Skip to content

Undefined behavior (signed-overflow) in ConstraintElimination #62226

Closed
@meheff

Description

@meheff

Error message:

llvm-project/llvm/lib/Transforms/Scalar/ConstraintElimination.cpp:490:35: runtime error: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'

Repro: build LLVM with ubsan:

cmake ../llvm -GNinja -DCMAKE_BUILD_TYPE=RelWithDebInfo   -DCMAKE_CXX_COMPILER=$TOOLBIN/clang++ -DCMAKE_C_COMPILER=$TOOLBIN/clang   -DLLVM_USE_SANITIZER=Undefined   -DLLVM_UBSAN_FLAGS='-fsanitize=signed-integer-overflow -fsanitize-undefined-trap-on-error'   -DLLVM_ENABLE_LLD=On -DLLVM_TARGETS_TO_BUILD=X86

Run on sample below:

opt -O2 sample.ll
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: bin/opt -O2 /tmp/minimized.ll -o /dev/null
 #0 0x000056520a9dc5ae llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:602:13
 #1 0x000056520a9daa35 llvm::sys::RunSignalHandlers() /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Support/Signals.cpp:105:18
 #2 0x000056520a9dcd6c SignalHandler(int) /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:413:1
 #3 0x00007f4e2625af90 (/lib/x86_64-linux-gnu/libc.so.6+0x3bf90)
 #4 0x000056520aeaeae2 (anonymous namespace)::ConstraintInfo::getConstraint(llvm::CmpInst::Predicate, llvm::Value*, llvm::Value*, llvm::SmallVectorImpl<llvm::Value*>&) const /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Transforms/Scalar/ConstraintElimination.cpp:490:35
 #5 0x000056520aead849 (anonymous namespace)::ConstraintInfo::getConstraintForSolving(llvm::CmpInst::Predicate, llvm::Value*, llvm::Value*) const /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Transforms/Scalar/ConstraintElimination.cpp:0:0
 #6 0x000056520aeaa6ac llvm::SmallVectorBase<unsigned int>::empty() const /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/ADT/SmallVector.h:94:46
 #7 0x000056520aeaa6ac (anonymous namespace)::ConstraintTy::empty() const /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Transforms/Scalar/ConstraintElimination.cpp:121:48
 #8 0x000056520aeaa6ac checkAndReplaceCondition(llvm::CmpInst*, (anonymous namespace)::ConstraintInfo&, llvm::Module*, llvm::ArrayRef<(anonymous namespace)::ReproducerEntry>, llvm::DominatorTree&) /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Transforms/Scalar/ConstraintElimination.cpp:924:9
 #9 0x000056520aeaa6ac eliminateConstraints(llvm::Function&, llvm::DominatorTree&, llvm::OptimizationRemarkEmitter&) /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Transforms/Scalar/ConstraintElimination.cpp:1190:20
#10 0x000056520aeaa6ac llvm::ConstraintEliminationPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Transforms/Scalar/ConstraintElimination.cpp:1257:8
#11 0x000056520ab70f62 llvm::detail::PassModel<llvm::Function, llvm::ConstraintEliminationPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:89:5
#12 0x000056520a5b7c25 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/IR/PassManager.h:521:10
#13 0x000056520ab5e9d2 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:89:5
#14 0x0000565209ddefe4 llvm::CGSCCToFunctionPassAdaptor::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Analysis/CGSCCPassManager.cpp:540:23
#15 0x000056520ab863f2 llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::CGSCCToFunctionPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:89:5
#16 0x0000565209ddbf19 llvm::PassManager<llvm::LazyCallGraph::SCC, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Analysis/CGSCCPassManager.cpp:90:12
#17 0x000056520ab5e562 llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::PassManager<llvm::LazyCallGraph::SCC, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:89:5
#18 0x0000565209dddbc7 llvm::DevirtSCCRepeatedPass::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Analysis/CGSCCPassManager.cpp:0:38
#19 0x000056520ab86eb2 llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::DevirtSCCRepeatedPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:89:5
#20 0x0000565209ddd1f9 llvm::ModuleToPostOrderCGSCCPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Analysis/CGSCCPassManager.cpp:278:18
#21 0x000056520ab5e762 llvm::detail::PassModel<llvm::Module, llvm::ModuleToPostOrderCGSCCPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:89:5
#22 0x000056520a5b6f05 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/IR/PassManager.h:521:10
#23 0x000056520ac30393 llvm::SmallPtrSetImplBase::isSmall() const /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/ADT/SmallPtrSet.h:195:33
#24 0x000056520ac30393 llvm::SmallPtrSetImplBase::~SmallPtrSetImplBase() /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/ADT/SmallPtrSet.h:83:10
#25 0x000056520ac30393 llvm::PreservedAnalyses::~PreservedAnalyses() /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/IR/PassManager.h:152:7
#26 0x000056520ac30393 llvm::ModuleInlinerWrapperPass::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /usr/local/google/home/meheff/src/llvm-project/llvm/lib/Transforms/IPO/Inliner.cpp:630:3
#27 0x000056520ab661b2 llvm::detail::PassModel<llvm::Module, llvm::ModuleInlinerWrapperPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:89:5
#28 0x000056520a5b6f05 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/IR/PassManager.h:521:10
#29 0x0000565209ac2406 llvm::SmallPtrSetImplBase::isSmall() const /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/ADT/SmallPtrSet.h:195:33
#30 0x0000565209ac2406 llvm::SmallPtrSetImplBase::~SmallPtrSetImplBase() /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/ADT/SmallPtrSet.h:83:10
#31 0x0000565209ac2406 llvm::PreservedAnalyses::~PreservedAnalyses() /usr/local/google/home/meheff/src/llvm-project/llvm/include/llvm/IR/PassManager.h:152:7
#32 0x0000565209ac2406 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool) /usr/local/google/home/meheff/src/llvm-project/llvm/tools/opt/NewPMDriver.cpp:522:3
#33 0x0000565209ad0605 main /usr/local/google/home/meheff/src/llvm-project/llvm/tools/opt/opt.cpp:701:12
#34 0x00007f4e2624618a __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#35 0x00007f4e26246245 call_init ./csu/../csu/libc-start.c:128:20
#36 0x00007f4e26246245 __libc_start_main ./csu/../csu/libc-start.c:368:5
#37 0x0000565209abc1e1 _start (bin/opt+0xc8f1e1)
Illegal instruction

