[RISCV] Clang 19.1 Compiler segfaults in 'RISC-V Assembly Printer' pass

[kraj]

attached testcase reproduces the following problem on latest from release/19.x branch

.      <eof> parser at end of file
2.      Code generation
3.      Running pass 'Function Pass Manager' on module 'ac_strategy-555195.cpp'.
4.      Running pass 'RISC-V Assembly Printer' on function '@_ZNK3jxl10AcStrategy24ComputeNaturalCoeffOrderEPj'
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0  libLLVM.so.19.1      0x00007f5c3b849164 llvm::sys::RunSignalHandlers() + 52
1  libLLVM.so.19.1      0x00007f5c3b8493be
2  libc.so.6            0x00007f5c3a7bc160
3  libLLVM.so.19.1      0x00007f5c3d39e090 llvm::MCELFStreamer::fixSymbolsInTLSFixups(llvm::MCExpr const*) + 16
4  libLLVM.so.19.1      0x00007f5c3d39ecdc llvm::MCELFStreamer::emitInstToData(llvm::MCInst const&, llvm::MCSubtargetInfo const&) + 412
5  libLLVM.so.19.1      0x00007f5c3d3b3698 llvm::MCObjectStreamer::emitInstructionImpl(llvm::MCInst const&, llvm::MCSubtargetInfo const&) + 376
6  libLLVM.so.19.1      0x00007f5c3e9b5e6c
7  libLLVM.so.19.1      0x00007f5c3e9ba37a
8  libLLVM.so.19.1      0x00007f5c3c2cbc47 llvm::AsmPrinter::emitFunctionBody() + 583
9  libLLVM.so.19.1      0x00007f5c3e9b6aad
10 libLLVM.so.19.1      0x00007f5c3bcaad7a llvm::MachineFunctionPass::runOnFunction(llvm::Function&) + 458
11 libLLVM.so.19.1      0x00007f5c3b9c0d66 llvm::FPPassManager::runOnFunction(llvm::Function&) + 870
12 libLLVM.so.19.1      0x00007f5c3b9c0f8b llvm::FPPassManager::runOnModule(llvm::Module&) + 59
13 libLLVM.so.19.1      0x00007f5c3b9c1748 llvm::legacy::PassManagerImpl::run(llvm::Module&) + 1112
14 libclang-cpp.so.19.1 0x00007f5c44156421 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) + 5873
15 libclang-cpp.so.19.1 0x00007f5c445bcb6b clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) + 2011
16 libclang-cpp.so.19.1 0x00007f5c42d73e4c clang::ParseAST(clang::Sema&, bool, bool) + 1260
17 libclang-cpp.so.19.1 0x00007f5c44f2bc29 clang::FrontendAction::Execute() + 185
18 libclang-cpp.so.19.1 0x00007f5c44ea7d35 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) + 581
19 libclang-cpp.so.19.1 0x00007f5c44fa9174 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) + 500
20 clang-19             0x00005598a2f05bce cc1_main(llvm::ArrayRef<char const*>, char const*, void*) + 6190
21 clang-19             0x00005598a2effbcd
22 clang-19             0x00005598a2f01d80 clang_main(int, char**, llvm::ToolContext const&) + 7056
23 clang-19             0x00005598a2efe29b main + 107
24 libc.so.6            0x00007f5c3a7a6fdb
25 libc.so.6            0x00007f5c3a7a7099 __libc_start_main + 137
26 clang-19             0x00005598a2efe30e _start + 46
ac_strategy-555195.sh: line 4: 1412615 Segmentation fault      (core dumped) 

ac_strategy-555195.zip

[llvmbot]

@llvm/issue-subscribers-backend-risc-v

Author: Khem Raj (kraj)

attached testcase reproduces the following problem on latest from `release/19.x` branch

