getContext(), "predeldeadf");
 // And delete the actual function from the module.
 M.getFunctionList().erase(DeadF);
+      err2(&M.getContext(), "postdeldeadf");
 
     ++N
     ```
     
     This is an error for certain on LLVM16, and may or may not occur on other versions.
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJysWF1T47jS_jXipouULZOvi1wYM3nf1IE5FLC7l1uy3Il1sKUcSYbN_vpTLTmJkzAzzNZQKeJY0qP-fLol4ZzaaMQFG9-y8d2V6Hxt7OLdtcahuypNtVusoBZvCM60CNJUCJ1TegP3978_gHAgNOSPK3ivlazB4WYtusY7xgvwtek2dVxdImp6opXemq5sECxurak6Se_wL49Wi6bZEaavEZRzHf0HbXSFHm2rtPNKgvE12nflcMSSO5bk8f9L3UtnO-1g9fhcFI-PwjkwGgS0puoajEKhjnNok4fwfqUbpdHCVjg3gpdaObDoSA1QOswjZQujPf7lV-22oddCg9JvolEVOC98AHedrMHXwoOARni0IEXTgDdwXzw_5_CumuZgo4GJ4mjQ1Yf9pOgcsiyH2vutY1nO-JLx5Ub5uitH0rSML7_ov3ct5neHR8aXwWiO8WWaTdKheZ63KNVakTg72lh5ENstCuuivGySHG3GJkmUwEWv_y6aDnP3gF5UwgvSp0SQFoXHitCi85UD543FKpgH7lA7fBBblhUBgCaeIbHsCyjtVIUfWfnCv-2Jtyy25g2jH9edll4ZDYzPhK7A1x35znnbhfeMz49C0oJX3JEaQfdWbOFNCRBQWbPNm-YJ12hRS3RQo_2RH5rmbf91vbXmPyg948uyMSXjy2ReTqaTMU4rPp2JZCYRJc5EipngN2uRTUU2Xt9McICjaN2LFdqtjW3JmavHfzO-PInVkdxuGc_u-WR24uaudPjfDrWPycD4TGlodyCFwxhmZIqgtvJohQ8GtCEKD8bwBhpjXrsttHuXb9A7KEUF9OvEMasDfghoA63SqlV_I5Aj1ip4g-ijsxLBrMMvtNZYWEGl4ujaNI15V3pDJh6As0nSf-JPfhs_UP4jg0WQm4TdJHB9M2O8mADjt-EpnUI_EvlNixbdVkiEsE92G1fD80v-snp-WRWMz752bYQPWcA4_9q1JVrSch-RFIb9DM74_Js4d9ig_y5OFWdAiSE3gZiF8hmtg7Xp9MUOA5tlSsumCwHBGV_WJrDFe2D53pL773RybtrVE-PL89ysCWm_wZtRFfmUMz6L1spZlg-WMJ5DQbpJo50HWQtLr0IwsuntAQgA4AiA1jrGZ2FSVrAsmCY89l9ZAflgiGVf2LjQ4WmIuTY2EEPnDTA-eQTK6OKaZV-2pAs9BGJyA2Y6F-xHUiWEOZCL8fxxtFbW-eGs9KNZDqXR1VCPj5Sgv6EiHUHtF5MKG_R50-R2c6-c_81RWEQx6fNpPWjOqYDdjyRj07ufd-Dyp3w43GIf3YGJGV_CE_rOavCW-oXILy6Wu1CKKPugVlSadrC6u1iudKVkIMJQ0k-mR6KMuePOkPeZ2bNh6AKUhNKYpof5_4iy6teTJU4YKE34noLSNGO8OFDQCZb7lzbv-l6Vy35HxmfLY8GbLCmxXoTdoL9XpRW04zpE-sv96iSQe0qAR4sO7RtWuRbNjur8CVeGHiA40Ha0WRwkwAfGix4jvowAyj0ILTZow5z84SJ7em6g0dEG_YEVYngGx6tBE3bOZBBagz_vvtz-9n-Mz6pycxlW19fX171QsG8RlIOnTmui8zC8j6xLlgSAPT2scorHO3jIg6xPoRNkWRFB8-pNOWP3elO48tnDEHHvXZ5OGS_m5F0etEzTvXt_hf3J8WcS3jZGvi5taADk7lRExnPGZ8VtzxRFKBxHfggC_jPkAIU9yGXx-YzvtxaVbi69Dr0noxyweiLH9KNxZJASjOfFLQGulquIu2Q8f0C7wdx7q8rOo6P1ZIklscV3Vc7zPqYP9vue8c6o-jM6G-e_obRaR-ZOV08j5Z47KdG5w3aDdKZglEhSWZTGVr9pFyevuybYhzoqPqMCfrYFUCX2Snd4GbfjQ2PEp3zISr8ibOmvJ15ZC72h3OxJVxpHpx-LrjZN5UaDFYEIY6D9IVzfK4UsXYvGHXXoTRdnjmrh7o0Uzb3Sr2KDH1jwUFk_F6QNoVlsP3LaQa0XA7JG-QqeDpLv1Kg5Axqxou5Yd6_UGe-gQlHFdkhoD-Gwxfhsi7YWW_cRbisqjKvKXcQ2W-rgqQrQh47Fx3aR8fnoBKW3STw13aGoin7v0Cr0ml7EwnRyiIV5-qtjgaTYJ7AbbTtX_1kK-Rr9cKSVMzPDx4EQEvpIP2c9yadT8nsuPoAOsvRclkOz1ct6nqL7tPxD-TquPSz82ANzagxm5IEsCVUk-bVVJMRW0aCwYDofQlMKWWMFoocdxhGxpKTJkRKDB8l64aGnx6-iPebaRxXhJzKuwoZCfn1RtaPcua76c1FozoT0nWiOtwFra9owEG8O9oqEDfeBR91y3HWENpxiZ71WF6z-6SD6ptRDDqRz7Nfhm9Ozbnx3fAzXUio0qfH0TIcBidYLFfKfOiQ6uxXh3N2KHRgbvrTxYKTs7JEl3tC6kHNX1SKr5tlcXOEincyT6YRn6fiqXmRpmY5TLgRKxGosEz7hs2Q-nU4Qk6SsrtSCJzxLplmaJGk6Ho_WSVqlfD1Ls0TcjG8m7CbBVqhmRMeBkbGbq3A5tZjc8Bt-1YgSG7e_drSLcHtSdhvHbpJGOe-Oy7zyDS6e-1szUPriNo4i4exm6aqzzeKnL20O12dByP8FAAD___xeRn0">