Bugpoint-reduced input:

; ModuleID = 'bugpoint-reduced-simplified.bc'
source_filename = "__module"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

declare i64 @__sample__main(ptr, ptr, ptr, ptr, ptr, ptr, i64)

declare i1 @____sample__main_partition_0(ptr, ptr, ptr, ptr, ptr, ptr)

declare dso_local i1 @____sample__main_eq.37_37(ptr)

declare dso_local i1 @____sample__main_eq.105_105(ptr)

declare dso_local i1 @____sample__main_eq.122_122(ptr)

declare dso_local i1 @____sample__main_eq.54_54(ptr)

declare dso_local i1 @____sample__main_and.38_38(ptr, ptr)

declare dso_local i1 @____sample__main_eq.41_41(ptr)

declare dso_local i1 @____sample__main_and.106_106(ptr, ptr)

declare dso_local i1 @____sample__main_eq.109_109(ptr)

declare dso_local i1 @____sample__main_and.123_123(ptr, ptr)

declare dso_local i1 @____sample__main_eq.126_126(ptr)

declare dso_local i1 @____sample__main_eq.87_87(ptr)

declare dso_local i1 @____sample__main_and.55_55(ptr, ptr)

declare dso_local i1 @____sample__main_eq.58_58(ptr)

declare dso_local i1 @____sample__main_and.42_42(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_and.110_110(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_and.127_127(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_eq.130_130(ptr)

declare dso_local i1 @____sample__main_and.88_88(ptr, ptr)

declare dso_local i1 @____sample__main_eq.91_91(ptr)

declare dso_local i1 @____sample__main_x4_5(ptr)

