<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Issue</th>
<td>
<a href=https://github.com/llvm/llvm-project/issues/153090>153090</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>
Segfault during loop optimization
</td>
</tr>
<tr>
<th>Labels</th>
<td>
new issue
</td>
</tr>
<tr>
<th>Assignees</th>
<td>
</td>
</tr>
<tr>
<th>Reporter</th>
<td>
sesse
</td>
</tr>
</table>
<pre>
Reduced from a much larger test case:
```
kos:~/dev/testa> cat test.cc
struct a {
int operator[](long);
};
void f() {
for (unsigned h = 0;;)
for (; h < 4; ++h)
for (unsigned i = h; i; ++i)
for (unsigned j = i; j; ++j)
for (unsigned k = j; k; ++k)
for (unsigned l = k; l; ++l)
for (unsigned m = l; m; ++m)
for (unsigned n = m; n; ++n)
for (unsigned o = n; o < 4; ++o)
for (unsigned r = o; r < 4; ++r) {
a p;
for (unsigned q = r; q < 4; ++q)
for (long t = p[q]; t; t &= 1)
;
}
}
kos:~/dev/testa> clang++-22 -O2 -c test.cc
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0. Program arguments: clang++-22 -O2 -c test.cc
1. <eof> parser at end of file
2. Optimizer
3. Running pass "require<globals-aa>,function(invalidate<aa>),require<profile-summary>,cgscc(devirt<4>(inline,function-attrs<skip-non-recursive-function-attrs>,openmp-opt-cgscc,function<eager-inv;no-rerun>(sroa<modify-cfg>,early-cse<memssa>,speculative-execution<only-if-divergent-target>,jump-threading,correlated-propagation,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm<no-allowspeculation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allowspeculation>,simple-loop-unswitch<no-nontrivial;trivial>),simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-unroll-full),sroa<modify-cfg>,vector-combine,mldst-motion<no-split-footer-bb>,gvn<>,sccp,bdce,instcombine<max-iterations=1;no-verify-fixpoint>,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm<allowspeculation>),coro-elide,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>),function-attrs,function(require<should-not-run-function-passes>),coro-split,coro-annotation-elide)),function(invalidate<should-not-run-function-passes>),cgscc(devirt<4>())" on module "test.cc"
4. Running pass "cgscc(devirt<4>(inline,function-attrs<skip-non-recursive-function-attrs>,openmp-opt-cgscc,function<eager-inv;no-rerun>(sroa<modify-cfg>,early-cse<memssa>,speculative-execution<only-if-divergent-target>,jump-threading,correlated-propagation,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm<no-allowspeculation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allowspeculation>,simple-loop-unswitch<no-nontrivial;trivial>),simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-unroll-full),sroa<modify-cfg>,vector-combine,mldst-motion<no-split-footer-bb>,gvn<>,sccp,bdce,instcombine<max-iterations=1;no-verify-fixpoint>,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm<allowspeculation>),coro-elide,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>),function-attrs,function(require<should-not-run-function-passes>),coro-split,coro-annotation-elide))" on module "test.cc"
5. Running pass "loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-unroll-full)" on function "_Z1fv"
#0 0x00007fc2e0a2d35a llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm-22/bin/../lib/libLLVM.so.22.0+0x462d35a)
#1 0x00007fc2e0a2ab57 llvm::sys::RunSignalHandlers() (/usr/lib/llvm-22/bin/../lib/libLLVM.so.22.0+0x462ab57)
#2 0x00007fc2e0963a24 (/usr/lib/llvm-22/bin/../lib/libLLVM.so.22.0+0x4563a24)
#3 0x00007fc2dbe49df0 (/lib/x86_64-linux-gnu/libc.so.6+0x3fdf0)
#4 0x00007fc2dce78f89 (/usr/lib/llvm-22/bin/../lib/libLLVM.so.22.0+0xa78f89)
clang++-22: error: clang frontend command failed with exit code 139 (use -v to see invocation)
Debian clang version 22.0.0 (++20250731080150+be449d6b6587-1~exp1)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/lib/llvm-22/bin
clang++-22: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang++-22: note: diagnostic msg: /tmp/test-801b55.cpp
clang++-22: note: diagnostic msg: /tmp/test-801b55.sh
clang++-22: note: diagnostic msg:
********************
```
Does not reproduce on Clang 18, but reproduces on Clang 20. The original reproduced on Clang 19 with a stack smash, but the reduced version does not for me.
