Skip to content

[Clang][Polly] Crash in Polly during code generation for libjpeg-turbo's jtransform_adjust_parameters #117877

@ms178

Description

@ms178

I encountered a crash in Clang 20.0git 0cb5846 while compiling the libjpeg-turbo-git (3.0.90.r10.g9758c8a7) library with aggressive optimizations, including Polly, OpenMP, and LTO. The crash occurs during the compilation of src/transupp.c, specifically within the function jtransform_adjust_parameters.

1. Crash Information:

  • Compiler Version: Clang 20.0git 0cb5846
  • Operating System: CachyOS
  • Architecture: x86_64
  • Source File: src/transupp.c (from libjpeg-turbo)
  • Function: jtransform_adjust_parameters
  • Optimization Flags:
    -I/tmp/makepkg/libjpeg-turbo-git/src/libjpeg-turbo/_build
    -I/tmp/makepkg/libjpeg-turbo-git/src/libjpeg-turbo/src
    -D_FORTIFY_SOURCE=0
    -O3
    -march=native
    -mtune=native
    -mllvm -inline-threshold=1500
    -mllvm -polly
    -mllvm -polly-position=early
    -mllvm -polly-dependences-computeout=6000000
    -mllvm -polly-detect-profitability-min-per-loop-insts=40
    -mllvm -polly-tiling=true
    -mllvm -polly-prevect-width=256
    -mllvm -polly-vectorizer=stripmine
    -mllvm -polly-invariant-load-hoisting
    -mllvm -polly-loopfusion-greedy
    -mllvm -polly-run-inliner
    -mllvm -polly-run-dce
    -mllvm -polly-enable-delicm=true
    -mllvm -polly
    -fmerge-all-constants
    -mllvm -polly-parallel
    -fopenmp
    -fopenmp-version=52
    -mllvm -polly-omp-backend=LLVM
    -mllvm -polly-num-threads=28
    -mllvm -polly-scheduling=dynamic
    -mllvm -polly-scheduling-chunksize=1
    -mllvm -extra-vectorizer-passes
    -mllvm -enable-cond-stores-vec
    -mllvm -slp-vectorize-hor-store
    -mllvm -enable-loopinterchange
    -mllvm -enable-loop-distribute
    -mllvm -enable-unroll-and-jam
    -mllvm -enable-loop-flatten
    -mllvm -unroll-runtime-multi-exit
    -mllvm -aggressive-ext-opt
    -mllvm -enable-interleaved-mem-accesses
    -mllvm -enable-masked-interleaved-mem-accesses
    -fno-math-errno
    -fno-trapping-math
    -falign-functions=32
    -funroll-loops
    -fno-semantic-interposition
    -fcf-protection=none
    -mharden-sls=none
    -fomit-frame-pointer
    -mprefer-vector-width=256
    -flto=thin
    -fsplit-lto-unit
    -mllvm -adce-remove-loops
    -mllvm -enable-ext-tsp-block-placement=1
    -mllvm -enable-gvn-hoist=1
    -mllvm -enable-dfa-jump-thread=1
    -Wno-error
    -fprofile-use=/home/marcus/Downloads/libjpg.profdata
    -fdata-sections
    -ffunction-sections
    -fno-unique-section-names
    -fsplit-machine-functions
    -mtls-dialect=gnu2
    -fgnuc-version=14.2.0
    -w
    -O3
    -DNDEBUG
    -std=gnu23
    -DBMP_SUPPORTED
    -DPPM_SUPPORTED
    -MD -MT CMakeFiles/turbojpeg-static.dir/src/transupp.c.o -MF CMakeFiles/turbojpeg-static.dir/src/transupp.c.o.d -o CMakeFiles/turbojpeg-static.dir/src/transupp.c.o -c
  • Build System: CMake

Crash Output/Stack Trace:

