Late GC lowering pass crashes due to trying to alloc bitvector with 0xffffffff elements

[maxbennedich]

const TABLE = zeros(UInt64, 100)

@inline function lookup(x::UInt64)
    @inbounds TABLE[x]
end

@inline function add_simd()
    s = UInt64(0)
    @simd for n in UInt64.(1:30)
        s += lookup(n)
    end
    s
end

add_simd()

Expected result: No segmentation fault
Actual result: signal (11): Segmentation fault: 11. Julia crashes.

@code_llvm add_simd() also crashes the same way. @code_native add_simd() gives some more detail:

signal (11): Segmentation fault: 11
in expression starting at no file:0
set_unused_bits at /Users/osx/buildbot/slave/package_osx64/build/usr/include/llvm/ADT/BitVector.h:858 [inlined]
clear_unused_bits at /Users/osx/buildbot/slave/package_osx64/build/usr/include/llvm/ADT/BitVector.h:864 [inlined]
flip at /Users/osx/buildbot/slave/package_osx64/build/usr/include/llvm/ADT/BitVector.h:481 [inlined]
ComputeLiveness at /Users/osx/buildbot/slave/package_osx64/build/src/llvm-late-gc-lowering.cpp:1353
runOnFunction at /Users/osx/buildbot/slave/package_osx64/build/src/llvm-late-gc-lowering.cpp:2169
_ZN4llvm13FPPassManager13runOnFunctionERNS_8FunctionE at /Applications/Julia-1.1.app/Contents/Resources/julia/lib/julia/libLLVM.dylib (unknown line)
_ZN4llvm13FPPassManager11runOnModuleERNS_6ModuleE at /Applications/Julia-1.1.app/Contents/Resources/julia/lib/julia/libLLVM.dylib (unknown line)
_ZN4llvm6legacy15PassManagerImpl3runERNS_6ModuleE at /Applications/Julia-1.1.app/Contents/Resources/julia/lib/julia/libLLVM.dylib (unknown line)
operator() at /Users/osx/buildbot/slave/package_osx64/build/src/jitlayers.cpp:335
addModule at /Users/osx/buildbot/slave/package_osx64/build/usr/include/llvm/ExecutionEngine/Orc/IRCompileLayer.h:57
addModule at /Users/osx/buildbot/slave/package_osx64/build/src/jitlayers.cpp:454
jl_add_to_ee at /Users/osx/buildbot/slave/package_osx64/build/src/jitlayers.cpp:679 [inlined]
jl_finalize_function at /Users/osx/buildbot/slave/package_osx64/build/src/jitlayers.cpp:687
getAddressForFunction at /Users/osx/buildbot/slave/package_osx64/build/src/codegen.cpp:1281
jl_dump_function_asm at /Users/osx/buildbot/slave/package_osx64/build/src/codegen.cpp:1602
_dump_function_linfo at /Users/osx/buildbot/slave/package_osx64/build/usr/share/julia/stdlib/v1.1/InteractiveUtils/src/codeview.jl:97
_dump_function at /Users/osx/buildbot/slave/package_osx64/build/usr/share/julia/stdlib/v1.1/InteractiveUtils/src/codeview.jl:72
_dump_function at /Users/osx/buildbot/slave/package_osx64/build/usr/share/julia/stdlib/v1.1/InteractiveUtils/src/codeview.jl:59 [inlined]
#code_native#9 at /Users/osx/buildbot/slave/package_osx64/build/usr/share/julia/stdlib/v1.1/InteractiveUtils/src/codeview.jl:136 [inlined]
#code_native at ./none:0
jl_fptr_trampoline at /Users/osx/buildbot/slave/package_osx64/build/src/gf.c:1854
#code_native#10 at /Users/osx/buildbot/slave/package_osx64/build/usr/share/julia/stdlib/v1.1/InteractiveUtils/src/codeview.jl:138
jl_fptr_trampoline at /Users/osx/buildbot/slave/package_osx64/build/src/gf.c:1854
code_native at /Users/osx/buildbot/slave/package_osx64/build/usr/share/julia/stdlib/v1.1/InteractiveUtils/src/codeview.jl:138
jl_fptr_trampoline at /Users/osx/buildbot/slave/package_osx64/build/src/gf.c:1854
do_call at /Users/osx/buildbot/slave/package_osx64/build/src/interpreter.c:323
eval_stmt_value at /Users/osx/buildbot/slave/package_osx64/build/src/interpreter.c:362 [inlined]
eval_body at /Users/osx/buildbot/slave/package_osx64/build/src/interpreter.c:759
jl_interpret_toplevel_thunk_callback at /Users/osx/buildbot/slave/package_osx64/build/src/interpreter.c:885
unknown function (ip: 0xfffffffffffffffe)
unknown function (ip: 0x10db4ff2f)
unknown function (ip: 0x0)
jl_interpret_toplevel_thunk at /Users/osx/buildbot/slave/package_osx64/build/src/interpreter.c:894
jl_toplevel_eval_flex at /Users/osx/buildbot/slave/package_osx64/build/src/toplevel.c:764
jl_toplevel_eval at /Users/osx/buildbot/slave/package_osx64/build/src/toplevel.c:773 [inlined]
jl_toplevel_eval_in at /Users/osx/buildbot/slave/package_osx64/build/src/toplevel.c:793
eval at ./boot.jl:328
eval_user_input at /Users/osx/buildbot/slave/package_osx64/build/usr/share/julia/stdlib/v1.1/REPL/src/REPL.jl:85
macro expansion at /Users/osx/buildbot/slave/package_osx64/build/usr/share/julia/stdlib/v1.1/REPL/src/REPL.jl:117 [inlined]
#26 at ./task.jl:259
jl_apply at /Users/osx/buildbot/slave/package_osx64/build/src/./julia.h:1571 [inlined]
start_task at /Users/osx/buildbot/slave/package_osx64/build/src/task.c:572
Allocations: 3613583 (Pool: 3612916; Big: 667); GC: 7
Segmentation fault: 11

