<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/123835>123835</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [BOLT] `llvm-bolt` sporadic assertion failure in `BinaryBasicBlock::isCold()` during shrink wrapping with `-O3`
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            BOLT
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          ms178
      </td>
    </tr>
</table>

<pre>
    **Description:**

While trying to pinpoint another bug, I saw one assertion failure on a Clang-20git assertion build. `llvm-bolt` crashes with an assertion failure when optimizing a binary (dbus-broker in this case) with `-O3` in an assertion build of LLVM. This however didn't reproduce when using `-O2`. The crash occurs during the shrink-wrapping optimization pass.

**Environment:**

* **LLVM Version:**  20.0.0git (e4f03b158c97098e1835cc1f00d0175398974f98) plus [these BOLT-patches](https://github.com/ms178/archpkgbuilds/blob/main/toolchain-experimental/llvm-git/fixes.patch) on top.
*   **Operating System:** CachyOS
*   **Target Architecture:** Intel Raptor Lake
*   **Build Type:** Assertion build (compiled with assertions enabled)
*   **Reproducibility:** Not consistent. While it occured the first time, I can't reproduce it always.

```
export CC=clang
export CXX=clang++
export CC_LD=lld
export CXX_LD=lld
export AR=llvm-ar
export NM=llvm-nm
export STRIP=llvm-strip
export OBJCOPY=llvm-objcopy
export OBJDUMP=llvm-objdump
export READELF=llvm-readelf
export RANLIB=llvm-ranlib
export HOSTCC=clang
export HOSTCXX=clang++
export HOSTAR=llvm-ar
export CPPFLAGS="-D_FORTIFY_SOURCE=0"
export CFLAGS="-O3 -march=native -mtune=native -falign-functions=32 -fno-semantic-interposition -fcf-protection=none -mharden-sls=none -w"
export CXXFLAGS="${CFLAGS} -Wp,-U_GLIBCXX_ASSERTIONS"
export LDFLAGS="-Wl,-O3,-Bsymbolic-functions,--as-needed -fcf-protection=none -mharden-sls=none -Wl,--hash-style=gnu -Wl,--undefined-version"
export CCLDFLAGS="$LDFLAGS"
export CXXLDFLAGS="$LDFLAGS"
export ASFLAGS="-D__AVX__=1 -D__AVX2__=1 -D__FMA__=1"
```

**Steps to Reproduce:**

1.  Compile `dbus-broker` (with my optimized [PKGBUILD](https://github.com/ms178/archpkgbuilds/blob/main/packages/dbus-broker-git/PKGBUILD)) with `-O3` and the flags from above using an assertion build of Clang.
2. Generate PGO data (e.g., `perf.fdata`). The neccessary steps and flags are integrated in the PKGBUILD I provided.
3.  Run `llvm-bolt` on the linked binary with the following command line (adjust paths as needed):

```bash
llvm-bolt "$srcdir/build/src/dbus-broker" --data "$srcdir/bolt_profile/perf.fdata" --dyno-stats --lite=false --cu-processing-batch-size=64 --eliminate-unreachable --frame-opt=all --icf=all --jump-tables=aggressive --min-branch-clusters --stoke --sctc-mode=always --plt=all --hot-data --hugify --frame-opt-rm-stores --peepholes=all --infer-stale-profile=1 --x86-strip-redundant-address-size --indirect-call-promotion=all --reg-reassign --use-aggr-reg-reassign --reorder-blocks=ext-tsp --reorder-functions=cdsort --split-all-cold --split-eh --split-functions --split-strategy=cdsplit -o "$srcdir/build/bolt/dbus-broker.bolt"
```

**Expected Result:**

`llvm-bolt` should successfully optimize the binary without crashing.

**Actual Result:**

`llvm-bolt` crashes with the following assertion failure:

```
llvm-bolt: /home/marcus/toolchain/llvm/llvm-project/bolt/include/bolt/Core/BinaryBasicBlock.h:677: bool llvm::bolt::BinaryBasicBlock::isCold() const: Assertion `Fragment.get() < 2 && "Function is split into more than two (hot/cold)-fragments"' failed.
```