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: /usr/bin/clang -I/tmp/makepkg/libjpeg-turbo-git/src/libjpeg-turbo/_build -I/tmp/makepkg/libjpeg-turbo-git/src/libjpeg-turbo/src -D_FORTIFY_SOURCE=0 -O3 -march=native -mtune=native -mllvm -inline-threshold=1500 -mllvm -polly -mllvm -polly-position=early -mllvm -polly-dependences-computeout=6000000 -mllvm -polly-detect-profitability-min-per-loop-insts=40 -mllvm -polly-tiling=true -mllvm -polly-prevect-width=256 -mllvm -polly-vectorizer=stripmine -mllvm -polly-invariant-load-hoisting -mllvm -polly-loopfusion-greedy -mllvm -polly-run-inliner -mllvm -polly-run-dce -mllvm -polly-enable-delicm=true -mllvm -polly -fmerge-all-constants -mllvm -polly-parallel -fopenmp -fopenmp-version=52 -mllvm -polly-omp-backend=LLVM -mllvm -polly-num-threads=28 -mllvm -polly-scheduling=dynamic -mllvm -polly-scheduling-chunksize=1 -mllvm -extra-vectorizer-passes -mllvm -enable-cond-stores-vec -mllvm -slp-vectorize-hor-store -mllvm -enable-loopinterchange -mllvm -enable-loop-distribute -mllvm -enable-unroll-and-jam -mllvm -enable-loop-flatten -mllvm -unroll-runtime-multi-exit -mllvm -aggressive-ext-opt -mllvm -enable-interleaved-mem-accesses -mllvm -enable-masked-interleaved-mem-accesses -fno-math-errno -fno-trapping-math -falign-functions=32 -funroll-loops -fno-semantic-interposition -fcf-protection=none -mharden-sls=none -fomit-frame-pointer -mprefer-vector-width=256 -flto=thin -fsplit-lto-unit -mllvm -adce-remove-loops -mllvm -enable-ext-tsp-block-placement=1 -mllvm -enable-gvn-hoist=1 -mllvm -enable-dfa-jump-thread=1 -Wno-error -fprofile-use=/home/marcus/Downloads/libjpg.profdata -fdata-sections -ffunction-sections -fno-unique-section-names -fsplit-machine-functions -mtls-dialect=gnu2 -fgnuc-version=14.2.0 -w -O3 -DNDEBUG -std=gnu23 -DBMP_SUPPORTED -DPPM_SUPPORTED -MD -MT CMakeFiles/turbojpeg-static.dir/src/transupp.c.o -MF CMakeFiles/turbojpeg-static.dir/src/transupp.c.o.d -o CMakeFiles/turbojpeg-static.dir/src/transupp.c.o -c /tmp/makepkg/libjpeg-turbo-git/src/libjpeg-turbo/src/transupp.c
1.      <eof> parser at end of file
2.      Optimizer
3.      Running pass "function(mem2reg,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;no-switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,instcombine<max-iterations=1;no-verify-fixpoint>,loop(indvars),polly::CodePreparationPass,polly::FunctionToScopPassAdaptor<llvm::PassManager<Scop, ScopAnalysisManager, ScopStandardAnalysisResults &, SPMUpdater &>>,sroa<modify-cfg>,early-cse<memssa>,gvn-hoist,speculative-execution<only-if-divergent-target>,jump-threading,correlated-propagation,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm<no-allowspeculation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allowspeculation>,simple-loop-unswitch<nontrivial;trivial>,loop-flatten),simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,loop(loop-idiom,indvars,simple-loop-unswitch<nontrivial;trivial>,loop-deletion,loop-interchange,loop-unroll-full),sroa<modify-cfg>,vector-combine,mldst-motion<no-split-footer-bb>,gvn<>,sccp,bdce,instcombine<max-iterations=1;no-verify-fixpoint>,dfa-jump-threading,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm<allowspeculation>),coro-elide,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>)" on module "/tmp/makepkg/libjpeg-turbo-git/src/libjpeg-turbo/src/transupp.c"
4.      Running pass "polly::FunctionToScopPassAdaptor<llvm::PassManager<Scop, ScopAnalysisManager, ScopStandardAnalysisResults &, SPMUpdater &>>" on function "jtransform_adjust_parameters"
 #0 0x00007dd2646ef8e8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/bin/../lib/libLLVM.so.20.0git+0x30ef8e8)
 #1 0x00007dd2646ef072 llvm::sys::CleanupOnSignal(unsigned long) (/usr/bin/../lib/libLLVM.so.20.0git+0x30ef072)
 #2 0x00007dd26464cbb3 (/usr/bin/../lib/libLLVM.so.20.0git+0x304cbb3)
