[llvm-bugs] [Bug 24517] New: Running -jump-threading twice crashes opt in ValueHandleBase::ValueIsDeleted

[via llvm-bugs]

https://llvm.org/bugs/show_bug.cgi?id=24517

            Bug ID: 24517
           Summary: Running -jump-threading twice crashes opt in
                    ValueHandleBase::ValueIsDeleted
           Product: tools
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: opt
          Assignee: unassignedbugs at nondot.org
          Reporter: mikael.holmen at ericsson.com
                CC: llvm-bugs at lists.llvm.org
    Classification: Unclassified

Created attachment 14751
  --> https://llvm.org/bugs/attachment.cgi?id=14751&action=edit
Reproducer

Running

build-all/bin/opt -S ./bugpoint-reduced-simplified.ll -jump-threading
-jump-threading

on the attached bugpoint-reduced ll-file ends with

While deleting: label %bb1
An asserting value handle still pointed to this value!
UNREACHABLE executed at ../lib/IR/Value.cpp:686!

It's on the second invocation of jump-threading that it breaks, when it calls
llvm::removeUnreachableBlocks:

0  opt             0x0000000001635faa
llvm::sys::PrintStackTrace(llvm::raw_ostream&) + 42
1  opt             0x0000000001635606 llvm::sys::RunSignalHandlers() + 54
2  opt             0x00000000016378fa
3  libpthread.so.0 0x00007f8c62e30340
4  libc.so.6       0x00007f8c62058cc9 gsignal + 57
5  libc.so.6       0x00007f8c6205c0d8 abort + 328
6  opt             0x00000000015f68fd llvm::llvm_unreachable_internal(char
const*, char const*, unsigned int) + 461
7  opt             0x00000000012b8e2b
llvm::ValueHandleBase::ValueIsDeleted(llvm::Value*) + 1051
8  opt             0x00000000012b879b llvm::Value::~Value() + 43
9  opt             0x000000000117abb9 llvm::BasicBlock::~BasicBlock() + 9
10 opt             0x000000000167281c
llvm::removeUnreachableBlocks(llvm::Function&) + 2940
11 opt             0x00000000014c1667
12 opt             0x0000000001288744
llvm::FPPassManager::runOnFunction(llvm::Function&) + 516
13 opt             0x000000000128898b
llvm::FPPassManager::runOnModule(llvm::Module&) + 43
14 opt             0x0000000001288e67
llvm::legacy::PassManagerImpl::run(llvm::Module&) + 903
15 opt             0x0000000000605864 main + 8148
16 libc.so.6       0x00007f8c62043ec5 __libc_start_main + 245
17 opt             0x00000000005f6df2

The code looks like this when jump-threading is invoked the second time:

*** IR Dump Before Jump Threading ***
define void @fn1() {
.split.us:
  br label %bb2.us.us

bb2.us.us:                                        ; preds = %bb2.us.us,
%.split.us
  br label %bb2.us.us

bb1.us:                                           ; preds = %bb1.us
  br label %bb1.us

bb2.us4:                                          ; preds = %bb2.us4
  br label %bb2.us4

bb2:                                              ; preds = %bb1
  %_tmp3 = icmp slt i16 %_tmp18, 2
  br i1 %_tmp3, label %bb1, label %bb1

bb1:                                              ; preds = %bb2, %bb2
  %_tmp18 = load i16, i16* @c
  %_tmp20 = icmp ne i16 %_tmp18, 0
  br i1 %_tmp20, label %bb2, label %bb6

bb6:                                              ; preds = %bb1
  ret void
}

And when it tries to delete bb1 it crashes.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20150820/702b4ac4/attachment.html>