Skip to content

[Polly] Assertion failure in APInt operator&= during Linux 6.13 kernel module compilation #123927

Open
@ms178

Description

Description
While compiling the Linux kernel module mm/migrate_device.c, clang crashes with an assertion failure in APInt::operator&= during Polly optimization passes. The crash occurs specifically in IslNodeBuilder::preloadInvariantEquivClass while processing the function migrate_vma_collect_pmd.

Steps to Reproduce

  1. You can find the PKGBUILD and all of the used patches in my repo: https://github.com/ms178/archpkgbuilds/tree/main/packages/linux-cachyos
  2. Attempt to compile mm/migrate_device.c with the flags below
  3. Crash occurs during Polly optimization phase

Environment

Compilation Command

clang -Wp,-MMD,mm/.migrate_device.o.d -nostdinc -I./arch/x86/include -I./arch/x86/include/generated \
-I./include -I./include -I./arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I./include/uapi \
-I./include/generated/uapi -include ./include/linux/compiler-version.h -include ./include/linux/kconfig.h \
-include ./include/linux/compiler_types.h -D__KERNEL__ --target=x86_64-linux-gnu -fintegrated-as \
-Werror=ignored-optimization-argument -Werror=option-ignored -std=gnu11 -fshort-wchar -funsigned-char \
-fno-common -fno-PIE -fno-strict-aliasing -mno-sse -mno-mmx -mno-sse2 -fcf-protection=none -m64 \
-falign-loops=1 -mno-80387 -mno-fp-ret-in-387 -mstack-alignment=8 -mskip-rax-setup -march=native \
-mno-red-zone -mcmodel=kernel -O3 -fno-stack-protector -fno-stack-clash-protection -pg -mfentry \
-DCC_USING_NOP_MCOUNT -DCC_USING_FENTRY -fno-lto -flto=thin -fsplit-lto-unit -fvisibility=hidden \
-falign-functions=16 -fstrict-flex-arrays=3 -fno-strict-overflow -fno-stack-check -Wall -Wundef \
-mllvm -polly -mllvm -polly-position=early -mllvm -polly-dependences-computeout=600000 \
-mllvm -polly-detect-profitability-min-per-loop-insts=40 -mllvm -polly-tiling=true \
-mllvm -polly-prevect-width=256 -mllvm -polly-vectorizer=stripmine \
-mllvm -polly-invariant-load-hoisting -mllvm -polly-loopfusion-greedy \
-mllvm -polly-run-inliner -mllvm -polly-run-dce -mllvm -polly-enable-delicm=true \
-c -o mm/migrate_device.o mm/migrate_device.c

Error Message

clang: /home/marcus/toolchain/llvm/llvm-project/llvm/include/llvm/ADT/APInt.h:675: APInt &llvm::APInt::operator&=(const APInt &): Assertion `BitWidth == RHS.BitWidth && "Bit widths must be the same"' failed.

