<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Issue</th>
<td>
<a href=https://github.com/llvm/llvm-project/issues/64371>64371</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>
use-after-poison in `HexagonDAGToDAGISel::balanceSubTree`
</td>
</tr>
<tr>
<th>Labels</th>
<td>
backend:Hexagon,
llvm:crash
</td>
</tr>
<tr>
<th>Assignees</th>
<td>
</td>
</tr>
<tr>
<th>Reporter</th>
<td>
chfast
</td>
</tr>
</table>
<pre>
```
==2555916==ERROR: AddressSanitizer: use-after-poison on address 0x621000038b58 at pc 0x55555ce6b133 bp 0x7fffffffc030 sp 0x7fffffffc028
READ of size 2 at 0x621000038b58 thread T0
#0 0x55555ce6b132 in getOperand /blockchain/projects/llvm-project/llvm/include/llvm/CodeGen/SelectionDAGNodes.h:927:5
#1 0x55555ce6b132 in llvm::HexagonDAGToDAGISel::balanceSubTree(llvm::SDNode*, bool) /blockchain/projects/llvm-project/llvm/lib/Target/Hexagon/HexagonISelDAGToDAG.cpp:1977:23
#2 0x55555ce60d98 in llvm::HexagonDAGToDAGISel::balanceSubTree(llvm::SDNode*, bool) /blockchain/projects/llvm-project/llvm/lib/Target/Hexagon/HexagonISelDAGToDAG.cpp:1979:27
#3 0x55555ce594cd in llvm::HexagonDAGToDAGISel::rebalanceAddressTrees() /blockchain/projects/llvm-project/llvm/lib/Target/Hexagon/HexagonISelDAGToDAG.cpp:2353:26
#4 0x55555ce57935 in llvm::HexagonDAGToDAGISel::PreprocessISelDAG() /blockchain/projects/llvm-project/llvm/lib/Target/Hexagon/HexagonISelDAGToDAG.cpp:1314:5
#5 0x5555632d3aa9 in llvm::SelectionDAGISel::DoInstructionSelection() /blockchain/projects/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:1087:3
#6 0x5555632ce9a9 in llvm::SelectionDAGISel::CodeGenAndEmitDAG() /blockchain/projects/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:949:5
#7 0x5555632c5d47 in llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) /blockchain/projects/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:1700:7
#8 0x5555632b9603 in llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) /blockchain/projects/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:482:3
#9 0x55555ce70972 in llvm::HexagonDAGToDAGISel::runOnMachineFunction(llvm::MachineFunction&) /blockchain/projects/llvm-project/llvm/lib/Target/Hexagon/HexagonISelDAGToDAG.h:48:23
#10 0x555560c55075 in llvm::MachineFunctionPass::runOnFunction(llvm::Function&) /blockchain/projects/llvm-project/llvm/lib/CodeGen/MachineFunctionPass.cpp:91:13
#11 0x555561fe9ef1 in llvm::FPPassManager::runOnFunction(llvm::Function&) /blockchain/projects/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1435:27
#12 0x5555620087b2 in llvm::FPPassManager::runOnModule(llvm::Module&) /blockchain/projects/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1481:16
#13 0x555561fec095 in runOnModule /blockchain/projects/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1550:27
#14 0x555561fec095 in llvm::legacy::PassManagerImpl::run(llvm::Module&) /blockchain/projects/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:535:44
#15 0x55555a28b637 in compileModule /blockchain/projects/llvm-project/llvm/tools/llc/llc.cpp:751:8
#16 0x55555a28b637 in main /blockchain/projects/llvm-project/llvm/tools/llc/llc.cpp:416:22
#17 0x7ffff7a1ed8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#18 0x7ffff7a1ee3f in __libc_start_main csu/../csu/libc-start.c:392:3
#19 0x55555a1b3754 in _start (/blockchain/projects/llvm-project/llvm/build/san/bin/llc+0x4c5f754) (BuildId: 2bacbb9d86dd871a44a620646292a652dc2dd0c6)