.      <eof> parser at end of file
2.      Code generation
3.      Running pass 'Function Pass Manager' on module 'ac_strategy-555195.cpp'.
4.      Running pass 'RISC-V Assembly Printer' on function '@<!-- -->_ZNK3jxl10AcStrategy24ComputeNaturalCoeffOrderEPj'
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0  libLLVM.so.19.1      0x00007f5c3b849164 llvm::sys::RunSignalHandlers() + 52
1  libLLVM.so.19.1      0x00007f5c3b8493be
2  libc.so.6            0x00007f5c3a7bc160
3  libLLVM.so.19.1      0x00007f5c3d39e090 llvm::MCELFStreamer::fixSymbolsInTLSFixups(llvm::MCExpr const*) + 16
4  libLLVM.so.19.1      0x00007f5c3d39ecdc llvm::MCELFStreamer::emitInstToData(llvm::MCInst const&amp;, llvm::MCSubtargetInfo const&amp;) + 412
5  libLLVM.so.19.1      0x00007f5c3d3b3698 llvm::MCObjectStreamer::emitInstructionImpl(llvm::MCInst const&amp;, llvm::MCSubtargetInfo const&amp;) + 376
6  libLLVM.so.19.1      0x00007f5c3e9b5e6c
7  libLLVM.so.19.1      0x00007f5c3e9ba37a
8  libLLVM.so.19.1      0x00007f5c3c2cbc47 llvm::AsmPrinter::emitFunctionBody() + 583
9  libLLVM.so.19.1      0x00007f5c3e9b6aad
10 libLLVM.so.19.1      0x00007f5c3bcaad7a llvm::MachineFunctionPass::runOnFunction(llvm::Function&amp;) + 458
11 libLLVM.so.19.1      0x00007f5c3b9c0d66 llvm::FPPassManager::runOnFunction(llvm::Function&amp;) + 870
12 libLLVM.so.19.1      0x00007f5c3b9c0f8b llvm::FPPassManager::runOnModule(llvm::Module&amp;) + 59
13 libLLVM.so.19.1      0x00007f5c3b9c1748 llvm::legacy::PassManagerImpl::run(llvm::Module&amp;) + 1112
14 libclang-cpp.so.19.1 0x00007f5c44156421 clang::EmitBackendOutput(clang::DiagnosticsEngine&amp;, clang::HeaderSearchOptions const&amp;, clang::CodeGenOptions const&amp;, clang::TargetOptions const&amp;, clang::LangOptions const&amp;, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr&lt;llvm::vfs::FileSystem&gt;, std::unique_ptr&lt;llvm::raw_pwrite_stream, std::default_delete&lt;llvm::raw_pwrite_stream&gt;&gt;, clang::BackendConsumer*) + 5873
15 libclang-cpp.so.19.1 0x00007f5c445bcb6b clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&amp;) + 2011
16 libclang-cpp.so.19.1 0x00007f5c42d73e4c clang::ParseAST(clang::Sema&amp;, bool, bool) + 1260
17 libclang-cpp.so.19.1 0x00007f5c44f2bc29 clang::FrontendAction::Execute() + 185
18 libclang-cpp.so.19.1 0x00007f5c44ea7d35 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&amp;) + 581
19 libclang-cpp.so.19.1 0x00007f5c44fa9174 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) + 500
20 clang-19             0x00005598a2f05bce cc1_main(llvm::ArrayRef&lt;char const*&gt;, char const*, void*) + 6190
21 clang-19             0x00005598a2effbcd
22 clang-19             0x00005598a2f01d80 clang_main(int, char**, llvm::ToolContext const&amp;) + 7056
23 clang-19             0x00005598a2efe29b main + 107
24 libc.so.6            0x00007f5c3a7a6fdb
25 libc.so.6            0x00007f5c3a7a7099 __libc_start_main + 137
26 clang-19             0x00005598a2efe30e _start + 46
ac_strategy-555195.sh: line 4: 1412615 Segmentation fault      (core dumped) 

ac_strategy-555195.zip

[dtcxzyw]

Reduced compilation flags: clang++ -target riscv64-gnu-linux -O2 -std=c++11 -Xclang -mrelax-all -fsized-deallocation -c test.cpp.

