Clang crashes when compiling with profiled data using PGO #166092
Description
The crash happens on the latest commit eda719f12cc68de5240e7a5f1c0c62
$ clang-trunk -v
clang version 22.0.0git (https://github.com/llvm/llvm-project.git eda719f12cc68de5240e7a5f1c0c62cf955af343)
Target: x86_64-unknown-linux-gnu
Thread model: posix
When compiling with profiled data generated as
$ clang-trunk -O3 -fprofile-instr-generate abc.c
$ LLVM_PROFILE_FILE="code.profraw" ./a.out
$ /path/to/llvm-profdata merge -output=code.profdata code.profraw
the following crash happens
$ clang-trunk -O3 -fprofile-instr-use=code.profdata abc.c
clang-22: /data/soft/trunk/llvm-project/llvm/lib/Support/BranchProbability.cpp:41: llvm::BranchProbability::BranchProbability(uint32_t, uint32_t): Assertion `Denominator > 0 && "Denominator cannot be 0!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0. Program arguments: /data/installed/root-clang/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O3 -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name abc.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/home/absozero/projects/reduce -fprofile-instrument-use=clang -fprofile-instrument-use-path=code.profdata -fcoverage-compilation-dir=/home/absozero/projects/reduce -resource-dir /data/installed/root-clang/lib/clang/22 -I/data/installed/root-bin/include/ -internal-isystem /data/installed/root-clang/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fmessage-length=176 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/abc-3dc9be.o -x c abc.c
1. <eof> parser at end of file
2. Optimizer
3. Running pass "function<eager-inv>(drop-unnecessary-assumes,float2int,lower-constant-intrinsics,chr,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-arithmetic;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O3>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;switch-to-arithmetic;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "abc.c"
4. Running pass "loop-unroll<O3>" on function "j"
#0 0x00005ee8b9d2e5a2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/data/installed/root-clang/bin/clang-22+0x43e95a2)
#1 0x00005ee8b9d2b29f llvm::sys::RunSignalHandlers() (/data/installed/root-clang/bin/clang-22+0x43e629f)
#2 0x00005ee8b9d2b3ec SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x0000759931845330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x000075993189eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#5 0x000075993189eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#6 0x000075993189eb2c pthread_kill ./nptl/pthread_kill.c:89:10
#7 0x000075993184527e raise ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007599318288ff abort ./stdlib/abort.c:81:7
#9 0x000075993182881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x000075993183b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#11 0x00005ee8b9c42dc8 llvm::BranchProbability::getBranchProbability(unsigned long, unsigned long) (/data/installed/root-clang/bin/clang-22+0x42fddc8)
#12 0x00005ee8b9e63043 llvm::getLoopProbability(llvm::Loop*) (/data/installed/root-clang/bin/clang-22+0x451e043)
#13 0x00005ee8b9e52b75 llvm::UnrollLoop(llvm::Loop*, llvm::UnrollLoopOptions, llvm::LoopInfo*, llvm::ScalarEvolution*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::TargetTransformInfo const*, llvm::OptimizationRemarkEmitter*, bool, llvm::Loop**, llvm::AAResults*) (/data/installed/root-clang/bin/clang-22+0x450db75)
#14 0x00005ee8b9b65ded tryToUnrollLoop(llvm::Loop*, llvm::DominatorTree&, llvm::LoopInfo*, llvm::ScalarEvolution&, llvm::TargetTransformInfo const&, llvm::AssumptionCache&, llvm::OptimizationRemarkEmitter&, llvm::BlockFrequencyInfo*, llvm::ProfileSummaryInfo*, bool, int, bool, bool, bool, std::optional<unsigned int>, std::optional<unsigned int>, std::optional<bool>, std::optional<bool>, std::optional<bool>, std::optional<bool>, std::optional<bool>, std::optional<unsigned int>, llvm::AAResults*) LoopUnrollPass.cpp:0:0
#15 0x00005ee8b9b688ea llvm::LoopUnrollPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/data/installed/root-clang/bin/clang-22+0x42238ea)
#16 0x00005ee8badd07a5 llvm::detail::PassModel<llvm::Function, llvm::LoopUnrollPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/data/installed/root-clang/bin/clang-22+0x548b7a5)
#17 0x00005ee8b9643da5 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/data/installed/root-clang/bin/clang-22+0x3cfeda5)
#18 0x00005ee8b6cef945 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/data/installed/root-clang/bin/clang-22+0x13aa945)
#19 0x00005ee8b96424a1 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/data/installed/root-clang/bin/clang-22+0x3cfd4a1)
#20 0x00005ee8b6cf0085 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/data/installed/root-clang/bin/clang-22+0x13ab085)
#21 0x00005ee8b9642c8d llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/data/installed/root-clang/bin/clang-22+0x3cfdc8d)
#22 0x00005ee8b9fe9102 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#23 0x00005ee8b9fed0dd clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/data/installed/root-clang/bin/clang-22+0x46a80dd)
#24 0x00005ee8ba674830 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/data/installed/root-clang/bin/clang-22+0x4d2f830)
#25 0x00005ee8bc16f6ac clang::ParseAST(clang::Sema&, bool, bool) (/data/installed/root-clang/bin/clang-22+0x682a6ac)
#26 0x00005ee8ba99f8f7 clang::FrontendAction::Execute() (/data/installed/root-clang/bin/clang-22+0x505a8f7)
#27 0x00005ee8ba9256ee clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/data/installed/root-clang/bin/clang-22+0x4fe06ee)
#28 0x00005ee8baa98c0e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/data/installed/root-clang/bin/clang-22+0x5153c0e)
#29 0x00005ee8b686208b cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/data/installed/root-clang/bin/clang-22+0xf1d08b)
#30 0x00005ee8b68575d7 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>) driver.cpp:0:0
#31 0x00005ee8b685c34e clang_main(int, char**, llvm::ToolContext const&) (/data/installed/root-clang/bin/clang-22+0xf1734e)
#32 0x00005ee8b66f273a main (/data/installed/root-clang/bin/clang-22+0xdad73a)
#33 0x000075993182a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#34 0x000075993182a28b call_init ./csu/../csu/libc-start.c:128:20
#35 0x000075993182a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#36 0x00005ee8b6856b45 _start (/data/installed/root-clang/bin/clang-22+0xf11b45)
clang-trunk: error: unable to execute command: Aborted
clang-trunk: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.0.0git (https://github.com/llvm/llvm-project.git eda719f12cc68de5240e7a5f1c0c62cf955af343)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /data/installed/root-clang/bin
Build config: +assertions
clang-trunk: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-trunk: note: diagnostic msg: /tmp/abc-93a8ec.c
clang-trunk: note: diagnostic msg: /tmp/abc-93a8ec.sh
clang-trunk: note: diagnostic msg:
********************
The test file is
int a, b, d;
short c;
char e;
void f(void);
int g(int *h) { return *h; }
char j() {
e = 16;
for (; e != 25; e = e + 9) {
int i = 0;
for (; i;)
;
a = 25;
for (; a > -29; a--) {
for (; i < 8; i++)
;
f();
for (; d;)
b = 3;
}
}
return 3;
}
void f() {
if (g(&a))
c = 0;
}
int main() { j(); }