This fails on at least Julia 1.1 and master. It works on Julia 1.0, but if I tweak the script a bit, it crashes there too.

julia> versioninfo()
Julia Version 1.1.0-rc1.0
Commit ba87aa3962 (2018-12-31 23:36 UTC)
Platform Info:
  OS: macOS (x86_64-apple-darwin14.5.0)
  CPU: Intel(R) Core(TM) i7-6920HQ CPU @ 2.90GHz
  WORD_SIZE: 64
  LIBM: libopenlibm
  LLVM: libLLVM-6.0.1 (ORCJIT, skylake)

[martinholters]

Works for me on 1.2.0-DEV.109.

[maxbennedich]

Works for me on 1.2.0-DEV.109.

Could you paste the result of versioninfo()?

It repeatedly fails on my Mac, but works on another system:

julia> versioninfo()
Julia Version 1.2.0-DEV.134
Commit 19fedfbb68 (2019-01-09 17:42 UTC)
Platform Info:
  OS: Windows (x86_64-w64-mingw32)
  CPU: Intel(R) Core(TM) i7-5600U CPU @ 2.60GHz
  WORD_SIZE: 64
  LIBM: libopenlibm
  LLVM: libLLVM-6.0.1 (ORCJIT, broadwell)

[maxbennedich]

Also segfaults on the following system with Julia 1.2 (nightly), but not Julia 1.0:

julia> versioninfo()
Julia Version 1.2.0-DEV.141
Commit 0df9b8355b (2019-01-10 02:19 UTC)
Platform Info:
  OS: Linux (x86_64-pc-linux-gnu)
  CPU: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz
  WORD_SIZE: 64
  LIBM: libopenlibm
  LLVM: libLLVM-6.0.1 (ORCJIT, skylake)

[martinholters]

Could you paste the result of versioninfo()?