[topperc]

Looks like the call to Fixups.clear() in RISCVMCCodeEmitter::expandLongCondBr erased every fixup in the function instead of just the fixups for the branch.

[topperc]

Possible fix

diff --git a/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCCodeEmitter.cpp b/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCCodeEmitter.cpp
index 75323632dd53..a54d0996b74a 100644
--- a/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCCodeEmitter.cpp
+++ b/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCCodeEmitter.cpp
@@ -283,13 +283,17 @@ void RISCVMCCodeEmitter::expandLongCondBr(const MCInst &MI,
     Offset = 4;
   }
 
+  size_t N = Fixups.size();
+
   // Emit an unconditional jump to the destination.
   MCInst TmpInst =
       MCInstBuilder(RISCV::JAL).addReg(RISCV::X0).addOperand(SrcSymbol);
   uint32_t Binary = getBinaryCodeForInstr(TmpInst, Fixups, STI);
   support::endian::write(CB, Binary, llvm::endianness::little);
 
-  Fixups.clear();
+  if (Fixups.size() > N)
+    Fixups.pop_back();
+
   if (SrcSymbol.isExpr()) {
     Fixups.push_back(MCFixup::create(Offset, SrcSymbol.getExpr(),
                                      MCFixupKind(RISCV::fixup_riscv_jal)

[topperc]

@kraj did you add -mrelax-all to the command line yourself?

[dtcxzyw]

I am working to provide a reproducer.

[dtcxzyw]

@kraj did you add -mrelax-all to the command line yourself?

See https://github.com/libjxl/libjxl/blob/7609879f3d9071506dea8f537ad56d744ee83617/CMakeLists.txt#L339

[wangpc-pp]

Looks like the call to Fixups.clear() in RISCVMCCodeEmitter::expandLongCondBr erased every fixup in the function instead of just the fixups for the branch.

So it exists for a long time?

[topperc]

Looks like the call to Fixups.clear() in RISCVMCCodeEmitter::expandLongCondBr erased every fixup in the function instead of just the fixups for the branch.

So it exists for a long time?

Yes. And -mrelax-all is broken on RISC-V. See #87127 for more details.

[dtcxzyw]

Reproducer:

; bin/clang++ -target riscv64-gnu-linux -O2 -std=c++11 -Xclang -mrelax-all -c test.cpp

struct b {
  using c = char *;
};
template <class d> struct e {
  using ab = d;
  ab ac() { return f; }
  d f;
};
template <class ad, class g> class h : e<ad> {
public:
  using i = e<ad>;
  using j = e<g>;
  typename i::ab ae() { return (*this).ac(); }
  typename j::ab af();
};
template <class ag> class k {
  h<b::c, ag> aj;

public:
  ~k() {
    b::c a = aj.ae();
    if (a)
      aj.af()(a);
  }
};
enum al { am };
template <typename aq> class m {
public:
  ~m() {
    if (ap == am)
      at.au.~aq();
  }
  struct {
    aq au;
  } at;
  al ap;
};
struct n {
  void operator()(char *);
};
using ax = k<n>;
struct o {
  ax a;
};
m<o> l;

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: bin/clang++ -target riscv64-gnu-linux -O2 -std=c++11 -Xclang -mrelax-all -c test.cpp
1.      <eof> parser at end of file
2.      Code generation
3.      Running pass 'Function Pass Manager' on module 'test.cpp'.
4.      Running pass 'RISC-V Assembly Printer' on function '@_ZN1mI1oED2Ev'
 #0 0x00007d7131c14572 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMSupport.so.20.0git+0x214572)
 #1 0x00007d7131c1143f llvm::sys::RunSignalHandlers() (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMSupport.so.20.0git+0x21143f)
 #2 0x00007d7131b00108 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007d7131242520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007d71341197d0 llvm::MCELFStreamer::emitInstToData(llvm::MCInst const&, llvm::MCSubtargetInfo const&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMMC.so.20.0git+0x8e7d0)
 #5 0x00007d71341350bf llvm::MCObjectStreamer::emitInstructionImpl(llvm::MCInst const&, llvm::MCSubtargetInfo const&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMMC.so.20.0git+0xaa0bf)
 #6 0x00007d7139e75edc (anonymous namespace)::RISCVAsmPrinter::EmitToStreamer(llvm::MCStreamer&, llvm::MCInst const&) (.constprop.0) RISCVAsmPrinter.cpp:0:0
 #7 0x00007d7139e7d8b3 (anonymous namespace)::RISCVAsmPrinter::emitInstruction(llvm::MachineInstr const*) RISCVAsmPrinter.cpp:0:0
 #8 0x00007d71330dcf2f llvm::AsmPrinter::emitFunctionBody() (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMAsmPrinter.so.20.0git+0x67f2f)
 #9 0x00007d7139e7a90a (anonymous namespace)::RISCVAsmPrinter::runOnMachineFunction(llvm::MachineFunction&) RISCVAsmPrinter.cpp:0:0
#10 0x00007d7135e3bf96 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMCodeGen.so.20.0git+0x43bf96)
#11 0x00007d71320fc368 llvm::FPPassManager::runOnFunction(llvm::Function&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMCore.so.20.0git+0x2fc368)
#12 0x00007d71320fc981 llvm::FPPassManager::runOnModule(llvm::Module&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMCore.so.20.0git+0x2fc981)
#13 0x00007d71320fd2c7 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMCore.so.20.0git+0x2fd2c7)
#14 0x00007d713674d219 (anonymous namespace)::EmitAssemblyHelper::EmitAssembly(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) BackendUtil.cpp:0:0
#15 0x00007d713674d6bd clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libclangCodeGen.so.20.0git+0x14d6bd)
#16 0x00007d7136c9d43e clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libclangCodeGen.so.20.0git+0x69d43e)
#17 0x00007d7131081a4d clang::ParseAST(clang::Sema&, bool, bool) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libclangParse.so.20.0git+0x4aa4d)
#18 0x00007d7134d53ef1 clang::FrontendAction::Execute() (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libclangFrontend.so.20.0git+0x153ef1)
#19 0x00007d7134cc3f1e clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libclangFrontend.so.20.0git+0xc3f1e)
#20 0x00007d713b170ad9 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libclangFrontendTool.so.20.0git+0x5ad9)
#21 0x00005bb55f36ae0c cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (bin/clang+++0x17e0c)
#22 0x00005bb55f362d44 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#23 0x00007d71346f380d void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#24 0x00007d7131b005ee llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMSupport.so.20.0git+0x1005ee)
#25 0x00007d71346f6dc8 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libclangDriver.so.20.0git+0xf6dc8)
#26 0x00007d71346afd5f clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libclangDriver.so.20.0git+0xafd5f)
#27 0x00007d71346b095d clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libclangDriver.so.20.0git+0xb095d)
#28 0x00007d71346c11e4 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libclangDriver.so.20.0git+0xc11e4)
#29 0x00005bb55f365ce9 clang_main(int, char**, llvm::ToolContext const&) (bin/clang+++0x12ce9)
#30 0x00005bb55f36130a main (bin/clang+++0xe30a)
#31 0x00007d7131229d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#32 0x00007d7131229e40 call_init ./csu/../csu/libc-start.c:128:20
#33 0x00007d7131229e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#34 0x00005bb55f361375 _start (bin/clang+++0xe375)
clang++: error: clang frontend command failed with exit code 139 (use -v to see invocation)
clang version 20.0.0git
Target: riscv64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin
Build config: +assertions
clang++: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang++: note: diagnostic msg: /tmp/test-f078d6.cpp
clang++: note: diagnostic msg: /tmp/test-f078d6.sh
clang++: note: diagnostic msg: 

********************

LLVM version: 387bee9