Compiler segfaults when compiling the vte crate for aarch64

[cramertj]

Only reproduces when doing a debug build of rustc for the aarch64-fuchsia target, the aarch64-unknown-linux-gnu target, and presumably others. rustc produces no output, but returns a failure status code. Building with cargo just says "compiling vte v0.3.2... error: could not compile vte". The log and backtrace can be found here.

To reproduce, run this command, which calls this script, which attempts to compile this crate inside of a fuchsia checkout.

Compiling with cargo build -v shows that there's a SIGSEGV being triggered:

Caused by:
  process didn't exit successfully: `/usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/bin/rustc --crate-name vte vendor/vte/src/lib.rs --color always --crate-type lib --emit=dep-info,link -C debuginfo=2 -C metadata=7dbc2e4c2a7c8274 -C extra-filename=-7dbc2e4c2a7c8274 --out-dir /usr/local/google/home/cramertj/src/fuchsia/out/arm64/rust_third_party/aarch64-fuchsia/debug/deps --target aarch64-fuchsia -C linker=/usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/clang/bin/clang -L dependency=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/rust_third_party/aarch64-fuchsia/debug/deps -L dependency=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/rust_third_party/debug/deps --extern utf8parse=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/rust_third_party/aarch64-fuchsia/debug/deps/libutf8parse-f80c351b97daf887.rlib --cap-lints allow -Clink-arg=--target=aarch64-fuchsia -Copt-level=0 -Clink-arg=--sysroot=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/sdks/zircon_sysroot/arch/arm64/sysroot -Lnative=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/arm64-shared` (signal: 11, SIGSEGV: invalid memory reference)

Running this rustc command directly shows rustc failing with a segmentation fault:

/usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/bin/rustc --crate-name vte vendor/vte/src/lib.rs --color always --crate-type lib --emit=dep-info,link -C debuginfo=2 -C metadata=7dbc2e4c2a7c8274 -C extra-filename=-7dbc2e4c2a7c8274 --out-dir /usr/local/google/home/cramertj/src/fuchsia/out/arm64/rust_third_party/aarch64-fuchsia/debug/deps --target aarch64-fuchsia -C linker=/usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/clang/bin/clang -L dependency=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/rust_third_party/aarch64-fuchsia/debug/deps -L dependency=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/rust_third_party/debug/deps --extern utf8parse=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/rust_third_party/aarch64-fuchsia/debug/deps/libutf8parse-f80c351b97daf887.rlib --cap-lints allow -Clink-arg=--target=aarch64-fuchsia -Copt-level=0 -Clink-arg=--sysroot=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/sdks/zircon_sysroot/arch/arm64/sysroot -Lnative=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/arm64-shared
[1]    141780 segmentation fault   --crate-name vte vendor/vte/src/lib.rs --color always --crate-type lib  -C 