I've updated in the meantime, still works for me. Here is the version info:

julia> versioninfo()
Julia Version 1.2.0-DEV.141
Commit 0df9b8355b* (2019-01-10 02:19 UTC)
Platform Info:
  OS: Linux (x86_64-linux-gnu)
  CPU: Intel(R) Xeon(R) CPU E5-1620 v2 @ 3.70GHz
  WORD_SIZE: 64
  LIBM: libopenlibm
  LLVM: libLLVM-6.0.1 (ORCJIT, ivybridge)

That is a self-built binary. Are you using a downloaded nightly?

[maxbennedich]

I tried a self-built binary (1.2.0-DEV.146) on the Linux system above, and it crashed the same way.

Maybe CPU related? Since both machines that failed were Skylake.

[tkf]

FYI, it also crashes in my laptop (with skylake CPU). Julia Version 1.2.0-DEV.146.

Full log

julia> versioninfo()
Julia Version 1.2.0-DEV.146
Commit b73d34f87d (2019-01-10 21:13 UTC)
Platform Info:
  OS: Linux (x86_64-pc-linux-gnu)
  CPU: Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz
  WORD_SIZE: 64
  LIBM: libopenlibm
  LLVM: libLLVM-6.0.1 (ORCJIT, skylake)

julia> const TABLE = zeros(UInt64, 100);

julia> @inline function lookup(x::UInt64)
           @inbounds TABLE[x]
       end
lookup (generic function with 1 method)

julia> @inline function add_simd()
           s = UInt64(0)
           @simd for n in UInt64.(1:30)
               s += lookup(n)
           end
           s
       end
add_simd (generic function with 1 method)

julia> add_simd()

signal (11): Segmentation fault
in expression starting at REPL[4]:1
set_unused_bits at /home/takafumi/repos/watch/julia/usr/include/llvm/ADT/BitVector.h:856
clear_unused_bits at /home/takafumi/repos/watch/julia/usr/include/llvm/ADT/BitVector.h:864 [inlined]
flip at /home/takafumi/repos/watch/julia/usr/include/llvm/ADT/BitVector.h:481 [inlined]
ComputeLiveness at /home/takafumi/repos/watch/julia/src/llvm-late-gc-lowering.cpp:1353
runOnFunction at /home/takafumi/repos/watch/julia/src/llvm-late-gc-lowering.cpp:2169
_ZN4llvm13FPPassManager13runOnFunctionERNS_8FunctionE at /home/takafumi/repos/watch/julia/usr/bin/../lib/libLLVM-6.0.so (unknown line)
_ZN4llvm13FPPassManager11runOnModuleERNS_6ModuleE at /home/takafumi/repos/watch/julia/usr/bin/../lib/libLLVM-6.0.so (unknown line)
_ZN4llvm6legacy15PassManagerImpl3runERNS_6ModuleE at /home/takafumi/repos/watch/julia/usr/bin/../lib/libLLVM-6.0.so (unknown line)
operator() at /home/takafumi/repos/watch/julia/src/jitlayers.cpp:335
addModule at /home/takafumi/repos/watch/julia/usr/include/llvm/ExecutionEngine/Orc/IRCompileLayer.h:57 [inlined]
addModule at /home/takafumi/repos/watch/julia/src/jitlayers.cpp:454
jl_add_to_ee at /home/takafumi/repos/watch/julia/src/jitlayers.cpp:679 [inlined]
jl_finalize_function at /home/takafumi/repos/watch/julia/src/jitlayers.cpp:687
getAddressForFunction at /home/takafumi/repos/watch/julia/src/codegen.cpp:1281
jl_generate_fptr at /home/takafumi/repos/watch/julia/src/codegen.cpp:1386
jl_fptr_trampoline at /home/takafumi/repos/watch/julia/src/gf.c:1911
jl_apply_generic at /home/takafumi/repos/watch/julia/src/gf.c:2267
do_call at /home/takafumi/repos/watch/julia/src/interpreter.c:323
eval_value at /home/takafumi/repos/watch/julia/src/interpreter.c:411
eval_stmt_value at /home/takafumi/repos/watch/julia/src/interpreter.c:362 [inlined]
eval_body at /home/takafumi/repos/watch/julia/src/interpreter.c:759
jl_interpret_toplevel_thunk_callback at /home/takafumi/repos/watch/julia/src/interpreter.c:885
unknown function (ip: 0xfffffffffffffffe)
unknown function (ip: 0x7f9bca703d4f)
unknown function (ip: 0xffffffffffffffff)
jl_interpret_toplevel_thunk at /home/takafumi/repos/watch/julia/src/interpreter.c:894
jl_toplevel_eval_flex at /home/takafumi/repos/watch/julia/src/toplevel.c:769
jl_toplevel_eval_flex at /home/takafumi/repos/watch/julia/src/toplevel.c:718
jl_toplevel_eval_in at /home/takafumi/repos/watch/julia/src/toplevel.c:798
eval at ./boot.jl:328
jl_apply_generic at /home/takafumi/repos/watch/julia/src/gf.c:2267
eval_user_input at /home/takafumi/repos/watch/julia/usr/share/julia/stdlib/v1.2/REPL/src/REPL.jl:85
macro expansion at /home/takafumi/repos/watch/julia/usr/share/julia/stdlib/v1.2/REPL/src/REPL.jl:117 [inlined]
#26 at ./task.jl:259
jl_apply_generic at /home/takafumi/repos/watch/julia/src/gf.c:2267
jl_apply at /home/takafumi/repos/watch/julia/src/julia.h:1576 [inlined]
start_task at /home/takafumi/repos/watch/julia/src/task.c:572
unknown function (ip: 0xffffffffffffffff)
Allocations: 7520348 (Pool: 7518845; Big: 1503); GC: 15
zsh: segmentation fault (core dumped)

