[llvm-bugs] [Bug 50765] New: [LSR] Zero factor leads to division by zero/assertion failure

Fri Jun 18 02:17:10 PDT 2021

https://bugs.llvm.org/show_bug.cgi?id=50765

            Bug ID: 50765
           Summary: [LSR] Zero factor leads to division by zero/assertion
                    failure
           Product: new-bugs
           Version: trunk
          Hardware: PC
                OS: Windows NT
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: new bugs
          Assignee: unassignedbugs at nondot.org
          Reporter: max.kazantsev at azul.com
                CC: htmldeveloper at gmail.com, llvm-bugs at lists.llvm.org

Run opt -loop-reduce -S

On the following test:

target datalayout =
"e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128-ni:1-p2:32:8:8:32-ni:2"
target triple = "x86_64-unknown-linux-gnu"

define void @hoge() {
bb:
  %tmp = load i32, i32 addrspace(3)* undef, align 4
  br label %bb1

bb1:                                              ; preds = %bb38, %bb
  %tmp2 = phi i64 [ undef, %bb ], [ %tmp6, %bb38 ]
  %tmp3 = phi i32 [ %tmp, %bb ], [ 1, %bb38 ]
  %tmp4 = add i32 %tmp3, 1
  %tmp5 = call i32 @llvm.smax.i32(i32 %tmp4, i32 74)
  %tmp6 = add nuw nsw i64 %tmp2, 1
  br i1 undef, label %bb7, label %bb38

bb7:                                              ; preds = %bb1
  %tmp8 = trunc i64 %tmp6 to i32
  %tmp9 = sub nsw i32 3, %tmp5
  %tmp10 = mul i32 %tmp9, %tmp8
  br label %bb11

bb11:                                             ; preds = %bb11, %bb7
  %tmp12 = phi i32 [ undef, %bb7 ], [ %tmp17, %bb11 ]
  %tmp13 = phi i64 [ 3, %bb7 ], [ %tmp22, %bb11 ]
  %tmp14 = phi i64 [ undef, %bb7 ], [ %tmp23, %bb11 ]
  %tmp15 = add i32 %tmp12, %tmp10
  %tmp16 = add nuw nsw i64 %tmp13, 1
  %tmp17 = add i32 %tmp15, %tmp10
  %tmp18 = add i32 %tmp17, undef
  %tmp19 = sub i32 %tmp18, undef
  %tmp20 = sext i32 %tmp19 to i64
  %tmp21 = add nsw i64 undef, %tmp20
  %tmp22 = add nuw nsw i64 %tmp13, 2
  %tmp23 = add i64 %tmp14, -2
  %tmp24 = icmp eq i64 %tmp23, 0
  br i1 %tmp24, label %bb25, label %bb11

bb25:                                             ; preds = %bb11
  %tmp26 = trunc i64 %tmp16 to i32
  %tmp27 = icmp ult i32 %tmp26, 52
  %tmp28 = trunc i64 %tmp22 to i32
  %tmp29 = mul i32 %tmp9, %tmp28
  %tmp30 = add i32 undef, %tmp29
  %tmp31 = mul i32 %tmp30, %tmp8
  %tmp32 = add i32 undef, %tmp31
  %tmp33 = add i32 %tmp32, 34
  %tmp34 = trunc i64 %tmp21 to i32
  %tmp35 = add i32 %tmp33, undef
  %tmp36 = sub i32 %tmp35, %tmp34
  %tmp37 = sext i32 %tmp36 to i64
  unreachable

bb38:                                             ; preds = %bb1
  br label %bb1
}

; Function Attrs: nofree nosync nounwind readnone speculatable willreturn
declare i32 @llvm.smax.i32(i32, i32) #0

attributes #0 = { nofree nosync nounwind readnone speculatable willreturn }

The outcome is

opt:
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/Transforms/Scalar/LoopStrengthReduce.cpp:3922:
void {anonymous}::LSRInstance::GenerateICmpZeroScales({anonymous}::LSRUse&,
unsigned int, {anonymous}::Formula): Assertion `Factor != 0 && "Zero factor not
expected!"' failed.
PLEASE submit a bug report to https://bugs.llvm.org/ and include the crash
backtrace.
Stack dump:
0.      Program arguments: /localhome/mkazantsev/work/llvm/build/RA/bin/opt
-loop-reduce -S ./reduced.ll
1.      Running pass 'Function Pass Manager' on module './reduced.ll'.
2.      Running pass 'Loop Pass Manager' on function '@hoge'
3.      Running pass 'Loop Strength Reduction' on basic block '%bb11'
 #0 0x00007f22f3830c6c llvm::sys::PrintStackTrace(llvm::raw_ostream&, int)
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/Support/Unix/Signals.inc:569:0
 #1 0x00007f22f382ed44 llvm::sys::RunSignalHandlers()
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/Support/Signals.cpp:76:0
 #2 0x00007f22f382f4b3 SignalHandler(int)
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/Support/Unix/Signals.inc:397:0
 #3 0x00007f22f298b630 __restore_rt sigaction.c:0:0
 #4 0x00007f22f1d333d7 raise (/lib64/libc.so.6+0x363d7)
 #5 0x00007f22f1d34ac8 abort (/lib64/libc.so.6+0x37ac8)
 #6 0x00007f22f1d2c1a6 __assert_fail_base (/lib64/libc.so.6+0x2f1a6)
 #7 0x00007f22f1d2c252 (/lib64/libc.so.6+0x2f252)
 #8 0x00007f22f487fb9f GenerateICmpZeroScales
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/Transforms/Scalar/LoopStrengthReduce.cpp:3914:0
 #9 0x00007f22f487fb9f (anonymous
namespace)::LSRInstance::GenerateAllReuseFormulae()
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/Transforms/Scalar/LoopStrengthReduce.cpp:4323:0
#10 0x00007f22f4886f7d (anonymous
namespace)::LSRInstance::LSRInstance(llvm::Loop*, llvm::IVUsers&,
llvm::ScalarEvolution&, llvm::DominatorTree&, llvm::LoopInfo&,
llvm::TargetTransformInfo const&, llvm::AssumptionCache&,
llvm::TargetLibraryInfo&, llvm::MemorySSAUpdater*)
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/Transforms/Scalar/LoopStrengthReduce.cpp:5723:0
#11 0x00007f22f488a592 ReduceLoopStrength(llvm::Loop*, llvm::IVUsers&,
llvm::ScalarEvolution&, llvm::DominatorTree&, llvm::LoopInfo&,
llvm::TargetTransformInfo const&, llvm::AssumptionCache&,
llvm::TargetLibraryInfo&, llvm::MemorySSA*)
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/Transforms/Scalar/LoopStrengthReduce.cpp:5944:0
#12 0x00007f22f488d84b (anonymous
namespace)::LoopStrengthReduce::runOnLoop(llvm::Loop*, llvm::LPPassManager&)
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/Transforms/Scalar/LoopStrengthReduce.cpp:5993:0
#13 0x00007f22f4e10b83 llvm::LPPassManager::runOnFunction(llvm::Function&)
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/Analysis/LoopPass.cpp:198:0
#14 0x00007f22f397f3fd llvm::FPPassManager::runOnFunction(llvm::Function&)
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/IR/LegacyPassManager.cpp:1449:0
#15 0x00007f22f397f629
llvm::ilist_node_impl<llvm::ilist_detail::node_options<llvm::Function, true,
false, void> >::getNext()
/localhome/mkazantsev/work/llvm/llvm/llvm/include/llvm/ADT/ilist_node.h:66:0
#16 0x00007f22f397f629
llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::Function, true,
false, void>, false, false>::operator++()
/localhome/mkazantsev/work/llvm/llvm/llvm/include/llvm/ADT/ilist_iterator.h:157:0
#17 0x00007f22f397f629 llvm::FPPassManager::runOnModule(llvm::Module&)
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/IR/LegacyPassManager.cpp:1484:0
#18 0x00007f22f39802d8 runOnModule
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/IR/LegacyPassManager.cpp:1561:0
#19 0x00007f22f39802d8 llvm::legacy::PassManagerImpl::run(llvm::Module&)
/localhome/mkazantsev/work/llvm/llvm/llvm/lib/IR/LegacyPassManager.cpp:542:0
#20 0x000000000041d3a1 main
/localhome/mkazantsev/work/llvm/llvm/llvm/tools/opt/opt.cpp:1103:0
#21 0x00007f22f1d1f555 __libc_start_main (/lib64/libc.so.6+0x22555)
#22 0x000000000041e091 _start
(/localhome/mkazantsev/work/llvm/build/RA/bin/opt+0x41e091)
Aborted (core dumped)

I just added this assert recently, without it the same test has UB caused by
division by zero factor.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20210618/da525c29/attachment-0001.html>