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memcpy.p0.p0.i64(ptr noalias nocapture writeonly, ptr noalias nocapture readonly, i64, i1 immarg) #0

declare dso_local i1 @____sample__main_and.59_59(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_eq.62_62(ptr)

declare dso_local i1 @____sample__main_and.45_45(ptr, ptr)

declare dso_local i1 @____sample__main_eq.48_48(ptr)

declare dso_local i1 @____sample__main_and.114_114(ptr, ptr)

declare dso_local i1 @____sample__main_eq.117_117(ptr)

declare dso_local i1 @____sample__main_and.131_131(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_bit_slice.1361_1361(ptr)

declare dso_local i1 @____sample__main_and.92_92(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_eq.95_95(ptr)

declare dso_local i1 @____sample__main_tuple_index.97_97(ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr)

declare dso_local i1 @____sample__main_and.63_63(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_and.49_49(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_and.118_118(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_and.135_135(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_and.96_96(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_eq.99_99(ptr, ptr)

declare dso_local i1 @____sample__main_one_hot.21_21(ptr)

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare i8 @llvm.cttz.i8(i8, i1 immarg) #1

declare dso_local i1 @____sample__main_concat.71_71(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_or.136_136(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_and.100_100(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_x16_22(ptr, ptr)

declare dso_local i1 @____sample__main_one_hot.72_72(ptr, ptr)

declare dso_local i1 @____sample__main_concat.140_140(ptr, ptr, ptr)

declare dso_local i1 @____sample__main_zero_ext.76_76(ptr, ptr)

declare dso_local i1 @____sample__main_x23_73(ptr, ptr)

declare dso_local i1 @____sample__main_zero_ext.4111_4111(ptr, ptr)

declare dso_local i1 @____sample__main_x26_77(ptr, ptr, ptr)

define i1 @____sample__main_partition_1(ptr %input_ptrs, ptr %output_ptrs, ptr %tmp_buffer, ptr %events, ptr %user_data, ptr %runtime) {
entry:
  %0 = alloca i128, align 8
  %1 = ptrtoint ptr %tmp_buffer to i64
  %2 = add i64 %1, 0
  %3 = inttoptr i64 %2 to ptr
  %4 = call i1 @____sample__main_x30_142(ptr %3, ptr %0)
  %5 = alloca i128, align 8
  %6 = call i1 @____sample__main_zero_ext.143_143(ptr poison, ptr %5)
  %7 = getelementptr [0 x ptr], ptr %output_ptrs, i32 0, i32 0
  %8 = load ptr, ptr %7, align 8
  %9 = call i1 @____sample__main_x31_144(ptr %0, ptr %5, ptr %8)
  ret i1 false
}

define private i1 @____sample__main_x30_142(ptr %selector_ptr, ptr %output_0_ptr) {
entry:
  %zero_ext.4111 = load i8, ptr %selector_ptr, align 1
  store i128 0, ptr %output_0_ptr, align 8
  %0 = lshr i8 %zero_ext.4111, 1
  %1 = trunc i8 %0 to i1
  br i1 %1, label %case_1_then, label %case_1_join

case_1_then:                                      ; preds = %entry
  %2 = alloca i128, align 8
  store i128 18446744073709551616, ptr %2, align 8
  %3 = load i128, ptr %2, align 8
  %4 = or i128 %3, 0
  store i128 %4, ptr %output_0_ptr, align 8
  br label %case_1_join

case_1_join:                                      ; preds = %case_1_then, %entry
  ret i1 false
}

declare dso_local i1 @____sample__main_zero_ext.143_143(ptr, ptr)

define private i1 @____sample__main_x31_144(ptr %lhs_ptr, ptr %rhs_ptr, ptr %output_0_ptr) {
entry:
  %x30 = load i128, ptr %lhs_ptr, align 8
  %zero_ext.143 = load i128, ptr %rhs_ptr, align 8
  %0 = icmp uge i128 %x30, %zero_ext.143
  %1 = and i1 %0, true
  store i1 %1, ptr %output_0_ptr, align 1
  ret i1 false
}

declare i64 @__sample__main_packed(ptr, ptr, ptr, ptr, ptr, ptr, i64)

attributes #0 = { nocallback nofree nounwind willreturn memory(argmem: readwrite) }
attributes #1 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions