[x86] Undefined temporary symbol .Ltmp0 created by blockaddress

[tetzank]

The backend pass codegenprepare eliminates a basic block from which the address was taken in another function. There seems to be some mechanism in place to prevent this as a second symbol is kept alive even though the basic block it refers to got removed. It gets the following comment in the assembly output:

.Ltmp1:                                 # Address of block that was removed by CodeGen

Unfortunately, the definition of the first temporary symbol .Ltmp0 is lost. At least two blockaddress expressions are required to trigger the issue.

Reproducer:

target datalayout = "i64:64:64-i128:128:128-a0:8:8"
target triple = "x86_64-unknown-linux-gnu"

define void @foo0(ptr %jumpAddr) {
  store ptr blockaddress(@main, %scope2_exit), ptr %jumpAddr, align 8   ; uses .Ltmp0
  ret void
}

define void @foo1(ptr %jumpAddr) {
  store ptr blockaddress(@main, %scope1_exit), ptr %jumpAddr, align 8   ; uses .Ltmp1
  ret void
}

define i64 @main(ptr %p, i1 %c1) {
first:
  br label %loop_head

loop_head:                                        ; preds = %loop_end, %first
  br i1 %c1, label %scope0, label %scope1

scope1:                                           ; preds = %loop_head
  br i1 %c1, label %scope1_exit, label %scope2

scope2:                                           ; preds = %scope1
  br i1 %c1, label %scope2_exit, label %inner

inner:                                            ; preds = %scope2
  br label %scope2_exit

scope2_exit:                                      ; preds = %inner, %scope2
  %phi2 = phi ptr [ %p, %inner ], [ null, %scope2 ]
  br label %scope1_exit

scope1_exit:                                      ; preds = %scope2_exit, %scope1
  %phi1 = phi ptr [ %phi2, %scope2_exit ], [ null, %scope1 ]
  %val1 = load i128, ptr %phi1, align 16
  br label %loop_end

scope0:                                           ; preds = %loop_head
  %ptr0 = select i1 %c1, ptr null, ptr %p
  %val0 = load i128, ptr %ptr0, align 16
  br label %loop_end

loop_end:                                         ; preds = %scope0, %scope1_exit
  %storemerge = phi i128 [ %val1, %scope1_exit ], [ %val0, %scope0 ]
  store i128 %storemerge, ptr %p, align 16
  br label %loop_head
}

The undefined symbol is detected when writing the ELF file.

$ llc --filetype=obj -o out.o minimal.ll
<unknown>:0: error: Undefined temporary symbol .Ltmp0

I was not able to run codegenprepare as a single pass. opt --passes=codegenprepare crashes and llc --passes only works on .mir files.

[llvmbot]

@llvm/issue-subscribers-backend-x86

Author: None (tetzank)

The backend pass **codegenprepare** eliminates a basic block from which the address was taken in another function. There seems to be some mechanism in place to prevent this as a second symbol is kept alive even though the basic block it refers to got removed. It gets the following comment in the assembly output: ``` .Ltmp1: # Address of block that was removed by CodeGen ``` Unfortunately, the definition of the first temporary symbol *.Ltmp0* is lost. At least two blockaddress expressions are required to trigger the issue.

Reproducer:

target datalayout = "i64:64:64-i128:128:128-a0:8:8"
target triple = "x86_64-unknown-linux-gnu"

define void @<!-- -->foo0(ptr %jumpAddr) {
  store ptr blockaddress(@<!-- -->main, %scope2_exit), ptr %jumpAddr, align 8   ; uses .Ltmp0
  ret void
}

define void @<!-- -->foo1(ptr %jumpAddr) {
  store ptr blockaddress(@<!-- -->main, %scope1_exit), ptr %jumpAddr, align 8   ; uses .Ltmp1
  ret void
}

define i64 @<!-- -->main(ptr %p, i1 %c1) {
first:
  br label %loop_head

loop_head:                                        ; preds = %loop_end, %first
  br i1 %c1, label %scope0, label %scope1

scope1:                                           ; preds = %loop_head
  br i1 %c1, label %scope1_exit, label %scope2

scope2:                                           ; preds = %scope1
  br i1 %c1, label %scope2_exit, label %inner

inner:                                            ; preds = %scope2
  br label %scope2_exit

scope2_exit:                                      ; preds = %inner, %scope2
  %phi2 = phi ptr [ %p, %inner ], [ null, %scope2 ]
  br label %scope1_exit

scope1_exit:                                      ; preds = %scope2_exit, %scope1
  %phi1 = phi ptr [ %phi2, %scope2_exit ], [ null, %scope1 ]
  %val1 = load i128, ptr %phi1, align 16
  br label %loop_end

scope0:                                           ; preds = %loop_head
  %ptr0 = select i1 %c1, ptr null, ptr %p
  %val0 = load i128, ptr %ptr0, align 16
  br label %loop_end

loop_end:                                         ; preds = %scope0, %scope1_exit
  %storemerge = phi i128 [ %val1, %scope1_exit ], [ %val0, %scope0 ]
  store i128 %storemerge, ptr %p, align 16
  br label %loop_head
}

The undefined symbol is detected when writing the ELF file.

$ llc --filetype=obj -o out.o minimal.ll
<unknown>:0: error: Undefined temporary symbol .Ltmp0

I was not able to run codegenprepare as a single pass. opt --passes=codegenprepare crashes and llc --passes only works on .mir files.

[tetzank]

Disabling codegenprepare indeed circumvents the problem:

$ llc --disable-cgp --filetype=obj -o out.o minimal.ll  # works fine

codegenprepare can be run with opt the following way:

$ opt --passes='require<profile-summary>,function(codegenprepare)' -S -o cgp.ll minimal.ll

This leads to the following diff:

--- minimal.ll  2025-09-30 14:06:41.920669135 +0000
+++ cgp.ll      2025-09-30 14:07:12.605023233 +0000
@@ -1,13 +1,15 @@
+; ModuleID = 'minimal.ll'
+source_filename = "minimal.ll"
 target datalayout = "i64:64:64-i128:128:128-a0:8:8"
 target triple = "x86_64-unknown-linux-gnu"
 
 define void @foo0(ptr %jumpAddr) {
-  store ptr blockaddress(@main, %scope2_exit), ptr %jumpAddr, align 8   ; uses .Ltmp0
+  store ptr blockaddress(@main, %scope1_exit), ptr %jumpAddr, align 8
   ret void
 }
 
 define void @foo1(ptr %jumpAddr) {
-  store ptr blockaddress(@main, %scope1_exit), ptr %jumpAddr, align 8   ; uses .Ltmp1
+  store ptr blockaddress(@main, %scope1_exit), ptr %jumpAddr, align 8
   ret void
 }
 
@@ -22,17 +24,13 @@
   br i1 %c1, label %scope1_exit, label %scope2
 
 scope2:                                           ; preds = %scope1
-  br i1 %c1, label %scope2_exit, label %inner
+  br i1 %c1, label %scope1_exit, label %inner
 
 inner:                                            ; preds = %scope2
-  br label %scope2_exit
-
-scope2_exit:                                      ; preds = %inner, %scope2
-  %phi2 = phi ptr [ %p, %inner ], [ null, %scope2 ]
   br label %scope1_exit
 
-scope1_exit:                                      ; preds = %scope2_exit, %scope1
-  %phi1 = phi ptr [ %phi2, %scope2_exit ], [ null, %scope1 ]
+scope1_exit:                                      ; preds = %scope2, %inner, %scope1
+  %phi1 = phi ptr [ null, %scope1 ], [ %p, %inner ], [ null, %scope2 ]
   %val1 = load i128, ptr %phi1, align 16
   br label %loop_end

This looks fine to me. bb scope2_exit gets removed and the blockaddress using it is updated.

Backend compilation works fine with this as input:

$ llc --filetype=obj -o out.o cgp.ll  # works fine

The changes in the diff happen exactly in the same way when looking into the backend pipeline with --print-before/after-all.

But I'm wondering. codegenprepare is a function pass. It is executed on @main, but manipulates @foo0 too. Is this allowed?

[arsenm]

This is an illegal use of blockaddress

[marcauberer]

This is an illegal use of blockaddress

@arsenm Can you elaborate more on this? In the LangRef there is only mentioned, that blockaddress to entry blocks is illegal, which is not the case here. Is storing of the address for later use in indirectbr disallowed?

[arsenm]

Yes. It states This value only has defined behavior when used as an operand to the ‘[indirectbr](https://llvm.org/docs/LangRef.html#i-indirectbr)’ or for comparisons against null.. Using the blockaddress from a different function is probably disallowed, but not explicitly documented

[arsenm]

Using the blockaddress from a different function is probably disallowed, but not explicitly documented

There's some limitation about this, but I don't remember what exactly it was.

[tetzank]

Using the blockaddress from a different function is probably disallowed, but not explicitly documented

If this is the case, why does blockaddress take the function as first parameter? Just the label would be enough.

This value only has defined behavior when used as an operand to the ‘indirectbr’ or for comparisons against null.

In the same paragraph it also says:
"This may be passed around as an opaque pointer sized value as long as the bits are not inspected."

For me, the first sentence only expresses that the meaning of the return value of blockaddress is only specified for indirectbr, otherwise it is unspecified and should not be inspected.

Maybe the reproducer is misleading. All indirectbr instructions got removed in this case by other optimizations. Only blockaddress is left. We are basically doing something like this:

define void @foo(i1 %cond, ptr %jumpAddr){
  br i1 %cond, label %bb_true, label %bb_false

bb_true:
  store ptr blockaddress(@bar, %dest_true), ptr %jumpAddr, align 8
  ret void

bb_false:
  store ptr blockaddress(@bar, %dest_false), ptr %jumpAddr, align 8
  ret void
}

define void @bar(i1 %cond){
  %jumpAddr = alloca ptr, align 8
  call void @foo(i1 %cond, ptr %jumpAddr)
  %jumpAddrLoaded = load ptr, ptr %jumpAddr, align 8
  indirectbr ptr %jumpAddrLoaded, [label %dest_true, label %dest_false]

dest_true:
  ; do something
  br label %exit

dest_false:
  ; do some other things
  br label %exit

exit:
  ret void
}

[tetzank]

There is an issue with function passes which change other functions as well, like codegenprepare. Depending on the definition order of the functions in the IR module, these changes to other functions can get lost.

The reproducer in the first comment #161164 (comment)
has the function definition order: foo0, foo1, main

The function pass pipeline is executed in that order: first running all function passes on foo0, then on foo1 and at the end on main. When running codegenprepare on main, it also updates foo0, but foo0 is already done. This update is lost. The blockaddress operand in foo0 is not changed, leading to the undefined symbol.

If the definition order is changed to main, foo0, foo1, then the update is not lost. The blockaddress operand in foo0 is changed.

Link to godbolt
Look at the right side. .Ltmp0 is used but never defined.
In the middle, the assembly output is fine, because foo0 was defined after main.

Reproducer in order main, foo0, foo1 without the issue:

target datalayout = "i64:64:64-i128:128:128-a0:8:8"
target triple = "x86_64-unknown-linux-gnu"

define i64 @main(ptr %p, i1 %c1) {
first:
  br label %loop_head

loop_head:                                        ; preds = %loop_end, %first
  br i1 %c1, label %scope0, label %scope1

scope1:                                           ; preds = %loop_head
  br i1 %c1, label %scope1_exit, label %scope2

scope2:                                           ; preds = %scope1
  br i1 %c1, label %scope2_exit, label %inner

inner:                                            ; preds = %scope2
  br label %scope2_exit

scope2_exit:                                      ; preds = %inner, %scope2
  %phi2 = phi ptr [ %p, %inner ], [ null, %scope2 ]
  br label %scope1_exit

scope1_exit:                                      ; preds = %scope2_exit, %scope1
  %phi1 = phi ptr [ %phi2, %scope2_exit ], [ null, %scope1 ]
  %val1 = load i128, ptr %phi1, align 16
  br label %loop_end

scope0:                                           ; preds = %loop_head
  %ptr0 = select i1 %c1, ptr null, ptr %p
  %val0 = load i128, ptr %ptr0, align 16
  br label %loop_end

loop_end:                                         ; preds = %scope0, %scope1_exit
  %storemerge = phi i128 [ %val1, %scope1_exit ], [ %val0, %scope0 ]
  store i128 %storemerge, ptr %p, align 16
  ret i64 0
}

define void @foo0(ptr %jumpAddr) {
  store ptr blockaddress(@main, %scope2_exit), ptr %jumpAddr, align 8   ; uses .Ltmp0
  ret void
}

define void @foo1(ptr %jumpAddr) {
  store ptr blockaddress(@main, %scope1_exit), ptr %jumpAddr, align 8   ; uses .Ltmp1
  ret void
}