Stack Trace

clang: /home/marcus/toolchain/llvm/llvm-project/llvm/include/llvm/ADT/APInt.h:675: APInt &llvm::APInt::operator&=(const APInt &): Assertion `BitWidth == RHS.BitWidth && "Bit widths must be the same"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: clang -Wp,-MMD,mm/.migrate_device.o.d -nostdinc -I./arch/x86/include -I./arch/x86/include/generated -I./include -I./include -I./arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/compiler-version.h -include ./include/linux/kconfig.h -include ./include/linux/compiler_types.h -D__KERNEL__ --target=x86_64-linux-gnu -fintegrated-as -Werror=ignored-optimization-argument -Werror=option-ignored -std=gnu11 -fshort-wchar -funsigned-char -fno-common -fno-PIE -fno-strict-aliasing -mno-sse -mno-mmx -mno-sse2 -fcf-protection=none -m64 -falign-loops=1 -mno-80387 -mno-fp-ret-in-387 -mstack-alignment=8 -mskip-rax-setup -march=native -mno-red-zone -mcmodel=kernel -Wno-sign-compare -fno-asynchronous-unwind-tables -fno-delete-null-pointer-checks -O3 -fno-stack-protector -fno-stack-clash-protection -pg -mfentry -DCC_USING_NOP_MCOUNT -DCC_USING_FENTRY -fno-lto -flto=thin -fsplit-lto-unit -fvisibility=hidden -falign-functions=16 -fstrict-flex-arrays=3 -fno-strict-overflow -fno-stack-check -Wall -Wundef -Werror=implicit-function-declaration -Werror=implicit-int -Werror=return-type -Wno-format-security -Wno-trigraphs -Wno-frame-address -Wno-address-of-packed-member -Wmissing-declarations -Wmissing-prototypes -Wframe-larger-than=2048 -Wno-gnu -Wvla -Wno-pointer-sign -Wcast-function-type -Wimplicit-fallthrough -Werror=date-time -Wenum-conversion -Wextra -Wunused -Wno-unused-but-set-variable -Wno-unused-const-variable -Wno-format-overflow -Wno-format-overflow-non-kprintf -Wno-format-truncation-non-kprintf -Wno-override-init -Wno-pointer-to-enum-cast -Wno-tautological-constant-out-of-range-compare -Wno-unaligned-access -Wno-enum-compare-conditional -Wno-enum-enum-conversion -Wno-missing-field-initializers -Wno-type-limits -Wno-shift-negative-value -Wno-sign-compare -Wno-unused-parameter -g -gdwarf-5 -gz=zstd -fdebug-info-for-profiling -mllvm -enable-fs-discriminator=true -mllvm -improved-fs-discriminator=true -fprofile-sample-use=/tmp/makepkg/linux-cachyos/src/cachyos-benchmarker.afdo -ffunction-sections -fsplit-machine-functions -fbasic-block-sections=list=/tmp/makepkg/linux-cachyos/src/propeller_cc_profile.txt -ffunction-sections -march=native -mtune=native -mllvm -inline-threshold=1000 -mllvm -polly -mllvm -polly-position=early -mllvm -polly-dependences-computeout=600000 -mllvm -polly-detect-profitability-min-per-loop-insts=40 -mllvm -polly-tiling=true -mllvm -polly-prevect-width=256 -mllvm -polly-vectorizer=stripmine -mllvm -polly-invariant-load-hoisting -mllvm -polly-loopfusion-greedy -mllvm -polly-run-inliner -mllvm -polly-run-dce -mllvm -polly-enable-delicm=true -mllvm -polly -fmerge-all-constants -mllvm -extra-vectorizer-passes -mllvm -enable-cond-stores-vec -mllvm -slp-vectorize-hor-store -mllvm -enable-loopinterchange -mllvm -enable-loop-distribute -mllvm -enable-unroll-and-jam -mllvm -enable-loop-flatten -mllvm -unroll-runtime-multi-exit -mllvm -aggressive-ext-opt -mllvm -enable-interleaved-mem-accesses -mllvm -enable-masked-interleaved-mem-accesses -fno-math-errno -fno-trapping-math -falign-functions=32 -fno-semantic-interposition -fcf-protection=none -mharden-sls=none -fomit-frame-pointer -mllvm -adce-remove-loops -mllvm -enable-ext-tsp-block-placement -mllvm -enable-gvn-hoist -mllvm -enable-dfa-jump-thread -mprefer-vector-width=256 -std=gnu17 -Wno-error -ffp-contract=f  CC [M]  net/wireless/scan.o
ast -fdata-sections -ffunction-sections -fsplit-machine-functions -fgnuc-version=14.2.0 -w -DKBUILD_MODFILE=\"mm/migrate_device\" -DKBUILD_BASENAME=\"migrate_device\" -DKBUILD_MODNAME=\"migrate_device\" -D__KBUILD_MODNAME=kmod_migrate_device -c -o mm/migrate_device.o mm/migrate_device.c
1.      <eof> parser at end of file
2.      Optimizer
3.      Running pass "function(mem2reg,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;no-switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,instcombine<max-iterations=1;no-verify-fixpoint>,loop(indvars),polly::CodePreparationPass,polly::FunctionToScopPassAdaptor<llvm::PassManager<Scop, ScopAnalysisManager, ScopStandardAnalysisResults &, SPMUpdater &>>,sroa<modify-cfg>,early-cse<memssa>,gvn-hoist,speculative-execution<only-if-divergent-target>,jump-threading,correlated-propagation,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm<no-allowspeculation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allowspeculation>,simple-loop-unswitch<nontrivial;trivial>,loop-flatten),simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-interchange,loop-unroll-full),sroa<modify-cfg>,vector-combine,mldst-motion<no-split-footer-bb>,gvn<>,sccp,bdce,instcombine<max-iterations=1;no-verify-fixpoint>,dfa-jump-threading,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm<allowspeculation>),coro-elide,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>)" on module "mm/migrate_device.c"
4.      Running pass "polly::FunctionToScopPassAdaptor<llvm::PassManager<Scop, ScopAnalysisManager, ScopStandardAnalysisResults &, SPMUpdater &>>" on function "migrate_vma_collect_pmd"
 #0 0x000060313a9da066 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) Signals.cpp:0:0
 #1 0x000060313a9d9e4d llvm::sys::CleanupOnSignal(unsigned long) (/home/marcus/llvm20/bin/clang-20+0xf3d9e4d)
 #2 0x000060313a973da0 (anonymous namespace)::CrashRecoveryContextImpl::HandleCrash(int, unsigned long) CrashRecoveryContext.cpp:0:0
 #3 0x000060313a973efd CrashRecoverySignalHandler(int) (.llvm.7482630021576115543) CrashRecoveryContext.cpp:0:0
 #4 0x00007be1a6245f50 (/usr/lib/libc.so.6+0x45f50)
 #5 0x00007be1a62b57ed pthread_kill (/usr/lib/libc.so.6+0xb57ed)
 #6 0x00007be1a6245e92 raise (/usr/lib/libc.so.6+0x45e92)
 #7 0x00007be1a62244a3 abort (/usr/lib/libc.so.6+0x244a3)
 #8 0x00007be1a62243d8 (/usr/lib/libc.so.6+0x243d8)
 #9 0x00007be1a623bde2 (/usr/lib/libc.so.6+0x3bde2)
#10 0x000060313838dbb2 llvm::ConstantFoldBinaryInstruction(unsigned int, llvm::Constant*, llvm::Constant*) (.cold) bolt-pseudo.o:0:0
#11 0x0000603137cff16e polly::IslNodeBuilder::preloadInvariantEquivClass(polly::InvariantEquivClassTy&) (.warm) bolt-pseudo.o:0:0
#12 0x000060313765d583 polly::IslNodeBuilder::preloadInvariantLoads() (/home/marcus/llvm20/bin/clang-20+0xc05d583)
#13 0x000060313768e7f6 generateCode(polly::Scop&, polly::IslAstInfo&, llvm::LoopInfo&, llvm::DominatorTree&, llvm::ScalarEvolution&, llvm::RegionInfo&) CodeGeneration.cpp:0:0
#14 0x00006031378feb45 polly::CodeGenerationPass::run(polly::Scop&, llvm::AnalysisManager<polly::Scop, polly::ScopStandardAnalysisResults&>&, polly::ScopStandardAnalysisResults&, polly::SPMUpdater&) (/home/marcus/llvm20/bin/clang-20+0xc2feb45)
#15 0x00006031378feaad llvm::detail::PassModel<polly::Scop, polly::CodeGenerationPass, llvm::AnalysisManager<polly::Scop, polly::ScopStandardAnalysisResults&>, polly::ScopStandardAnalysisResults&, polly::SPMUpdater&>::run(polly::Scop&, llvm::AnalysisManager<polly::Scop, polly::ScopStandardAnalysisResults&>&, polly::ScopStandardAnalysisResults&, polly::SPMUpdater&) RegisterPasses.cpp:0:0
#16 0x0000603137647d65 llvm::PassManager<polly::Scop, llvm::AnalysisManager<polly::Scop, polly::ScopStandardAnalysisResults&>, polly::ScopStandardAnalysisResults&, polly::SPMUpdater&>::run(polly::Scop&, llvm::AnalysisManager<polly::Scop, polly::ScopStandardAnalysisResults&>&, polly::ScopStandardAnalysisResults&, polly::SPMUpdater&) (/home/marcus/llvm20/bin/clang-20+0xc047d65)
#17 0x00006031376477d6 llvm::detail::PassModel<llvm::Function, polly::FunctionToScopPassAdaptor<llvm::PassManager<polly::Scop, llvm::AnalysisManager<polly::Scop, polly::ScopStandardAnalysisResults&>, polly::ScopStandardAnalysisResults&, polly::SPMUpdater&>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) RegisterPasses.cpp:0:0
#18 0x0000603136f66cd6 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) AMDGPUTargetMachine.cpp:0:0
#19 0x0000603136f664c8 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/marcus/llvm20/bin/clang-20+0xb9664c8)
#20 0x0000603136f662db llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) AMDGPUTargetMachine.cpp:0:0
#21 0x00006031376375d3 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/marcus/llvm20/bin/clang-20+0xc0375d3)
#22 0x0000603137716ced (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#23 0x00006031374cc139 clang::emitBackendOutput(clang::CompilerInstance&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/home/marcus/llvm20/bin/clang-20+0xbecc139)
#24 0x0000603137cefea8 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (.warm) bolt-pseudo.o:0:0
#25 0x0000603136eaa22f clang::ParseAST(clang::Sema&, bool, bool) (/home/marcus/llvm20/bin/clang-20+0xb8aa22f)
#26 0x00006031375e70a9 clang::FrontendAction::Execute() (/home/marcus/llvm20/bin/clang-20+0xbfe70a9)
#27 0x00006031376f4ab3 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/home/marcus/llvm20/bin/clang-20+0xc0f4ab3)
#28 0x00006031376f4fd8 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/home/marcus/llvm20/bin/clang-20+0xc0f4fd8)
#29 0x00006031376f270d cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/home/marcus/llvm20/bin/clang-20+0xc0f270d)
#30 0x00006031376eea32 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#31 0x00006031376ee8d9 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::$_0>(long) Job.cpp:0:0
#32 0x00006031376ee89d llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/home/marcus/llvm20/bin/clang-20+0xc0ee89d)
#33 0x00006031376ee780 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (/home/marcus/llvm20/bin/clang-20+0xc0ee780)
#34 0x00006031376ee574 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/home/marcus/llvm20/bin/clang-20+0xc0ee574)
#35 0x00006031376ee430 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/home/marcus/llvm20/bin/clang-20+0xc0ee430)
#36 0x00006031376ee19f clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/home/marcus/llvm20/bin/clang-20+0xc0ee19f)
#37 0x00006031376f0aff clang_main(int, char**, llvm::ToolContext const&) (/home/marcus/llvm20/bin/clang-20+0xc0f0aff)
#38 0x000060312f3045f2 (/home/marcus/llvm20/bin/clang-20+0x3d045f2)
#39 0x00007be1a6226187 (/usr/lib/libc.so.6+0x26187)
#40 0x00007be1a6226237 __libc_start_main (/usr/lib/libc.so.6+0x26237)
#41 0x000060312f5ee751 _start (/home/marcus/llvm20/bin/clang-20+0x3fee751)
clang: error: clang frontend command failed with exit code 134 (use -v to see invocation)
clang version 20.0.0git (https://github.com/llvm/llvm-project.git e4f03b158c97098e1835cc1f00d0175398974f98)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/marcus/llvm20/bin
Build config: +assertions
clang: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
********************

migrate_device-19b156.c.txt
migrate_device-19b156.sh.txt

Additional Context

  • The crash happens during Polly's code generation phase
  • Occurs while processing the function migrate_vma_collect_pmd
  • The assertion failure indicates mismatched bit widths during an AND operation
  • Using extensive optimization flags including Polly-specific optimizations

Metadata

Assignees

No one assigned

    Labels

    crashPrefer [crash-on-valid] or [crash-on-invalid]polly

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions