SIGSEGV in rustc upon compiling with --release

[cfstras]

I tried compiling this code with --release:

pub fn fun(number: usize, decision: bool) {
    for _ in 0..2 {
        for _ in 0..number {
            let iter: Box<dyn Iterator<Item = ()>> = if decision {
                Box::new(std::iter::empty())
            } else {
                Box::new(std::iter::once(()))
            };
            for _ in iter {}
        }
    }
}

rustc --crate-type lib -C opt-level=3 code.rs

(Thanks to @Xiretza for helping me find this shorter reproducer)

I expected to see this happen: (nothing, since there's no main method) a clean compile

Instead, this happened:

[1]    7213 segmentation fault  rustc --crate-type lib -C opt-level=3 code.rs

(Or, when compiling through cargo build --release:)

error: could not compile [...]` (lib)

Caused by:
  process didn't exit successfully: `[...]/.rustup/toolchains/stable-aarch64-apple-darwin/bin/rustc [...] (signal: 11, SIGSEGV: invalid memory reference)
warning: build failed, waiting for other jobs to finish...

Meta

rustc --version --verbose:

rustc 1.74.1 (a28077b28 2023-12-04)
binary: rustc
commit-hash: a28077b28a02b92985b3a3faecf92813155f1ea1
commit-date: 2023-12-04
host: aarch64-apple-darwin
release: 1.74.1
LLVM version: 17.0.4

Note: this crashes on the playground on nightly (2023-12-20 5ac4c8a), beta (1.75.0-beta.7), and stable (1.74.1). Also crashes on aarch64-apple-darwin nightly (2023-12-19 f704f3b), beta (1.75.0-beta.7) and stable (1.74.1)

Backtrace

(From Playground since I don't have a debug build on macOS yet)

error: rustc interrupted by SIGSEGV, printing backtrace

/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/librustc_driver-9ad8050f1171bcfc.so(+0x311dd46)[0x7f8e67528d46]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x14420)[0x7f8e64250420]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(_ZN4llvm16MemorySSAUpdater19updateForClonedLoopERKNS_13LoopBlocksRPOENS_8ArrayRefIPNS_10BasicBlockEEERKNS_8ValueMapIPKNS_5ValueENS_14WeakTrackingVHENS_14ValueMapConfigISB_NS_3sys10SmartMutexILb0EEEEEEEb+0x883)[0x7f8e62ea1b4d]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(+0x696078a)[0x7f8e630ac78a]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(+0x66b2315)[0x7f8e62dfe315]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(_ZN4llvm22SimpleLoopUnswitchPass3runERNS_4LoopERNS_15AnalysisManagerIS1_JRNS_27LoopStandardAnalysisResultsEEEES5_RNS_10LPMUpdaterE+0x44e)[0x7f8e62dfbb0e]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(+0x66af6b9)[0x7f8e62dfb6b9]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(_ZN4llvm11PassManagerINS_4LoopENS_15AnalysisManagerIS1_JRNS_27LoopStandardAnalysisResultsEEEEJS4_RNS_10LPMUpdaterEEE24runWithoutLoopNestPassesERS1_RS5_S4_S7_+0x3aa)[0x7f8e62ae8caa]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(_ZN4llvm11PassManagerINS_4LoopENS_15AnalysisManagerIS1_JRNS_27LoopStandardAnalysisResultsEEEEJS4_RNS_10LPMUpdaterEEE3runERS1_RS5_S4_S7_+0x23)[0x7f8e62ae8823]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(_ZN4llvm25FunctionToLoopPassAdaptor3runERNS_8FunctionERNS_15AnalysisManagerIS1_JEEE+0x608)[0x7f8e6278e088]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(+0x6041a71)[0x7f8e6278da71]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(_ZN4llvm11PassManagerINS_8FunctionENS_15AnalysisManagerIS1_JEEEJEE3runERS1_RS3_+0xe51)[0x7f8e62ab2fd7]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(_ZN4llvm26CGSCCToFunctionPassAdaptor3runERNS_13LazyCallGraph3SCCERNS_15AnalysisManagerIS2_JRS1_EEES5_RNS_17CGSCCUpdateResultE+0x356)[0x7f8e627bff96]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(+0x6073c39)[0x7f8e627bfc39]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(_ZN4llvm11PassManagerINS_13LazyCallGraph3SCCENS_15AnalysisManagerIS2_JRS1_EEEJS4_RNS_17CGSCCUpdateResultEEE3runERS2_RS5_S4_S7_+0x667)[0x7f8e62b89527]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(_ZN4llvm21DevirtSCCRepeatedPass3runERNS_13LazyCallGraph3SCCERNS_15AnalysisManagerIS2_JRS1_EEES5_RNS_17CGSCCUpdateResultE+0x174)[0x7f8e62b88342]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(_ZN4llvm33ModuleToPostOrderCGSCCPassAdaptor3runERNS_6ModuleERNS_15AnalysisManagerIS1_JEEE+0x673)[0x7f8e6289d211]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(+0x6150b99)[0x7f8e6289cb99]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(_ZN4llvm11PassManagerINS_6ModuleENS_15AnalysisManagerIS1_JEEEJEE3runERS1_RS3_+0xb9)[0x7f8e627c10f9]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(_ZN4llvm24ModuleInlinerWrapperPass3runERNS_6ModuleERNS_15AnalysisManagerIS1_JEEE+0x1ab)[0x7f8e62ab07c7]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(+0x6364617)[0x7f8e62ab0617]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libLLVM-17-rust-1.74.1-stable.so(_ZN4llvm11PassManagerINS_6ModuleENS_15AnalysisManagerIS1_JEEEJEE3runERS1_RS3_+0xb9)[0x7f8e627c10f9]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/librustc_driver-9ad8050f1171bcfc.so(+0x25e38ac)[0x7f8e669ee8ac]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/librustc_driver-9ad8050f1171bcfc.so(+0x25dc8ca)[0x7f8e669e78ca]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/librustc_driver-9ad8050f1171bcfc.so(+0x25da3d9)[0x7f8e669e53d9]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/librustc_driver-9ad8050f1171bcfc.so(+0x25d9a83)[0x7f8e669e4a83]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/librustc_driver-9ad8050f1171bcfc.so(+0x25d7999)[0x7f8e669e2999]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/librustc_driver-9ad8050f1171bcfc.so(+0x257b936)[0x7f8e66986936]
/playground/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/libstd-b149a04e58514815.so(rust_metadata_std_afc0969a1e8d0069+0x10a395)[0x7f8e6437d395]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x8609)[0x7f8e64244609]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f8e64167353]

note: we would appreciate a report at https://github.com/rust-lang/rust
note: backtrace dumped due to SIGSEGV! resuming signal
error: could not compile `playground` (lib)

[lqd]

It's probably on our side since it's tripping an LLVM assert? (or is it tripped by an incorrect optimization maybe?)

[nikic]

Reduced:

; RUN: opt -passes="loop-mssa(loop-instsimplify,simple-loop-unswitch<nontrivial>)" < %s
@vtable = constant ptr @foo

declare void @foo() memory(none)

define void @test(i1 %c) {
  br label %loop

loop:
  %fn = load ptr, ptr @vtable, align 8
  call void %fn()
  br i1 %c, label %exit, label %loop

exit:
  ret void
}

[nikic]

Upstream fix: llvm/llvm-project#76142

[jamesmunns]

@cfstras, could you please try adding -Cllvm-args=--enable-machine-outliner=never and see if it still reproduces? I had thought this was cortex-m/thumb specific, but might be relevant to all ARM targets. CC:

#118867

edit: Ah nikic might have already found a more specific issue, probably nevermind :)

[cfstras]

I verified successfully that this also fixes the build for my codebase where I originally found this 👍🏻 (by cherry-picking only your commit on top of the currently used nightly llvm branch in rust-lang/rust, 606bc11367b4)

edit @jamesmunns: Sorry, just saw your comment as I was leaving. I can try that later, but since it also reproduces on the (linux/ guessing amd64?) rust playground, I doubt this is ARM-related.

[cfstras]

@jamesmunns: The argument doesn't seem to make a difference, neither on stable/beta, nor on nightly.
Current versions (as in my initial post) all crash (with and without the flag), and the stage1 I built with @nikic's fix works fine with and without the flag.