<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/87625>87625</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            opt crash - segmentation fault in RewriteStatepointsForGC.cpp
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          Chronostasys
      </td>
    </tr>
</table>

<pre>
    LLVM version: 18.1.2

system info: MacBook Pro(M2)  macOS 14.1 (23B74)

command:
```bash
opt -S -passes=rewrite-statepoints-for-gc test.ll
```

code:
```llvm


define void @fn1() gc "statepoint-example" {
  %r28 = alloca i8, addrspace(1)
  call void @fn2(i8 addrspace(1)* %r28)
  ret void
}

declare void @fn2(i8 addrspace(1)*)
```

stacktrace:
```log
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: opt -S -passes=rewrite-statepoints-for-gc test.ll
 #0 0x0000000109c054a0 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/local/libexec/llvm-18/lib/libLLVM.dylib+0x1494a0)
 #1 0x0000000109c0374c llvm::sys::RunSignalHandlers() (/opt/local/libexec/llvm-18/lib/libLLVM.dylib+0x14774c)
 #2 0x0000000109c05b54 SignalHandler(int) (/opt/local/libexec/llvm-18/lib/libLLVM.dylib+0x149b54)
 #3 0x0000000185363a24 (/usr/lib/system/libsystem_platform.dylib+0x180467a24)
 #4 0x000000010ac087ec findBaseOrBDV(llvm::Value*, llvm::MapVector<llvm::Value*, llvm::Value*, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, llvm::Value*>, 0u>>&, llvm::MapVector<llvm::Value*, bool, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, bool>, 0u>>&) (/opt/local/libexec/llvm-18/lib/libLLVM.dylib+0x114c7ec)
 #5 0x000000010ac087ec findBaseOrBDV(llvm::Value*, llvm::MapVector<llvm::Value*, llvm::Value*, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, llvm::Value*>, 0u>>&, llvm::MapVector<llvm::Value*, bool, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, bool>, 0u>>&) (/opt/local/libexec/llvm-18/lib/libLLVM.dylib+0x114c7ec)
 #6 0x000000010ac0964c std::__1::__function::__func<findBasePointer(llvm::Value*, llvm::MapVector<llvm::Value*, llvm::Value*, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, llvm::Value*>, 0u>>&, llvm::MapVector<llvm::Value*, bool, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, bool>, 0u>>&)::$_3, std::__1::allocator<findBasePointer(llvm::Value*, llvm::MapVector<llvm::Value*, llvm::Value*, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, llvm::Value*>, 0u>>&, llvm::MapVector<llvm::Value*, bool, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, bool>, 0u>>&)::$_3>, void (llvm::Value*)>::operator()(llvm::Value*&&) (/opt/local/libexec/llvm-18/lib/libLLVM.dylib+0x114d64c)
 #7 0x000000010ac08bf8 findBasePointer(llvm::Value*, llvm::MapVector<llvm::Value*, llvm::Value*, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, llvm::Value*>, 0u>>&, llvm::MapVector<llvm::Value*, bool, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, bool>, 0u>>&)::$_8::operator()(llvm::Value*, std::__1::function<void (llvm::Value*)>) const (/opt/local/libexec/llvm-18/lib/libLLVM.dylib+0x114cbf8)
 #8 0x000000010ac07478 findBasePointer(llvm::Value*, llvm::MapVector<llvm::Value*, llvm::Value*, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, llvm::Value*>, 0u>>&, llvm::MapVector<llvm::Value*, bool, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, bool>, 0u>>&) (/opt/local/libexec/llvm-18/lib/libLLVM.dylib+0x114b478)
 #9 0x000000010ac01030 insertParsePoints(llvm::Function&, llvm::DominatorTree&, llvm::TargetTransformInfo&, llvm::SmallVectorImpl<llvm::CallBase*>&, llvm::MapVector<llvm::Value*, llvm::Value*, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, llvm::Value*>, 0u>>&, llvm::MapVector<llvm::Value*, bool, llvm::DenseMap<llvm::Value*, unsigned int, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, unsigned int>>, llvm::SmallVector<std::__1::pair<llvm::Value*, bool>, 0u>>&) (/opt/local/libexec/llvm-18/lib/libLLVM.dylib+0x1145030)
#10 0x000000010abfff64 llvm::RewriteStatepointsForGC::runOnFunction(llvm::Function&, llvm::DominatorTree&, llvm::TargetTransformInfo&, llvm::TargetLibraryInfo const&) (/opt/local/libexec/llvm-18/lib/libLLVM.dylib+0x1143f64)
#11 0x000000010abfee78 llvm::RewriteStatepointsForGC::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/local/libexec/llvm-18/lib/libLLVM.dylib+0x1142e78)
#12 0x0000000109db009c llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/local/libexec/llvm-18/lib/libLLVM.dylib+0x2f409c)
#13 0x000000010225dea4 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/local/libexec/llvm-18/bin/opt+0x100005ea4)
#14 0x000000010226b7f4 main (/opt/local/libexec/llvm-18/bin/opt+0x1000137f4)
#15 0x0000000184fb90e0 
[1]    86308 segmentation fault  opt -S -passes=rewrite-statepoints-for-gc test.ll
```


This is quite similar to #61917, but I'm not sure if they are the same.

I'm just trying to write a pass that analyzes if heap allocations are necessary and replaces the results with stack allocas. The crash takes place just after the replacement.

</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzsWt1u2zoSfhr6ZhCDomRLvvBFEje7xTZo0AS5DUbSyOYpRWpJqq336RcS7cSynbZpcw6KwEEgW-Rwfj7ON5RMonNyqYnmbHLBJosRtn5l7PxyZY02zqNbu1FuyvX8w4f7a_hC1kmjWXwOUTaOxoLxBePn4erWzlMNUlemE7jG4sKYz3BjDRPZtWBiBlBj8fEWomQcAROZiC_ShInZrpbC1DXqksWbezbl4T9HtwpNpvFwdgtnDTpHjsULS1-t9HTmPHpqjNTenVXGni0L8OT8WKk9XUODJR1aU-pLvSsVriVVUhN8MbIElvBKR0xkXWDLApgQT_bP6BvWjSImBLD0IowGYGJiRQYsXgAqZQoEmTFxCViW1jVYEBNZ9AgIQIFK7VgTTGQyO5QW5xvNO0Mt-X7kxv10MYyjUGjpp1Q_zc8x9JzH4rO33YhDDM0ytNx8eHd--w5cm9fSA0LeLsFSY6wHb2DlfeO60eKKiaul9Ks2HxemZuKqn4XwcdZY8xcVnokr6VxLjokrQF2C1IVqSwK_IigsuhXkW5fGwfxt5yOUbd08-sjH0P_dWLO0WAPaZVuT9p0f8Mv5BUzEHPg3Hv4iPiv4JEEOfRzxOYs7koQvN1Zq33t2ZwPeT0IWvz4Y5y1hzcS0SxCpfZdmfbZdmaZDoUsf1X3KnL5RsYUpykJbuHasHZfr_v6Cf4uSWYL8KUuYiKM9f-M0KY75-6nVt3KpUf0bdanIuk3m_75LaZoUA5fEPoT5JIGB8S5ZXw2RfJIMzMc75rNJPI1RJBs7rbOPukK5C7fh-0Oj0FfG1rv6M55MUxRDE8luhFjwLKUCKqnLC3T00V4s7gf5cI-qpZ6KlztTc43NPRXeWBZf_kj2eOuCtKNrbJ5V0Op-dShD_h0b-r6v9s8M7-tP_G44siSPUg213KB8PoqBE_G7A4W3NSr1iITzZWh-eIjCl-Z7yo-0Bv283dqavhT23Bh1AvoYKEegfQUKR0mR0rCETE4E-0Pm_USwN0mw6R7BZtOkgEOPHx6qVhc-vDM83rP4csvFm-5pql_QT2w8sfHtAP0sG4MoE8lD3HUeqg0vhsHoiSUnlrxloH-KJaE__FRxnACzfmjXZhqyPXfCbyHHxaevty6W071313T_wTOvMjjR-ETjtwz0T9A4ewE_j62KT4-Rlz-sBGIGhdHOv8qDb15lA4JnewRPk_RE8BPB3zbQf-u7ZZ6kQ4rN9igW8ZiD1I6sv0G7YZkbkOxqWx72J3xhaqm7inNniQ5679Auyd9Z1K4ytu6naV9mB7j3daMGGF2iUh3vt5n34mw7kfxE8j8F6L-V5BMeP-07MRFHg30yzKuqmiY7kXwKW263TztuV8b-6zJ02lZ_1E-U_2fqQJD5IHOLdt1JhIeM14MorqbJAKJoDyKiNHsBRANgrk3ZqsPAzzWqtZPuGjUuaZgbmyGvmQWCdkp9F-Jwq6_MOZ_t7j7eoPuea78QyvZF8Q_ER1QJnxUDeHa3IrkQk5JwlyS21R1CN7IhJfVwD_nWW6mXn6jaq43H4wzJfY3Fqtdz_oPU7xfCAylj1MfWN62_kuqIkt_qfiacc2tx3bXuTkyPiWqXUh8USNP4B9_Xue4u2PuP1OX3pO7JykqS3cptF4-Xff58fuRSb-U61nSTPyEcloZkmBjTPK0SqFHq37ASxWk1tLK7i5YlVT7jxGHTPbmI2GQBAJBNY56Bo2VN2mNXfaHCVnn49YMUR4-ahOvdSjqQDv7bSk_gZC0VWvCm35SIZlHaQ956eM9EWoM2HlxrCWQFfkVrQBuOijist-dDwjXI_9U6D96upV52Snt3AaGLAPwKPWBXEf5HrlO4Imw2B3m6sF2vXFNBzqFd96dTLDUKC3K9TUuuVd7BV-lX0J-c2Yx2Y7h7PL7i8TM56IcFd7DyZDcK-uYO6I3vo3Iel7N4hiOaR2kkRBzzNB6t5nmWx1WKSZRRKrKUiygu8orjNONplGTpSM4FFwlPeBKJKJ1E4zzBOOWCqirCsqoESzjVKNW4S5qxsctRf_BmnqVTMRkpzEm5_tiYEJq-Qt_JhGCTxcjO-0TL26VjCVfSefekxUuvaN7lRoj37FjuSA3PrG_jomlGrVXzXz831Efw_wAAAP__GNGkUQ">