Memcpyopt crashes with simple IR

[gbaraldi]

target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128-ni:10:11:12:13"
target triple = "x86_64-unknown-linux-gnu"

define void @"julia_#36#f_439"() {
top:
  call void @llvm.memcpy.p0.p11.i64(ptr null, ptr addrspace(11) null, i64 0, i1 false), !tbaa !0
  ret void
}

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memcpy.p0.p11.i64(ptr noalias nocapture writeonly, ptr addrspace(11) noalias nocapture readonly, i64, i1 immarg) #0

attributes #0 = { nocallback nofree nounwind willreturn memory(argmem: readwrite) }

!0 = !{!1, !1, i64 0, i64 1}
!1 = !{!"jtbaa_const", !2, i64 0}
!2 = !{!"jtbaa", !3, i64 0}
!3 = !{!"jtbaa"}

opt: /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/include/llvm/Support/Casting.h:663: decltype(auto) llvm::dyn_cast(From*) [with To = llvm::MemoryUse; From = const llvm::MemoryUseOrDef]: Assertion `detail::isPresent(Val) && "dyn_cast on a non-existent value"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: ./opt reduced.ll --passes=memcpyopt -S
 #0 0x00007ff07cfaf7d4 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/lib/Support/Unix/Signals.inc:567:22
 #1 0x00007ff07cfafbaa PrintStackTraceSignalHandler(void*) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/lib/Support/Unix/Signals.inc:641:1
 #2 0x00007ff07cfad3c7 llvm::sys::RunSignalHandlers() /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/lib/Support/Signals.cpp:104:20
 #3 0x00007ff07cfaf0ec SignalHandler(int) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/lib/Support/Unix/Signals.inc:412:1
 #4 0x00007ff07ba42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #5 0x00007ff07ba969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #6 0x00007ff07ba42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #7 0x00007ff07ba287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #8 0x00007ff07ba2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #9 0x00007ff07ba39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#10 0x00007ff07d6f1599 decltype(auto) llvm::dyn_cast<llvm::MemoryUse, llvm::MemoryUseOrDef const>(llvm::MemoryUseOrDef const*) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/include/llvm/Support/Casting.h:664:48
#11 0x00007ff07d6f1619 llvm::OperandTraits<llvm::MemoryUseOrDef>::operands(llvm::MemoryUseOrDef const*) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/include/llvm/Analysis/MemorySSA.h:440:45
#12 0x00007ff07d6f1669 llvm::MemoryUseOrDef::getOperand(unsigned int) const /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/include/llvm/Analysis/MemorySSA.h:445:1
#13 0x00007ff07d6f12af llvm::MemoryUseOrDef::getDefiningAccess() const /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/include/llvm/Analysis/MemorySSA.h:262:67
#14 0x00007ff07eed4ac7 llvm::MemCpyOptPass::processMemCpy(llvm::MemCpyInst*, llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void>, false, false>&) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/lib/Transforms/Scalar/MemCpyOptimizer.cpp:1481:51
#15 0x00007ff07eed5bb8 llvm::MemCpyOptPass::iterateOnFunction(llvm::Function&) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/lib/Transforms/Scalar/MemCpyOptimizer.cpp:1672:42
#16 0x00007ff07eed5fae llvm::MemCpyOptPass::runImpl(llvm::Function&, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::AssumptionCache*, llvm::DominatorTree*, llvm::MemorySSA*) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/lib/Transforms/Scalar/MemCpyOptimizer.cpp:1723:9
#17 0x00007ff07eed5e29 llvm::MemCpyOptPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/lib/Transforms/Scalar/MemCpyOptimizer.cpp:1700:28
#18 0x00007ff081b656e5 llvm::detail::PassModel<llvm::Function, llvm::MemCpyOptPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/include/llvm/IR/PassManagerInternal.h:90:3
#19 0x00007ff07d35c5c5 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/include/llvm/IR/PassManager.h:521:32
#20 0x00007ff080a86983 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/include/llvm/IR/PassManagerInternal.h:90:3
#21 0x00007ff07d35b85a llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/lib/IR/PassManager.cpp:125:22
#22 0x00007ff080a868b3 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/include/llvm/IR/PassManagerInternal.h:90:3
#23 0x00007ff07d35c281 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/include/llvm/IR/PassManager.h:521:32
#24 0x0000556a90e6bd9a llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool) /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/tools/opt/NewPMDriver.cpp:518:10
#25 0x0000556a90e9d2d8 main /home/gabrielbaraldi/julia3/deps/srccache/llvm-julia-16.0.6-0/llvm/tools/opt/opt.cpp:719:27
#26 0x00007ff07ba29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#27 0x00007ff07ba29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#28 0x0000556a90e64b05 _start (./opt+0x1db05)

It seems memcpyop does MSSA->getMemoryAccess(M) which returns a null pointer which isn't guarded.

[nikic]

Can't reproduce: https://llvm.godbolt.org/z/9WY5jxzcW

[gbaraldi]

I reduced with llvm 16 and it does crash in 17. The original does crash in trunk, so lemme reduce there as well

[nikic]

Here's a reduced example that works on trunk: https://llvm.godbolt.org/z/YqhnsM7zc