**Stack Trace:**

```
#0 0x00005d009882d785 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) Signals.cpp:0:0
#1 0x00005d009882db7c SignalHandler(int) Signals.cpp:0:0
#2 0x000078c0ae445f50 (/usr/lib/libc.so.6+0x45f50)
#3 0x000078c0ae4b57ed pthread_kill (/usr/lib/libc.so.6+0xb57ed)
#4 0x000078c0ae445e92 raise (/usr/lib/libc.so.6+0x45e92)
#5 0x000078c0ae4244a3 abort (/usr/lib/libc.so.6+0x244a3)
#6 0x000078c0ae4243d8 (/usr/lib/libc.so.6+0x243d8)
#7 0x000078c0ae43bde2 (/usr/lib/libc.so.6+0x3bde2)
#8 0x00005d0099199b65 llvm::bolt::ShrinkWrapping::perform(bool) (/home/marcus/toolchain/llvm/stage2-prof-use-lto/bin/llvm-bolt+0x4599b65)
#9 0x00005d00990d0dd2 std::_Function_handler<void (llvm::bolt::BinaryFunction&, unsigned short), llvm::bolt::FrameOptimizerPass::performShrinkWrapping(llvm::bolt::RegAnalysis const&, llvm::bolt::FrameAnalysis const&, llvm::bolt::BinaryContext&)::$_2>::_M_invoke(std::_Any_data const&, llvm::bolt::BinaryFunction&, unsigned short&&) FrameOptimizer.cpp:0:0
#10 0x00005d009928c3d5 llvm::bolt::ParallelUtilities::runOnEachFunctionWithUniqueAllocId(llvm::bolt::BinaryContext&, llvm::bolt::ParallelUtilities::SchedulingPolicy, std::function<void (llvm::bolt::BinaryFunction&, unsigned short)>, std::function<bool (llvm::bolt::BinaryFunction const&)>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, bool, unsigned int)::$_0::operator()(std::_Rb_tree_iterator<std::pair<unsigned long const, llvm::bolt::BinaryFunction>>, std::_Rb_tree_iterator<std::pair<unsigned long const, llvm::bolt::BinaryFunction>>, unsigned short) const ParallelUtilities.cpp:0:0
#11 0x00005d0098984258 std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()>>>, void>>::_M_invoke(std::_Any_data const&) DWARFRewriter.cpp:0:0
#12 0x00005d00988bee01 std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) JITLinkLinker.cpp:0:0
#13 0x000078c0ae4b8ed7 (/usr/lib/libc.so.6+0xb8ed7)
#14 0x000078c0ae4b8f59 __pthread_once (/usr/lib/libc.so.6+0xb8f59)
#15 0x00005d0097798260 void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) DWARFRewriter.cpp:0:0
#16 0x00005d00977981b1 std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) DWARFRewriter.cpp:0:0
#17 0x00005d009779813a std::__future_base::_Deferred_state<std::thread::_Invoker<std::tuple<std::function<void ()>>>, void>::_M_complete_async() DWARFRewriter.cpp:0:0
#18 0x00005d009778fb0d std::__future_base::_State_baseV2::wait() DWARFRewriter.cpp:0:0
#19 0x00005d009928d4d7 llvm::StdThreadPool::processTasks(llvm::ThreadPoolTaskGroup*) ThreadPool.cpp:0:0
#20 0x00005d009928f5f4 void* llvm::thread::ThreadProxy<std::tuple<llvm::StdThreadPool::grow(int)::$_0>>(void*) ThreadPool.cpp:0:0
#21 0x000078c0ae4b37dd (/usr/lib/libc.so.6+0xb37dd)
#22 0x000078c0ae55f018 (/usr/lib/libc.so.6+0x15f018)
```