 #3 0x00007dd2613fb530 (/usr/bin/../lib/libc.so.6+0x47530)
 #4 0x00007dd26402e8d4 llvm::DominatorTreeBase<llvm::BasicBlock, false>::dominates(llvm::BasicBlock const*, llvm::BasicBlock const*) const (/usr/bin/../lib/libLLVM.so.20.0git+0x2a2e8d4)
 #5 0x00007dd26613474d llvm::RegionBase<llvm::RegionTraits<llvm::Function>>::contains(llvm::BasicBlock const*) const (/usr/bin/../lib/libLLVM.so.20.0git+0x4b3474d)
 #6 0x00007dd2679d128b polly::VirtualUse::create(polly::Scop*, polly::ScopStmt*, llvm::Loop*, llvm::Value*, bool) (/usr/bin/../lib/libLLVM.so.20.0git+0x63d128b)
 #7 0x00007dd26799cd23 polly::BlockGenerator::getNewValue(polly::ScopStmt&, llvm::Value*, llvm::DenseMap<llvm::AssertingVH<llvm::Value>, llvm::AssertingVH<llvm::Value>, llvm::DenseMapInfo<llvm::AssertingVH<llvm::Value>, void>, llvm::detail::DenseMapPair<llvm::AssertingVH<llvm::Value>, llvm::AssertingVH<llvm::Value>>>&, llvm::DenseMap<llvm::Loop const*, llvm::SCEV const*, llvm::DenseMapInfo<llvm::Loop const*, void>, llvm::detail::DenseMapPair<llvm::Loop const*, llvm::SCEV const*>>&, llvm::Loop*) const (/usr/bin/../lib/libLLVM.so.20.0git+0x639cd23)
 #8 0x00007dd26799e742 polly::BlockGenerator::copyInstScalar(polly::ScopStmt&, llvm::Instruction*, llvm::DenseMap<llvm::AssertingVH<llvm::Value>, llvm::AssertingVH<llvm::Value>, llvm::DenseMapInfo<llvm::AssertingVH<llvm::Value>, void>, llvm::detail::DenseMapPair<llvm::AssertingVH<llvm::Value>, llvm::AssertingVH<llvm::Value>>>&, llvm::DenseMap<llvm::Loop const*, llvm::SCEV const*, llvm::DenseMapInfo<llvm::Loop const*, void>, llvm::detail::DenseMapPair<llvm::Loop const*, llvm::SCEV const*>>&) (/usr/bin/../lib/libLLVM.so.20.0git+0x639e742)
 #9 0x00007dd2679a527a polly::RegionGenerator::copyStmt(polly::ScopStmt&, llvm::DenseMap<llvm::Loop const*, llvm::SCEV const*, llvm::DenseMapInfo<llvm::Loop const*, void>, llvm::detail::DenseMapPair<llvm::Loop const*, llvm::SCEV const*>>&, isl_id_to_ast_expr*) (/usr/bin/../lib/libLLVM.so.20.0git+0x63a527a)
#10 0x00007dd26799572f polly::IslNodeBuilder::createUser(isl_ast_node*) (/usr/bin/../lib/libLLVM.so.20.0git+0x639572f)
#11 0x00007dd26798fbca polly::IslNodeBuilder::createForSequential(isl::ast_node_for, bool) (/usr/bin/../lib/libLLVM.so.20.0git+0x638fbca)
#12 0x00007dd26798f0ed polly::IslNodeBuilder::createMark(isl_ast_node*) (/usr/bin/../lib/libLLVM.so.20.0git+0x638f0ed)
#13 0x00007dd26798fbca polly::IslNodeBuilder::createForSequential(isl::ast_node_for, bool) (/usr/bin/../lib/libLLVM.so.20.0git+0x638fbca)
#14 0x00007dd267993877 polly::IslNodeBuilder::createFor(isl_ast_node*) (/usr/bin/../lib/libLLVM.so.20.0git+0x6393877)
#15 0x00007dd26798f166 polly::IslNodeBuilder::createMark(isl_ast_node*) (/usr/bin/../lib/libLLVM.so.20.0git+0x638f166)
#16 0x00007dd26798fbca polly::IslNodeBuilder::createForSequential(isl::ast_node_for, bool) (/usr/bin/../lib/libLLVM.so.20.0git+0x638fbca)
#17 0x00007dd267993877 polly::IslNodeBuilder::createFor(isl_ast_node*) (/usr/bin/../lib/libLLVM.so.20.0git+0x6393877)
#18 0x00007dd2679923d3 polly::IslNodeBuilder::createForParallel(isl_ast_node*) (/usr/bin/../lib/libLLVM.so.20.0git+0x63923d3)
#19 0x00007dd2679958dc polly::IslNodeBuilder::createBlock(isl_ast_node*) (/usr/bin/../lib/libLLVM.so.20.0git+0x63958dc)
#20 0x00007dd26798f166 polly::IslNodeBuilder::createMark(isl_ast_node*) (/usr/bin/../lib/libLLVM.so.20.0git+0x638f166)
#21 0x00007dd2679958dc polly::IslNodeBuilder::createBlock(isl_ast_node*) (/usr/bin/../lib/libLLVM.so.20.0git+0x63958dc)
#22 0x00007dd2678f6060 (/usr/bin/../lib/libLLVM.so.20.0git+0x62f6060)
#23 0x00007dd2678f50aa polly::CodeGenerationPass::run(polly::Scop&, llvm::AnalysisManager<polly::Scop, polly::ScopStandardAnalysisResults&>&, polly::ScopStandardAnalysisResults&, polly::SPMUpdater&) (/usr/bin/../lib/libLLVM.so.20.0git+0x62f50aa)