Running inside gdb gives

Starting program: /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/bin/rustc --crate-name vte vendor/vte/src/lib.rs --color always --crate-type lib --emit=dep-info,link -C debuginfo=2 -C metadata=7dbc2e4c2a7c8274 -C extra-filename=-7dbc2e4c2a7c8274 --out-dir /usr/local/google/home/cramertj/src/fuchsia/out/arm64/rust_third_party/aarch64-fuchsia/debug/deps --target aarch64-fuchsia -C linker=/usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/clang/bin/clang -L dependency=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/rust_third_party/aarch64-fuchsia/debug/deps -L dependency=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/rust_third_party/debug/deps --extern utf8parse=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/rust_third_party/aarch64-fuchsia/debug/deps/libutf8parse-f80c351b97daf887.rlib --cap-lints allow -Clink-arg=--target=aarch64-fuchsia -Copt-level=0 -Clink-arg=--sysroot=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/sdks/zircon_sysroot/arch/arm64/sysroot -Lnative=/usr/local/google/home/cramertj/src/fuchsia/out/arm64/arm64-shared
Dwarf Error: wrong version in compilation unit header (is 0, should be 2, 3, or 4) [in module /usr/lib/debug/.build-id/ef/9474f02d7f7a3959b6dae0afe8e6acee1ac5ba.debug]
Dwarf Error: wrong version in compilation unit header (is 0, should be 2, 3, or 4) [in module /usr/lib/debug/.build-id/7b/5f153d3f24f886129354bf9e6a32d01607e87a.debug]
Dwarf Error: wrong version in compilation unit header (is 0, should be 2, 3, or 4) [in module /usr/lib/debug/.build-id/18/ad48fb80336dd6554ce9d61ecb3ccb7f6befa3.debug]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Dwarf Error: wrong version in compilation unit header (is 0, should be 2, 3, or 4) [in module /usr/lib/debug/.build-id/cb/88f1fe155855433a969d01f052923b299701b8.debug]
Dwarf Error: wrong version in compilation unit header (is 0, should be 2, 3, or 4) [in module /usr/lib/debug/.build-id/45/2d8247a2b64710d413dfc84b6d7c8924aca427.debug]
[New Thread 0x7fffe9bff700 (LWP 148074)]
[New Thread 0x7fffea1ff700 (LWP 148073)]
[New Thread 0x7fffea9fe700 (LWP 148071)]
[New Thread 0x7fffeabff700 (LWP 148070)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe9bff700 (LWP 148074)]
0x00007fffee25db31 in llvm::AArch64RegisterBankInfo::getInstrMapping(llvm::MachineInstr const&) const ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so

That's a failure in llvm::AArch64RegisterBankInfo::getInstrMapping.

Backtrace:

#0  0x00007fffee25db31 in llvm::AArch64RegisterBankInfo::getInstrMapping(llvm::MachineInstr const&) const ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#1  0x00007fffee2a95ab in llvm::RegBankSelect::assignInstr(llvm::MachineInstr&) ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#2  0x00007fffee2a985b in llvm::RegBankSelect::runOnMachineFunction(llvm::MachineFunction&) ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#3  0x00007fffee64c5e1 in llvm::MachineFunctionPass::runOnFunction(llvm::Function&) ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#4  0x00007fffef025b8a in llvm::FPPassManager::runOnFunction(llvm::Function&) ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#5  0x00007fffef025c33 in llvm::FPPassManager::runOnModule(llvm::Module&) ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#6  0x00007fffef02649c in llvm::legacy::PassManagerImpl::run(llvm::Module&) ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#7  0x00007fffedbe035e in LLVMRustWriteOutputFile ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#8  0x00007fffeda9602a in rustc_codegen_llvm::back::write::write_output_file::hc1598394e3dc1211 ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#9  0x00007fffeda887fd in rustc_codegen_llvm::back::write::codegen::_$u7b$$u7b$closure$u7d$$u7d$::hd52935e011270cea ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#10 0x00007fffeda84088 in rustc::util::common::time_ext::h95d6f9755793118d ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#11 0x00007fffeda98317 in rustc_codegen_llvm::back::write::codegen::hb3c2e05dc727551f ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#12 0x00007fffeda9f5c0 in rustc_codegen_llvm::back::write::execute_work_item::hbe07d0cf915f5ac7 ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#13 0x00007fffeda6ce7e in std::sys_common::backtrace::__rust_begin_short_backtrace::h1bfae061eb41ee5c ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#14 0x00007fffeda8fdb8 in std::panicking::try::do_call::hdd25355d6215f15f ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#15 0x00007ffff76ae00a in __rust_maybe_catch_panic ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/bin/../lib/libstd-5fd27a9c989d76ae.so
#16 0x00007fffeda7b581 in _$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::h2db209aaa27400ee ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#17 0x00007ffff76760ab in std::sys_common::thread::start_thread::hb5e82cfc8bd3d75e ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/bin/../lib/libstd-5fd27a9c989d76ae.so
#18 0x00007ffff7672336 in std::sys::unix::thread::Thread::new::thread_start::h4be83cd1b9373083 ()
   from /usr/local/google/home/cramertj/src/fuchsia/buildtools/linux-x64/rust/bin/../lib/libstd-5fd27a9c989d76ae.so
#19 0x00007ffff1946494 in start_thread (arg=0x7fffe9bff700) at pthread_create.c:333
#20 0x00007ffff7365a8f in clone () from /lib/x86_64-linux-gnu/libc.so.6

This error does not occur on revision 8acec1, so the LLVM 7 upgrade (#51966) might be at fault here (cc @alexcrichton).

Edit: Confirmed-- I bisected this locally to the LLVM 7 upgrade (Fuchsia compiles fine before, compiler segfaults after).

[alexcrichton]

@cramertj do you think you'd be able to get the LLVM IR out to submit a test case to LLVM? If not I can try to do so as well. IF the IR can be extracted we can also run it against the master branch of LLVM to see if this bug has already been fixed.

[cramertj]

Rust VTE crate LLVM IR for aarch64-unknown-linux-gnu target (which also segfaults).

[cramertj]

This looks very similar to https://bugs.llvm.org//show_bug.cgi?id=33191, which was fixed in https://www.mail-archive.com/cfe-commits@lists.llvm.org/msg56359.html.

In other news, running llc on this LLVM IR with -O0 gives

llc: /b/s/w/ir/kitchen-workdir/llvm-project/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp:144: IRTranslator::ValueToVRegInfo::VRegListT &llvm::IRTranslator::allocateVRegs(const llvm::Value &): Assertion `!VMap.contains(Val) && "Value already allocated in VMap"' failed.
[1]    229235 abort      ./llc ~/src/vte/vte-1a91a6433ea8e7b6.15uuiki9s1a8yvyu.rcgu.ll -O0

That's this assertion.

Backtrace:

#0  0x00007ffff713ffcf in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007ffff71413fa in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00007ffff7138e37 in __assert_fail_base () from /lib/x86_64-linux-gnu/libc.so.6
#3  0x00007ffff7138ee2 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
#4  0x0000000002ba17b6 in llvm::IRTranslator::allocateVRegs(llvm::Value const&) ()
#5  0x0000000002ba073c in llvm::IRTranslator::translateExtractValue(llvm::User const&, llvm::MachineIRBuilder&) ()
#6  0x0000000002b97a34 in llvm::IRTranslator::translate(llvm::Instruction const&) ()
#7  0x0000000002b95c08 in llvm::IRTranslator::runOnMachineFunction(llvm::MachineFunction&) ()
#8  0x0000000001f24666 in llvm::MachineFunctionPass::runOnFunction(llvm::Function&) ()
#9  0x00000000022fa482 in llvm::FPPassManager::runOnFunction(llvm::Function&) ()
#10 0x00000000022f9d78 in llvm::FPPassManager::runOnModule(llvm::Module&) ()
#11 0x00000000022fbe50 in llvm::legacy::PassManagerImpl::run(llvm::Module&) ()
#12 0x0000000001572fc7 in ?? ()
#13 0x000000000156f2ab in main ()

[cramertj]

Bytecode of testcase reduced using bugpoint, and the LLVM IR

[cramertj]

# good: [509f29ac17874394acf4d49d6bae3cd93c652aa1] [WebAssembly] Fix fast-isel optimization of branch conditions.
git bisect good 509f29ac17874394acf4d49d6bae3cd93c652aa1
# bad: [03684905101f0b7e49dfe530e54dc1aeac6ef0fb] Fix compile on dist-x86_64-linux builder
git bisect bad 03684905101f0b7e49dfe530e54dc1aeac6ef0fb
# bad: [2c3c78e685eeaed179014d9d5fc6e279ca28b70a] Make ICF log output order deterministic.
git bisect bad 2c3c78e685eeaed179014d9d5fc6e279ca28b70a
# bad: [1b838dc9f8531990d7d8fcaa0abd144ce0407f29] Remove left-over debug printout from r321692
git bisect bad 1b838dc9f8531990d7d8fcaa0abd144ce0407f29

[cramertj]

Reported as https://bugs.llvm.org/show_bug.cgi?id=38396

[alexcrichton]

Wow that was a super quick fix!

@cramertj the next steps here would be to backport that commit to our branch in rust-lang/llvm, and then an update of the submodule in this repository