**Additional Information:**

*   The crash does not occur with `-O2` in an assertion build.
*   The crash does not occur every time with `-O3`.
*   The issue seems to be related to function splitting and shrink wrapping.
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJzcWl9z4yqW_zTKC4VLRv4jP-TBseOezKZvUkn6ds-TC8GRxQ0CLaAknk-_BZJtyXHa6Z3ZrXunKt1lweFwzu_8BYlaKzYK4DIaX0Xj5QWtXaHNZWmH0_Qi03x7GZF5ROZLsMyIygmtomTejEWx__teCAnIma1QG-Q0qoSqtFAOUaVdAQZl9SYiC3SDLH1FWgGi1oLxnFBOhawNIK0QRQtJ1QaTeCNchySrheQDFE1iKV9KnGnpokmMmKG2AItehSsQVSd4vhagkK6cKMU_vWgUZUJRs0URSXlWW5wZ_QwGCYVcISxi1EJEZg3HaBLju8RvJFSffZAH6Rzd3v7-dYCe_NJCv8ILGMQFVxGZOmSgMprXrJWitl6AwJNEk9ivgkYDpBmrjUW8NgG-ApAtjFDP-NXQqvJjrQo07F5RawcN7o0NrtWLMFqVoNyRXSIyR82zlxT9DsZ2jYcQiQfxIKAdkRRGeZxkw3HKZtN4lsIwTcaMDfM45vFwOk5m6Ww6ymepR6iStUXR-MoVYAFd3d0-4Yo6VoCNxsuIpIVzlQ0brSKy2ghX1NmA6TIiq-BXEVlRw4rqeRPAtBFZZVJnfpoKFZGV01qyggqF4a0CI7x2VEZkFVxgI1xEVrl4AzsI-3qZtEJOV4NWb9RqfleBoc6j-Li1DsqD9gvKiu3d4xH9EzUbcGhuWCEcMFcbOCy5UQ4keqCV0wbd0mc4WnwVPONpW3XWzI_8JiIp02UlJPDWdXcEFoGimQQekdkR44fWm0QmpHDbA_fftENMKyusA-UGqAlF4RqvAh78KRfGOuRECU0UMnrsoz7e5Cvd7j1rErd_8RzeKm0cWiyiZMl8gHbGfvzYD5Ir_9chX98uo2QpJe_RnxidP4SRlxJTcxj97etuVJWH0cenh5v73YR1RlSHuburvy_u7v-xm9XZH0xX29788tvX-848r8vO-ofr-fL6drWbN0A5yLwzP__t9uZqP02VFNlh9m93j0-nMArjH-Pkp08DsLi_X93OvzxGyTIiBC_Xq7uHp5vVP9aPd98eFtdRsowjQjr0Xeq7BOHSh1iULBV14gUQLl2toPOcUyk2Cue1YsH9omSZEIRzpbGFkionGBbKgam0FcGDcc5yXBntAyNkkqXy2RyXBTUcFLbS7sde-8L9-NERLyKjaHrVCjxdIvy9isgCf1t_ub258k4yf3y8fni6ufvtscfldtnV8bv0i-4S__-V3ZaZloJ11CELjKnFCoAD_yXZG864oLbA1m2lR22j6v1ErTjkQgHHL21O7em66MkZkdHu-QiRz5DNH_tOsJ7__mO9jpLlELVPpPO4-jpvnhoe3TDe14tHB5X1ZXqXVOCobAwHCC2aFOUrVqdS-moYkTSkrXK7q0vAfSm4_68vV99ubpf_pgJQUfZMN-AnOgK0mX-_F5mdqNdUtWlP0o1FudElopl-gbYIn67lofXw2Y8M0BdQvmgAuv9yhzh1NJTHwWbg02c0iSsw-SD3Ex5aMmuquQLGwFrfX9gAsZejkYEaQD6SNp4rb_oNQDst0A2qjH4RHLgXIBkg9FCrd_2OblZJoZ6B7zqZoHpQVkupX71-TJel31oKBV5wyv-orUMVdYVF1KImHjx0yfwo22fUFlE832-LGr-0hnFhvIk8WhFZWcP6dokIQRi3UPWXaOnWldG5kODNeoCuWbL12cZRZxHGUjgfaTmVFhDGrPbx6jEVaoMzX-exFf_0JJMRwhikKIWiDnCtDFBW-OKJMM4NLQHrykXJkkqJMBYs3__-oy4r7Dypj3e62Ri_gc-HuBQKZ4YqVmAma-vAeKms089-1jLHcKk5BFa-WCKMK3nYpdCugQDjot6IfNuVBRtfr7SBsAqgKnQrQSOhysF4ICTgHVohqPFbOmkKHTbAa8Wpcphy7qUOaITFXBhgDjMqpV9e6jbFNcwNbHw1C30-wri2gL3ex-MGtOFgcCY1e_aiwZvDzladqW6tYNz6BIWxraRw2G_NtOT7ASj2P_fL9iPW-VDYbBs-fghh_ZG7hQjo-dugGfowx12_VcB8qD2AreW7vvgosmyha8mRrUMA57WUh9wWgqsTbLp2Td8umnSx33LOXE3l5zbsHV360fvuFPM-SrsRGiW-xV8V2vd2K1_xa9ttn9uOedc4V0b_AcwdMBWKyZrDYWChjX-6ChpfUSvYlXeHQREl88l06vfLtJYocE3mUTJvxYiS-fGiZlTYhfZmDAcH36sGoQ9tcTSJV4ZufIc_2IBrCaNkgQiKyCQiE-8Xq9aFkLCo8RehnEalNt5EVCH36v0nLbTXgoUdZz78AmMbPGsaMG2y7AelkbJn9GTou5rYIydJjOK3OI7jMY_jWZoSPk3HHUjs1jY_7o1QLnBtmJL0QGTo61pbZ4CWQc2F18ir_ig2iko7YFUVJfM4_Au7Do93zaaspf4bVVz6PJyeY0JaJtOUxRRGo3E-DkU9Iqva-qjzXW34nw2sHkwichW_BardsSRJ-iyy8RQ4qlzhO-b1s5DyLL-wZM9vdCwSzAgyVFj4hGAwI3tG4z4jMhrRxNd-484yCrR7RpNjRglPP8Ei4emexbTPIsk4kLMsAtWeRdq192w4m2WT8cnAewwXBt_b-4JmzFdabcqIpD5eQ0iFzT-RKqyjGyChDoViIZ32CWJP0mSeBv4g1F7iWU_imMecE2Qdb0Ra74J4XbTumixetAhn4o_zyW5RGyS1CtdV3Gdt40IHuDgJysqX3rs2jZt7am0PmCPMTkvwAJu5onJrhW1TVyPEh_t9mrrRbaGVg7eGbtZMRGS0JlFy3UL2dS3Ui372qeOA41xt16HT-NwuZxCcNNujPmAn0k8v681IyhJ-2h_vqaFSgvzmhBROQIu8qdWduqas2An0XbjimxL_XcNcSs1u-E8doQvWaXU_2PeRFcBrKdTm3h8Rt375Hsxdb_Lv8cXk-iPmoWp-innHqu8Yrtfs7W04bBn4Srv2zaEP-gUrqOkR-4G1M1Q4u5s-Ykc97NRp05lvSJqk0VGxqSsHH42bnzrcr2nTlO2elz5ka2cA1sK1JMliP1lR4Z_33KUOJ5eg96dceS_o__d-72zesEHvfO9EAPUL-CwdkXH68_S4n6xDmKwr1xtdr_Pa1QbWGbWwgyF0oM1I33V-TtuMLEGC81tfo51Jz_B4ovZ5bcG5f03gNv7eO_yvSd1b3LQkLc1NyKM9aVxd-XPW4mfJoA3Cvf13Qv5yhp6h5ff5w-oBXo330BPuQfr9XQYQD3-OxKOjrhn4nezF4dqboytOR60_gUN5HOeHHDP30Pz95ulWqGf_7yQ0xy1nCnx6vsv0VPveZDg65pGPZ2i93jWuWrHz_WZYdGA57lpsOp2lZBIHD-kkYSpl4N3xqV-0aYPRX8qgZ_n2tGxW_1W08wMHU3jTrnNJN21P8K_YuO3E_sMtPWmR-nPruJNyr-nkk1l8cpwThtn_JotbcGvTVMY_tTvsEDoPzPQdMAn9uQxLyMEY4GvrEepV7v_Lyt5agOmy8hqvqd0q1t5LnVMy7SuZ5lnMf9X6r1S4T243OzqS8RGfdtrZR8efAlL33kZNJ9xcqfuuzfaOIwdCP_fF6Lpqi_Nh5sR10vGhMB_nowZKMu9I0jVYy8_ot-0pm_1U_I3Rr_tbrt5ppDFj2m59Vu7hUTeQTDk_X_491b78k_5d2nicx8Pz10TDQNYyOXULOec8vG6lEt2oXJuSnvjmpvk64PAVCddgkdLti__OKzHy4Scsg_Ns4AXMNnw5cPSSrb9WWFsDsgBleLGYATIgw6sup9Eu8pprW9e8guPtRy5o95HL4IJfJnyWzOgFXA6nyXQ0S6fp8KK4nMZJMk5jRkecQT4aT4FO49mEUjqZpoTChbgkMRnHQzIkJEni4SDlMJzybASTLM0YHUejGEoq5MB71kCbzUUQ-HJIkjQZX0iagbTh8ydCru5unyJCovHywlw2l131xkajWArr7IGDE06GT6bCgvHy3es6W2lDuWAnvksS4dL7_G25Z9N-FnSE1pE1LmojL3_yyvX0K4AAgo3IqsXh5ZL8TwAAAP__SMnU0Q">