weird bug in Julia 1.11 triggered by `@inbounds`

[matthias314]

I've come across the following weird bug. It occurs in the branch popat-bug of my package SmallCollections.jl:

julia> using SmallCollections

julia> firstpopat(v, i) = first(popat(v, i))
firstpopat (generic function with 1 method)

julia> v = MutableSmallVector{16,Float64}(1:16);

julia> firstpopat(v, 1) == first(popat(v, 1))
false

(popat is an non-mutating version of Base.popat!. It returns the shortened vector plus the deleted value.)

The problem is that the values 12.0 and 13.0 are not in the correct order in the vector firstpopat(v, 1):

julia> (firstpopat(v, 1),)
([2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0, 10.0, 11.0, 13.0, 12.0, 14.0, 15.0, 16.0],)

julia> (first(popat(v, 1)),)
([2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0, 10.0, 11.0, 12.0, 13.0, 14.0, 15.0, 16.0],)

I can reproduce the bug consistently on my laptop (see below); on other computers it doesn't show up. Also, it doesn't seem to occur for other types (Float32, Int8 etc.), nor for shorter vectors like v = MutableSmallVector{8,Float64}(1:8), but it does for v = MutableSmallVector{32,Float64}(1:32)). Julia 1.10.10 behaves correctly, Julia 1.12.0-rc1 has the bug.

The bug is triggered by the last line of the following function

@inline function popat(v::FixedVector{N,T}, i::Integer) where {N,T}
    @boundscheck checkbounds(v, i)
    t = ntuple(Val(N)) do j
        if j < i
            v[j]
        elseif j < N
            v[j+1]
        else
            default(T)
        end
    end
    FixedVector{N,T}(t), @inbounds v[i]  # without @inbounds the bug disappears
end

see https://github.com/matthias314/SmallCollections.jl/blob/008bad01e0c812984f59dfbf47414dcf14b4f4d9/src/staticvectors.jl#L125-L137. What makes this particularly weird is that the value v[i] is subsequently ignored through first. Maybe it's an LLVM issue.

Laptop info:

Julia Version 1.11.6
Commit 9615af0f269 (2025-07-09 12:58 UTC)
Build Info:
  Official https://julialang.org/ release
Platform Info:
  OS: Linux (x86_64-linux-gnu)
  CPU: 4 × Intel(R) Core(TM) i3-10110U CPU @ 2.10GHz
  WORD_SIZE: 64
  LLVM: libLLVM-16.0.6 (ORCJIT, skylake)

[xal-0]

I'm able to reproduce this with -C:

$ julia +1.11 -C generic test.jl
true
$ julia +1.11 -C haswell test.jl
true
$ julia +1.11 -C broadwell test.jl
true
$ julia +1.11 -C skylake test.jl
false
$ julia +1.11 -C goldmont test.jl
true
$ julia +1.11 -C goldmont-plus test.jl
true
$ julia +1.11 -C sapphirerapids test.jl
true

It appears to happen on 1.12, but not nightly (1a1270d). Looks like an LLVM bug that has been fixed between version 18 and 20?

	1.11.6	1.12.0-rc1	1a1270d
generic
haswell
broadwell
skylake	bad	bad
goldmont
goldmont-plus
sapphirerapids

[matthias314]

It can get worse:

julia> v = MutableSmallVector{35,Float64}((1,));

julia> firstpopat(v, 1)

[28030] signal 11 (1): Segmentation fault
in expression starting at REPL[4]:1
_ZN4llvm13slpvectorizer7BoUpSLP13vectorizeTreeERNS_9MapVectorIPNS_5ValueENS_11SmallVectorIPNS_11InstructionELj2EEENS_8DenseMapIS4_jNS_12DenseMapInfoIS4_vEENS_6detail12DenseMapPairIS4_jEEEESt6vectorISt4pairIS4_S8_ESaISI_EEEES7_ at /usr/local/julia-1.11.6/bin/../lib/julia/libLLVM-16jl.so (unknown line)
_ZN4llvm13slpvectorizer7BoUpSLP13vectorizeTreeEv at /usr/local/julia-1.11.6/bin/../lib/julia/libLLVM-16jl.so (unknown line)
_ZN4llvm17SLPVectorizerPass18tryToVectorizeListENS_8ArrayRefIPNS_5ValueEEERNS_13slpvectorizer7BoUpSLPEb at /usr/local/julia-1.11.6/bin/../lib/julia/libLLVM-16jl.so (unknown line)
_Z22tryToVectorizeSequenceIN4llvm5ValueEEbRNS0_15SmallVectorImplIPT_EENS0_12function_refIFjS4_EEENS7_IFbS4_S4_EEESB_NS7_IFbNS0_8ArrayRefIS4_EEbEEEb.constprop.0 at /usr/local/julia-1.11.6/bin/../lib/julia/libLLVM-16jl.so (unknown line)
_ZN4llvm17SLPVectorizerPass22vectorizeChainsInBlockEPNS_10BasicBlockERNS_13slpvectorizer7BoUpSLPE at /usr/local/julia-1.11.6/bin/../lib/julia/libLLVM-16jl.so (unknown line)
_ZN4llvm17SLPVectorizerPass7runImplERNS_8FunctionEPNS_15ScalarEvolutionEPNS_19TargetTransformInfoEPNS_17TargetLibraryInfoEPNS_9AAResultsEPNS_8LoopInfoEPNS_13DominatorTreeEPNS_15AssumptionCacheEPNS_12DemandedBitsEPNS_25OptimizationRemarkEmitterE.part.0 at /usr/local/julia-1.11.6/bin/../lib/julia/libLLVM-16jl.so (unknown line)
_ZN4llvm17SLPVectorizerPass3runERNS_8FunctionERNS_15AnalysisManagerIS1_JEEE at /usr/local/julia-1.11.6/bin/../lib/julia/libLLVM-16jl.so (unknown line)
run at /cache/build/tester-amdci4-12/julialang/julia-release-1-dot-11/usr/include/llvm/IR/PassManagerInternal.h:89

EDIT: same for v = MutableSmallVector{49,Float32}((1,)). (It may not happen every time, though.)