[vchuravy]

I thought initially that this might have been an alignment issue in the user code,
but this looks like it is a segfault within LLVM.

With a debug build:

julia: /home/vchuravy/builds/julia-debug/usr/include/llvm/ADT/BitVector.h:869: void llvm::BitVector::grow(unsigned int): Assertion `NewCapacity > 0 && "realloc-ing zero space"' failed.

signal (6): Aborted
in expression starting at /home/vchuravy/builds/julia-debug/fail.jl:15
gsignal at /usr/lib/libc.so.6 (unknown line)
abort at /usr/lib/libc.so.6 (unknown line)
__assert_fail_base.cold.0 at /usr/lib/libc.so.6 (unknown line)
__assert_fail at /usr/lib/libc.so.6 (unknown line)
grow at /home/vchuravy/builds/julia-debug/usr/include/llvm/ADT/BitVector.h:869
resize at /home/vchuravy/builds/julia-debug/usr/include/llvm/ADT/BitVector.h:375
MaybeResize at /home/vchuravy/src/julia/src/llvm-late-gc-lowering.cpp:747
NoteUse at /home/vchuravy/src/julia/src/llvm-late-gc-lowering.cpp:824
NoteOperandUses at /home/vchuravy/src/julia/src/llvm-late-gc-lowering.cpp:844
LocalScan at /home/vchuravy/src/julia/src/llvm-late-gc-lowering.cpp:1156
runOnFunction at /home/vchuravy/src/julia/src/llvm-late-gc-lowering.cpp:2168
runOnFunction at /home/vchuravy/src/julia/deps/srccache/llvm-6.0.1/lib/IR/LegacyPassManager.cpp:1520

julia> versioninfo()
Julia Version 1.2.0-DEV.345
Commit 9e301429e5* (2019-02-16 20:05 UTC)
DEBUG build
Platform Info:
  OS: Linux (x86_64-pc-linux-gnu)
  CPU: Intel(R) Core(TM) i7-7660U CPU @ 2.50GHz
  WORD_SIZE: 64
  LIBM: libopenlibm
  LLVM: libLLVM-6.0.1 (ORCJIT, skylake)

[vchuravy]

For some reason we are trying to allocate a BitVector with 0xffffffff elements, which causes an unsigned overflow in (NEW_SIZE + 64)/64 triggering the above assertion.

[maxbennedich]

Thanks for looking into this, really appreciated!