0x621000038b58 is located 1624 bytes inside of 4096-byte region [0x621000038500,0x621000039500)
allocated by thread T0 here:
#0 0x55555a273782 in operator new(unsigned long, std::align_val_t) (/blockchain/projects/llvm-project/llvm/build/san/bin/llc+0x4d1f782) (BuildId: 2bacbb9d86dd871a44a620646292a652dc2dd0c6)
#1 0x55555a912f3e in Allocate /blockchain/projects/llvm-project/llvm/include/llvm/Support/AllocatorBase.h:92:12
#2 0x55555a912f3e in llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096ul, 4096ul, 128ul>::StartNewSlab() /blockchain/projects/llvm-project/llvm/include/llvm/Support/Allocator.h:339:42
#3 0x55555a912bf1 in llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096ul, 4096ul, 128ul>::Allocate(unsigned long, llvm::Align) /blockchain/projects/llvm-project/llvm/include/llvm/Support/Allocator.h:195:5
#4 0x5555631750de in Allocate /blockchain/projects/llvm-project/llvm/include/llvm/Support/Allocator.h:209:12
#5 0x5555631750de in Allocate<llvm::RegisterSDNode, llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096UL, 4096UL, 128UL> > /blockchain/projects/llvm-project/llvm/include/llvm/Support/Recycler.h:89:57
#6 0x5555631750de in Allocate<llvm::RegisterSDNode> /blockchain/projects/llvm-project/llvm/include/llvm/Support/RecyclingAllocator.h:43:47
#7 0x5555631750de in newSDNode<llvm::RegisterSDNode, unsigned int &, llvm::EVT &> /blockchain/projects/llvm-project/llvm/include/llvm/CodeGen/SelectionDAG.h:405:40
#8 0x5555631750de in llvm::SelectionDAG::getRegister(unsigned int, llvm::EVT) /blockchain/projects/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp:2188:13
#9 0x55555cee9182 in getCopyFromReg /blockchain/projects/llvm-project/llvm/include/llvm/CodeGen/SelectionDAG.h:801:30
#10 0x55555cee9182 in llvm::HexagonTargetLowering::LowerFormalArguments(llvm::SDValue, unsigned int, bool, llvm::SmallVectorImpl<llvm::ISD::InputArg> const&, llvm::SDLoc const&, llvm::SelectionDAG&, llvm::SmallVectorImpl<llvm::SDValue>&) const /blockchain/projects/llvm-project/llvm/lib/Target/Hexagon/HexagonISelLowering.cpp:844:26
#11 0x555563110cc3 in llvm::SelectionDAGISel::LowerArguments(llvm::Function const&) /blockchain/projects/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp:10869:26
#12 0x5555632c0f00 in llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) /blockchain/projects/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:1465:5
#13 0x5555632b9603 in llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) /blockchain/projects/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:482:3
#14 0x55555ce70972 in llvm::HexagonDAGToDAGISel::runOnMachineFunction(llvm::MachineFunction&) /blockchain/projects/llvm-project/llvm/lib/Target/Hexagon/HexagonISelDAGToDAG.h:48:23
#15 0x555560c55075 in llvm::MachineFunctionPass::runOnFunction(llvm::Function&) /blockchain/projects/llvm-project/llvm/lib/CodeGen/MachineFunctionPass.cpp:91:13
#16 0x555561fe9ef1 in llvm::FPPassManager::runOnFunction(llvm::Function&) /blockchain/projects/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1435:27
#17 0x5555620087b2 in llvm::FPPassManager::runOnModule(llvm::Module&) /blockchain/projects/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1481:16
#18 0x555561fec095 in runOnModule /blockchain/projects/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1550:27
#19 0x555561fec095 in llvm::legacy::PassManagerImpl::run(llvm::Module&) /blockchain/projects/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:535:44
