[LLVMdev] Function inline pass core dump when removing a function

[陈晓宇]

Guys,

In this case, I wanted to hack globalopt pass to require ScalarEvolution
analysis. It seems ScalarEvolution is not released after globalopt pass,
and it will hold a reference to the basicblocks. Later when the function is
removed(by inline pass), coredump happened:
opt test.bc -mem2reg -globalopt -inline -loop-unroll -debug-pass Details -o
out.bc >& log

So it seems to me if a pass wanted to require ScalarEvolution,
ScalarEvolution::releaseMemory should be called every time after the pass
is called. Is that right?

Steps to reproduce(In case some of you do not have clang installed, test.bc
attached):
1. The makefile:
all:
        clang test.c -disable-llvm-optzns -emit-llvm -S
        llvm-as test.s -o test.bc
        opt test.bc -mem2reg -globalopt -inline -loop-unroll -debug-pass
Details -o out.bc >& log
        llvm-dis < out.bc > out.ll
2. test.c:
#include <stdio.h>

int A[100];
static int toBeInlined(int A[100]) {
    int ans = 0;
    for (int i=0; i<100; ++i)
        ans+=A[i];
    return ans;
}

int main() {
    for (int i=0; i<100; ++i)
        if (i%3==0)
            A[i] = i;
        else
            A[i] = i+1;
    int ans = toBeInlined(A);
    printf("%d\n", ans);
    return 0;
}

3. Hack to globalopt pass:
 #include <algorithm>
 using namespace llvm;

@@ -63,6 +65,7 @@
   struct GlobalOpt : public ModulePass {
     virtual void getAnalysisUsage(AnalysisUsage &AU) const {
       AU.addRequired<TargetLibraryInfo>();
+      AU.addRequired<ScalarEvolution>();
     }
     static char ID; // Pass identification, replacement for typeid
     GlobalOpt() : ModulePass(ID) {
@@ -92,6 +95,7 @@
 INITIALIZE_PASS_BEGIN(GlobalOpt, "globalopt",
                 "Global Variable Optimizer", false, false)
 INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfo)
+INITIALIZE_PASS_DEPENDENCY(ScalarEvolution)
 INITIALIZE_PASS_END(GlobalOpt, "globalopt",
                 "Global Variable Optimizer", false, false)

@@ -2084,6 +2088,14 @@
   for (Module::iterator FI = M.begin(), E = M.end(); FI != E; ) {
     Function *F = FI++;
     // Functions without names cannot be referenced outside this module.
+    if (!F->isDeclaration()) {
+      ScalarEvolution *SE = &getAnalysis<ScalarEvolution>(*F);
+      for(inst_iterator i = inst_begin(F), e = inst_end(F); i != e; ++i) {
+        Instruction *I = &*i;
+        if (I->getType()->isIntegerTy() || I->getType()->isPointerTy())
+          const SCEV* SS = SE->getSCEV(I);
+      }
+    }
     if (!F->hasName() && !F->isDeclaration())
       F->setLinkage(GlobalValue::InternalLinkage);
     F->removeDeadConstantUsers();

4. The coredump:
(gdb) bt
#0  0x000000386de30265 in raise () from /lib64/libc.so.6
#1  0x000000386de31d10 in abort () from /lib64/libc.so.6
#2  0x0000000000aa93e6 in llvm::llvm_unreachable_internal (
    msg=0xcce748 "An asserting value handle still pointed to this value!",
    file=0xccde18 "/home/xchen/llvm/lib/VMCore/Value.cpp", line=620)
    at /home/xchen/llvm/lib/Support/ErrorHandling.cpp:98
#3  0x0000000000a6d369 in llvm::ValueHandleBase::ValueIsDeleted
(V=0x10f7050)
    at /home/xchen/llvm/lib/VMCore/Value.cpp:619
#4  0x0000000000a6e631 in llvm::Value::~Value (this=0x10f7050,
__in_chrg=<value optimized out>)
    at /home/xchen/llvm/lib/VMCore/Value.cpp:59
#5  0x00000000009401fd in llvm::BasicBlock::~BasicBlock (this=0x10f7050,
__in_chrg=<value optimized out>)
    at /home/xchen/llvm/lib/VMCore/BasicBlock.cpp:83
#6  0x000000000068503d in
llvm::ilist_node_traits<llvm::BasicBlock>::deleteNode (V=0x10f7050)
    at /home/xchen/llvm/include/llvm/ADT/ilist.h:112
#7  0x0000000000686ed3 in llvm::iplist<llvm::BasicBlock,
llvm::ilist_traits<llvm::BasicBlock> >::erase (
    this=0x10f3f68, where=...) at
/home/xchen/llvm/include/llvm/ADT/ilist.h:463
#8  0x00000000009400a6 in llvm::BasicBlock::eraseFromParent (this=0x10f7050)
    at /home/xchen/llvm/lib/VMCore/BasicBlock.cpp:101
#9  0x0000000000a155a7 in llvm::Function::dropAllReferences (this=0x10f3f10)
    at /home/xchen/llvm/lib/VMCore/Function.cpp:242
#10 0x0000000000a15701 in llvm::Function::~Function (this=0x10f3f10,
__in_chrg=<value optimized out>)
    at /home/xchen/llvm/lib/VMCore/Function.cpp:188
#11 0x0000000000598107 in llvm::Inliner::runOnSCC (this=0x10e9780, SCC=...)
    at /home/xchen/llvm/lib/Transforms/IPO/Inliner.cpp:487
#12 0x000000000079a828 in (anonymous
namespace)::CGPassManager::RunPassOnSCC (this=0x10e9f80, P=0x10e9780,
    CurSCC=..., CG=..., CallGraphUpToDate=@0x7fffffffd0af,
DevirtualizedCall=@0x7fffffffd1f7)
    at /home/xchen/llvm/lib/Analysis/IPA/CallGraphSCCPass.cpp:121
#13 0x000000000079ac71 in (anonymous
namespace)::CGPassManager::RunAllPassesOnSCC (this=0x10e9f80,
    CurSCC=..., CG=..., DevirtualizedCall=@0x7fffffffd1f7)
    at /home/xchen/llvm/lib/Analysis/IPA/CallGraphSCCPass.cpp:402
#14 0x000000000079b046 in (anonymous namespace)::CGPassManager::runOnModule
(this=0x10e9f80, M=...)
    at /home/xchen/llvm/lib/Analysis/IPA/CallGraphSCCPass.cpp:457
#15 0x0000000000a50d49 in llvm::MPPassManager::runOnModule (this=0x10f4100,
M=...)
    at /home/xchen/llvm/lib/VMCore/PassManager.cpp:1572
---Type <return> to continue, or q <return> to quit---
#16 0x0000000000a521b9 in llvm::PassManagerImpl::run (this=0x10f4460, M=...)
    at /home/xchen/llvm/lib/VMCore/PassManager.cpp:1655
#17 0x0000000000a5221b in llvm::PassManager::run (this=0x7fffffffd4b0,
M=...)
    at /home/xchen/llvm/lib/VMCore/PassManager.cpp:1684
#18 0x0000000000541e77 in main (argc=10, argv=0x7fffffffd718) at
/home/xchen/llvm/tools/opt/opt.cpp:745
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-dev/attachments/20120831/974b7361/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: test.bc
Type: application/octet-stream
Size: 1172 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-dev/attachments/20120831/974b7361/attachment.obj>