[files.zip](https://github.com/user-attachments/files/21723491/files.zip)
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJzsWltv2zgW_jXMC0FDpuzYfvCD7cQzBbKbos3uAvtSUOSRxJoiVZJyknmY3744lHzJpZ3ZafeCQQqjlcnzfefwXMhT0SIEXVmAJZmuyfTqQnSxdn4ZIAS4KJx6XH4A1UlQtPSuoYI2naypEb4CTyOESKUIQPIVydLnMhs-2WrnAslXvxK-VbAnfIvSguTXVIqYoCMpKclWIfpORiooma1JtqJU20hdC15E53uzCJ8bZyvCFyRHGTK76h_2TitaEj4nfHHEl85TwuedTUtTtKYkv6IZIvI1cqDQUYzk6ySxoRN8JHxN-Lo-ib3k04mvRml9guhzyEvQ5wRK8p9PoM9PQS9huwRLiN0JtnsOewk0CZgw5gQ0L4EvoU2CJlRzgjavQV-CbQInnD2B7evgl3CX4AnpngfFfY3kJY1PNA6x_jmNP8sVQds-kV4jfUn7JdF65PrynPbLYN2AwXylMcm3ZLr-glmcr2lMf1HCL3Fm_PUV9X8G4zDf-6z_VlkZgSWCtjDOKbvllMlDoZFs9f7mevXxmoauaDSWW9FV1EPrfKTR0TrGFokJ3xK-rXSsu2IkXUP41pj94R_WevcZZCR8q0PoIBC-pcIqqq00nQIaa6DSi1DTQshd9EIC4Rvaemi9k7irKBpc5_thRIoQnNQiYtQ6S4P0uo0jkq0-RiF3VHVN228v2Yhki_feVV40VPiqa8BGNPk3Vz5GJMk34Ep0VCt8AE9FpGAVdSUttQGSrTiK3bZRN_oX8CRb5TjwobNW24q2IgRKOPfwpdMeSL6pjCuECUyg-wnflJ2VUTtL-FzbvTBaiYhyw_yC8M0J3HqHalnomkb4x55BVkFKwucK9tpHkm8maXyurdEWzlQwEaMPJN-EnW6ZdZZ5kJ0Peg_suQwSuxZs0zLXRjboOFmbb0BU4Jm2e5KvrWMefGd7xcE7QfJN45QuH5ksq54OhDePTOLGv2mgCWHwQGhBdkZENAMeQHaDAmfNI9MlU3oPvgIbWcQTJPaoz13Tslh7EEpjHDfSeQ8GUwLzrRWV6N26CbppjS4fkyGbwtkuMG1DTOhQO6NIfjXuV1E6fy-8YuFeR1kz6awi-Xr45oWtgEXHtMT0QvlhJjpmnNt1OLoDaPEbFgaK1E6HyKRrGmeT3ifjxgkVWIjOQ2D3OvY6WSk6E3FdvRZtd88ZDl4DVhgnd2loWGhPUXhhZT0QHIU723pQWkZRGBjijJTSNQVmS75pxAPTEQ9S7Ww4uWYPHrlL_dA6bYcoiKryEFIGnbPwjdGFFMYEFmqv7e7ei5bwTRTa4DAY3bxF5rcj4-G40aUMtyF6oW1k6EBtDxmOa2KpoPAIcW1vyqDzMH_ubIyPbEi-sY4JY9z9sQZdX8M9xLvYb0Y1CAWeqa41Wg5SaD3u0MIDBoeZ6AZoT_06b7ICUhRYZ_sg9XZYZ6PXey2whzg-DVvgW6b852oY13lMHKXx9N5oq_bCB9y1H6IX7LWwMTzc8DDvk0WBgfN87Kx3xrCyM2aI4evHwh5kdJ6dto7GqBBZ44ZjIC3d6MhK5yJ4VhQ9rtrj7JBVUuL2UqjUIXyHL37_qSJ6XQ00sn10bSR8o0IacXtgosMUszo-r85v1MaiV-ewuBX8j5P-ezP-_zbdFy8boidN2KnZCrXrjGLWReY7e-qQhrR_ErKUoYcvwlrcOFF2COXiqd7nvd7v1fSVRu_Az6mztHGqM4A956GV5Zxkq8lrXelb5_jWOb51jn_KyLx1jm-d41vn-NY5vnWOf4bO8Vud3fS1zu6_VJnJrsPyUO-nf47LfW8X4XlGs4csy7JZKTlkgqt8Kmh6MZyvSL4Kj6F_eO-1jenN7V3_7nd-EvLi_pML0YNoCL8kfEMxHnyRbmH4tgue8K3RxeFdM-eEbwttCd-ORqcpXdzc_P0vo-BGnI8ywtfZw-QyGdS_TSc8Hz-zVhTT2WvWfujsR11ZYX4WVhlAj85_lEGo82gQf2LQ4jIXfPIDtEwT0VFLfqZFFTBZqDIbtPQkD_PLT5cTZrTtHlhlu35CIullYsxLVWZHvsk5n4TZvJz_AN-IxNMrefrmnuQrCt47f3ypT0vvbASrKG4jwipaCm1AUdxvKDzoSKVTQMd5MqwLQNmeRkcDANV274ZGJSm7gkILOxDvwQfMdDRrNHgJzeAZn2azfJzNs_EUDS5gMlmoy-JyOp-x8a_w0A63NnfDf0RWdHBrK888m63u0gmCtQ4GpVoX9APJVu9siNj-qiudFvpNb77mIuuwH1tRpUVlXYha0iZUiQrD9h2fdIc73BOt7u5Wm5_p3c_XdHt7c3P7j3d__Ylu391cf6R3t2l4_bef6Ifr97cf7voLmvevXfLMAxbUVy96jgIeqMFogaIi9nz_1sr5NjbtcB3G5tm4mE5Hsm1_BE2o_0AYvj8SZ1fpmLwOAqqkycmqk4Ab9ibl8niOm2nRnU2G0yzPRvSuBuq8rrQV5iSkzigWfUkJGtK1W2hEqA-ssQbqh58BHOpGHewpnacNjIY1T9elNhBGv-i2v7f_xr1iF8Dj6Stk3V_l8W0CE77l4xnPJ4vxYSjx8cWFWuZqkS_EBSzHs-lkMZnnk_yiXmY8H08W-UTMylmZT6ezclKOJQepJguYTucXepkKez4e83G-yPJRMZ6NoYSZmHE-g2xKJhk0QpsR1t_I-eoiXXAux9M8W2QXRhRgQvqVBOcW7mmaxeNxenXhl6loi64KZJIZHWI40UQdDSw_QpUaI6o6j6c7nsHU9XeNaYu66LxZ_vFL2MHM_ZL_KwAA__8vfCdJ">