[llvm-bugs] [Bug 34345] New: MemorySSA crashes when using ADCE preserved dominators. Assertion `dominates(MP, U) && "Memory PHI does not dominate it's uses"' failed.

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=34345

            Bug ID: 34345
           Summary: MemorySSA crashes when using ADCE preserved
                    dominators. Assertion `dominates(MP, U) && "Memory PHI
                    does not dominate it's uses"' failed.
           Product: new-bugs
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: new bugs
          Assignee: unassignedbugs at nondot.org
          Reporter: david.stenberg at ericsson.com
                CC: llvm-bugs at lists.llvm.org

Created attachment 19052
  --> https://bugs.llvm.org/attachment.cgi?id=19052&action=edit
Reduced reproducer.

When running the following command-line using a debug-built opt from trunk
(r311862):

    opt -loops -adce -early-cse-memssa -o /dev/null
bugpoint-reduced-simplified.ll

opt crashes with the following failed assertion:

    opt: ../lib/Analysis/MemorySSA.cpp:1707: void
llvm::MemorySSA::verifyDomination(llvm::Function &) const: Assertion
`dominates(MP, U) && "Memory PHI does not dominate it's uses"' failed.

    #0  0x00007ffff6d7a875 in raise () from /lib64/libc.so.6
    #1  0x00007ffff6d7be51 in abort () from /lib64/libc.so.6
    #2  0x00007ffff6d73740 in __assert_fail () from /lib64/libc.so.6
    #3  0x0000000000fef1ce in llvm::MemorySSA::verifyDomination
(this=0x3e50520, F=...) at ../lib/Analysis/MemorySSA.cpp:1707
    #4  0x0000000000feee3e in llvm::MemorySSA::verifyMemorySSA (this=0x3e50520)
at ../lib/Analysis/MemorySSA.cpp:1631
    #5  0x0000000000ff0904 in llvm::MemorySSAWrapperPass::verifyAnalysis
(this=0x3e4ba60) at ../lib/Analysis/MemorySSA.cpp:1972
    #6  0x0000000001822d37 in llvm::PMDataManager::verifyPreservedAnalysis
(this=0x3e4b880, P=0x3e49510) at ../lib/IR/LegacyPassManager.cpp:863
    #7  0x0000000001825b87 in llvm::FPPassManager::runOnFunction
(this=0x3e4b860, F=...) at ../lib/IR/LegacyPassManager.cpp:1523
    #8  0x0000000001825da5 in llvm::FPPassManager::runOnModule (this=0x3e4b860,
M=...) at ../lib/IR/LegacyPassManager.cpp:1535
    #9  0x000000000182658e in (anonymous namespace)::MPPassManager::runOnModule
(this=0x3e49660, M=...) at ../lib/IR/LegacyPassManager.cpp:1591
    #10 0x000000000182608b in llvm::legacy::PassManagerImpl::run
(this=0x3e4b370, M=...) at ../lib/IR/LegacyPassManager.cpp:1694
    #11 0x0000000001826ad1 in llvm::legacy::PassManager::run
(this=0x7fffffffc460, M=...) at ../lib/IR/LegacyPassManager.cpp:1725
    #12 0x00000000009a9115 in main (argc=9, argv=0x7fffffffcbb8) at
../tools/opt/opt.cpp:757

The pass crashes as it asserts that `for.cond32':

  for.cond32:                                       ; preds = %for.end73,
%if.then31
    br i1 true, label %for.body33, label %for.end74

dominates `if.end79':

  if.end79:                                         ; preds = %if.end78,
%for.end74
    br label %for.inc

which is a BB with an unreachable predecessor, if.end78:

  for.end74:                                        ; preds = %for.cond32       
    br label %if.end79

  if.end78:                                         ; No predecessors!          
    br label %if.end79

We started seeing the crash with the introduction of "Teach ADCE to preserve
dominators" (r311467 and earlier versions).

With the preserved dominator tree from ADCE, for.cond32 is not considered a
dominator of if.end78, whereas dominatedBySlowTreeWalk() considers it that.
This can be seen with EXPENSIVE_CHECKS enabled:

  opt: ../include/llvm/Support/GenericDomTree.h:436: bool
llvm::DominatorTreeBase<llvm::BasicBlock, false>::dominates(const
DomTreeNodeBase<NodeT> *, const DomTreeNodeBase<NodeT> *) const [NodeT =
llvm::BasicBlock, IsPostDom = false]: Assertion `(!DFSInfoValid ||
(dominatedBySlowTreeWalk(A, B) == B->DominatedBy(A))) && "Tree walk disagrees
with dfs numbers!"' failed.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20170828/8dac60b7/attachment-0001.html>