#20 0x55555a28b637 in compileModule /blockchain/projects/llvm-project/llvm/tools/llc/llc.cpp:751:8
#21 0x55555a28b637 in main /blockchain/projects/llvm-project/llvm/tools/llc/llc.cpp:416:22
#22 0x7ffff7a1ed8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
SUMMARY: AddressSanitizer: use-after-poison /blockchain/projects/llvm-project/llvm/include/llvm/CodeGen/SelectionDAGNodes.h:927:5 in getOperand
```
```llvm
target triple = "hexagon"
define i64 @f(i32 %LGV1, ptr %G.13, ptr %RP) {
%B1 = add i32 %LGV1, %LGV1
%G8 = getelementptr i32, ptr null, i32 %LGV1
store ptr %G8, ptr %G.13, align 8
%B2 = add i32 %LGV1, %B1
%G1 = getelementptr float, ptr %RP, i32 %B2
store i1 false, ptr %G1, align 1
ret i64 0
}
```
https://godbolt.org/z/zTxPWbK6h
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzcWltzozgW_jXKi6pTQuIiHvyA4zib2vRMyk731j6lhJAxOzJQSEwn_eu3JMBczHa5exJvZVJtGwQcfd-5SOechimVpbkQC-Atgbe6YrXeF9WC73dM6au4SF4XwEftP7QCKAJkBcgKe54XOn5zcrvZ_L4BJIJRklRCqS3LM519F5UZq5X4xHZaVJ_KIlNFDoscsuY-iF587CCEEKGxRyHTsOQQvXjmjws_dgiBcQnRS7Br_jgiCKrxCKawQba5jVaw2EGVfRcQG2kT-XpfCZbAJ9Q-ACGEABM0nhLDLIep0L-XomJ5AgFex7Lgf_A9y3KA12VV_EdwrQBeS_nn4VN73p4CvM5yLutE9AM3RSLuhHl2K6TgOivyVXT3W5EIdb0HJApxAEjkjVE5M6isPBIBEv1DvLDUinkqVtHd_VbI5kLMJMu52NbxUyUEwLR_ZrsyUwIcAXwD46KQAIc_z05mMcDrJ1alwoy2QPojA6WDdc3LEpDICQNDEJOOIcAED-ihJKQfm15o6AUDeqSn54UuT86kV4mWYBtJhqQCmF6KCiYeMT_-2BfdAZsgJN6ZbB4rUVYFF0q1U12QiUMc9zSovJaIT3BCGAvHRIbR2bNYFfe50lVtrxxv-WtU5leEyamB0LFB1EQQGbPxezZchOexaWeO8uT2kOm_bJOfJRK64alVggEPL3GDc3g0o5GUS6YyvjTQ1Wg5WNe5fQryIlcaYP-S5goQAiQKxjRpTzMOfUTOoVnV-e_5Z8b3WS46RiOaJ9cuydOl-NQrw36xCFAYnLtxXZbpmWvJ3pIc7V3t7twlDT7inoeCyZI4wfrIlBqwnKX31hacgdDFoGPXxwmhLt_wnZ0Ixc4ZE1o_GgGfWc5Sm9ZdgMr9BuD1g0gZfx3M3UWYS7zRntuy6NIKHyNEgxifx-JzkdRynE10Q-_IgFo7TLZahwzswFFoHWsA8n2weB6a06Y7g6VXkbTS2q2-l3l_KPuQvqxOPesUrjuh0e36HsM09ondX3hxKDMpflWpuihkc5U33y2CwDNGpRMA_gyAA8vyt5vXNbVYhPFk4qCrlALmiITuzMTPzzKL-bPSrNLPnEn5bKFwVQO8vr4GeK1eVSJKM01eatmo_uQBuzZ6dM6F6XBWQU5nnU7YHJobPtkbrrnZVsLR5mIEH7cW5sQk8Fwr2D4BbRrzk8qM60wmhi8zt8f2IavYJXpxubcLPLfxVLo0d94npp7FMeNxHCbUTxIaOMx1mY-R7_o4xMz3cMJxkiDe-HgL3f5MitFMQVlwpkUCHR-7MH7VQsEsV1kiTBXrotD_ZAZhJVKTxwBvORDhIQTwTT8Q2oFuSiY72fHroOzdi0oYDvPlL8MBCahdMgtT--qigrn4BjCtc9slSKAs8tSUV0onTUgzmaX5859MPutWVW9rhcTZBRS_iRUmZTULHbwjwrCNWm29Qam_rcuyqMwdrdCiWjIl2jLfBMskRPEMnn7FXNaH8lFXR1nN2nozTDTMpeN1YxvjOLUcHzmY1hKQ2zbVNBHzm_i2lSz-1fT_HOaWNSEm43fxTG1sKMfTTON9KHcmnnPmXnRkvPl91eGEZovyem0c91jiBB5KLuCQFgdGofXGHoj3AyAjA2xEmiktqq7hcvMG1vvyMD5yMP3yAMgttJ831MJG8FcuRaMEaovRoNeB_4s6eBeQWZ6ObeYS8zWAG8zAzcW3DtQPbXYMgyw3u6c_tuPt1yc7-CbE5svKhhKyGRvqOdEZTvNVcjOSCt2RGwZ3lusTRu9dGXdNNIfatIj0pAY1sQgd2rWYb4rydV0Vh41I31fNFJm0lAzU7KAZSCdlelMmPxTfRJXlaXPJnq2L6sBkVKX1QeRaTRqxX5msT5ysb8sOzbI9MCm_Cj63VtxvV-1BXtY6qlLjjn07ZyRm9VDw_3VtZLHpxR_M3xEht23NYuW_T8uh03HrQ9R1bR92YDCnDwwHcX5W-8hKnbfSxftjNnvrS05E_XBKEQ8agWiH0MdvBLr-ZLvv6_u_WxdwwNH9e7YABwy9D9_-G5DxP2brb8Ag-HhtvwF6-v9s-c20Vz5au2_wv8ro4q2-cTXvXKzTN54XX6bR174CYr-3Xz5_jjb_Pvu9j8u9RzF6f6OFPHmJZTxo5dshbTcFqKusNL5CVhBgvO82CDx8OhG7LBcw810IXLQDmGYEQ4C9h7uvjkkyS12Z07trhwxON482HIJlZ0CAvaVjp2JJAicyusP-3jtq702FFlKYtM7IzQjupshraVPsoaDmaaWLShxR0RmItpsH6RAZ_gGy5QiXM4NrJwumJ-SP0JZHH26QZQ7cManEEJjTwzpOVglttd7ZMljN2nivdWm3XbwGeJ0WSVxIfV1UKcDr7-bz9PL4r_if_r65_SpZkCQkIbsSC8cPHeSGoU-u9gtBqOeR0CEMuSRwHBTELkWI42DHuOsGV9kCI0wQRebjI3yNfMpdgnASOzFFzAcuEgeWyWvjZwbBVaZULRa-kXclWSyksi9gYRwz_ofIkz5LMk6HbwDG7brKK6b2ZtBbXVULGzhxnSrgIpkprfopdKalWJxEoVmKfHTu-zU-uqoruZioMtP7Or7mxWGwWo8j2PIzkW0p_jcAAP__j7fOgw">