[llvm-dev] Running -jump-threading twice crashes opt in ValueHandleBase::ValueIsDeleted

[Mikael Holmén via llvm-dev]

Hi,

Running

build-all/bin/opt -S ./bugpoint-reduced-simplified.ll -jump-threading 
-jump-threading

on the attached bugpoint-reduced ll-file ends with

While deleting: label %bb1
An asserting value handle still pointed to this value!
UNREACHABLE executed at ../lib/IR/Value.cpp:686!

It's on the second invocation of jump-threading that it breaks, when it 
calls llvm::removeUnreachableBlocks:


0  opt             0x000000000163806a 
llvm::sys::PrintStackTrace(llvm::raw_ostream&) + 42
1  opt             0x0000000001637576 llvm::sys::RunSignalHandlers() + 86
2  opt             0x0000000001639893
3  libpthread.so.0 0x00007f57baa72340
4  libc.so.6       0x00007f57b9c9acc9 gsignal + 57
5  libc.so.6       0x00007f57b9c9e0d8 abort + 328
6  opt             0x00000000015f874d 
llvm::llvm_unreachable_internal(char const*, char const*, unsigned int) 
+ 461
7  opt             0x00000000012a2ebb 
llvm::ValueHandleBase::ValueIsDeleted(llvm::Value*) + 1051
8  opt             0x00000000012a282b llvm::Value::~Value() + 43
9  opt             0x0000000001164cf9 llvm::BasicBlock::~BasicBlock() + 9
10 opt             0x00000000016749ec 
llvm::removeUnreachableBlocks(llvm::Function&) + 2956
11 opt             0x00000000014c2be7
12 opt             0x00000000012727ec 
llvm::FPPassManager::runOnFunction(llvm::Function&) + 524
13 opt             0x0000000001272a2b 
llvm::FPPassManager::runOnModule(llvm::Module&) + 43
14 opt             0x0000000001272f27 
llvm::legacy::PassManagerImpl::run(llvm::Module&) + 935
15 opt             0x0000000000602304 main + 8164
16 libc.so.6       0x00007f57b9c85ec5 __libc_start_main + 245
17 opt             0x00000000005f3882

The code looks like this when jump-threading is invoked the second time:

*** IR Dump Before Jump Threading ***
define void @fn1() {
.split.us:
   br label %bb2.us.us

bb2.us.us:                                        ; preds = %bb2.us.us, 
%.split.us
   br label %bb2.us.us

bb1.us:                                           ; preds = %bb1.us
   br label %bb1.us

bb2.us4:                                          ; preds = %bb2.us4
   br label %bb2.us4

bb2:                                              ; preds = %bb1
   %_tmp3 = icmp slt i16 %_tmp18, 2
   br i1 %_tmp3, label %bb1, label %bb1

bb1:                                              ; preds = %bb2, %bb2
   %_tmp18 = load i16, i16* @c
   %_tmp20 = icmp ne i16 %_tmp18, 0
   br i1 %_tmp20, label %bb2, label %bb6

bb6:                                              ; preds = %bb1
   ret void
}

And when it tries to delete bb1 it crashes.

(We're not really that interested in running -jump-threading twice, but 
our test runs randomizes the opt flags and stumbled upon this.)

Should I write a TR on this or is this the expected outcome?

Regards,
Mikael
-------------- next part --------------
; ModuleID = 'bugpoint-reduced-simplified.bc'
target triple = "x86_64-unknown-linux-gnu"

@c = external global i16

define void @fn1() {
  br i1 undef, label %.split.us, label %.split

.split.us:                                        ; preds = %0
  br i1 undef, label %bb1.us.us, label %bb1.us

bb1.us.us:                                        ; preds = %bb2.us.us, %.split.us
  br i1 undef, label %bb2.us.us, label %bb6

bb2.us.us:                                        ; preds = %bb1.us.us
  br label %bb1.us.us

bb1.us:                                           ; preds = %bb2.us, %.split.us
  br i1 undef, label %bb2.us, label %bb6

bb2.us:                                           ; preds = %bb1.us
  br label %bb1.us

.split:                                           ; preds = %0
  br i1 undef, label %bb1.us1, label %bb1

bb1.us1:                                          ; preds = %bb5.us12, %.split
  br i1 undef, label %bb2.us4, label %bb6

bb2.us4:                                          ; preds = %bb1.us1
  br i1 undef, label %bb4.us7, label %bb5.us12

bb4.us7:                                          ; preds = %bb2.us4
  br label %bb5.us12

bb5.us12:                                         ; preds = %bb4.us7, %bb2.us4
  br label %bb1.us1

bb2:                                              ; preds = %bb1
  %_tmp3 = icmp slt i16 %_tmp18, 2
  br i1 %_tmp3, label %bb4, label %bb5

bb4:                                              ; preds = %bb2
  br label %bb5

bb5:                                              ; preds = %bb4, %bb2
  br label %bb1

bb1:                                              ; preds = %bb5, %.split
  %_tmp18 = load i16, i16* @c
  %_tmp20 = icmp ne i16 %_tmp18, 0
  br i1 %_tmp20, label %bb2, label %bb6

bb6:                                              ; preds = %bb1, %bb1.us1, %bb1.us, %bb1.us.us
  ret void
}