#24 0x00007dd2678e1a89 (/usr/bin/../lib/libLLVM.so.20.0git+0x62e1a89)
#25 0x00007dd26795cfb2 llvm::PassManager<polly::Scop, llvm::AnalysisManager<polly::Scop, polly::ScopStandardAnalysisResults&>, polly::ScopStandardAnalysisResults&, polly::SPMUpdater&>::run(polly::Scop&, llvm::AnalysisManager<polly::Scop, polly::ScopStandardAnalysisResults&>&, polly::ScopStandardAnalysisResults&, polly::SPMUpdater&) (/usr/bin/../lib/libLLVM.so.20.0git+0x635cfb2)
#26 0x00007dd2678e9799 (/usr/bin/../lib/libLLVM.so.20.0git+0x62e9799)
#27 0x00007dd263e212d8 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/usr/bin/../lib/libLLVM.so.20.0git+0x28212d8)
#28 0x00007dd263e20f0d (/usr/bin/../lib/libLLVM.so.20.0git+0x2820f0d)
#29 0x00007dd263e76e05 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/usr/bin/../lib/libLLVM.so.20.0git+0x2876e05)
#30 0x00007dd263e76bed (/usr/bin/../lib/libLLVM.so.20.0git+0x2876bed)
#31 0x00007dd26414efc5 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/usr/bin/../lib/libLLVM.so.20.0git+0x2b4efc5)
#32 0x00007dd26b48e523 (/usr/bin/../lib/libclang-cpp.so.20.0git+0x308e523)
#33 0x00007dd269921db2 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/usr/bin/../lib/libclang-cpp.so.20.0git+0x1521db2)
#34 0x00007dd26991f1f1 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/usr/bin/../lib/libclang-cpp.so.20.0git+0x151f1f1)
#35 0x00007dd2696e4590 clang::ParseAST(clang::Sema&, bool, bool) (/usr/bin/../lib/libclang-cpp.so.20.0git+0x12e4590)
#36 0x00007dd26c62c770 clang::FrontendAction::Execute() (/usr/bin/../lib/libclang-cpp.so.20.0git+0x422c770)
#37 0x00007dd26c56c25f clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/usr/bin/../lib/libclang-cpp.so.20.0git+0x416c25f)
#38 0x00007dd26c6ae777 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/usr/bin/../lib/libclang-cpp.so.20.0git+0x42ae777)
#39 0x000000000041069e cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/usr/bin/clang+0x41069e)
#40 0x000000000040c903 (/usr/bin/clang+0x40c903)
#41 0x00007dd26c0e0899 (/usr/bin/../lib/libclang-cpp.so.20.0git+0x3ce0899)
#42 0x00007dd26464cd9e llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/usr/bin/../lib/libLLVM.so.20.0git+0x304cd9e)
#43 0x00007dd26998e240 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (/usr/bin/../lib/libclang-cpp.so.20.0git+0x158e240)
#44 0x00007dd26984bb05 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/usr/bin/../lib/libclang-cpp.so.20.0git+0x144bb05)
#45 0x00007dd26c0dbd0c clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/usr/bin/../lib/libclang-cpp.so.20.0git+0x3cdbd0c)
#46 0x000000000040b31a clang_main(int, char**, llvm::ToolContext const&) (/usr/bin/clang+0x40b31a)
#47 0x0000000000409635 main (/usr/bin/clang+0x409635)
#48 0x00007dd2613da127 (/usr/bin/../lib/libc.so.6+0x26127)
#49 0x00007dd2613da1e4 __libc_start_main (/usr/bin/../lib/libc.so.6+0x261e4)
#50 0x000000000040c441 _start (/usr/bin/clang+0x40c441)
clang: error: clang frontend command failed with exit code 139 (use -v to see invocation)
clang version 20.0.0git (/home/marcus/Downloads/llvm-git/llvm-project 0cb5846a68cc5c5e519b2c80ab106e7e4fc6eedb)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
clang: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/transupp-2fe439.c
clang: note: diagnostic msg: /tmp/transupp-2fe439.sh 

transupp-2fe439.c.txt
transupp-2fe439.sh.txt
transupp-f787bc.c.txt
transupp-f787bc.sh.txt

Additional Notes:

  • The crash seems to be related to Polly's interaction with dominance analysis and virtual use creation during code generation.
  • The large number of optimization flags and the use of OpenMP and LTO might be contributing factors.

Metadata

Metadata

Assignees

No one assigned

    Labels

    crashPrefer [crash-on-valid] or [crash-on-invalid]polly

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions