[klee-dev] Phi nodes and LLVM11

[Alastair Reid]

Hi,

I am seeing KLEE crash on a large example generated by the Rust compiler
with LLVM11 and wonder if you could help suggest some ways to narrow down
what is going wrong so that I can submit a usable bug report.

Given the repeated mention of phi nodes in the error output (below), I
wonder if I should be looking in the PhiCleaner pass?
Or, given the mention of insertelement, I wonder if I should be looking at
the Scalarizer pass (because I know that rustc and LLVM11 are aggressively
using LLVM11's generic vector intrinsics.
Any thoughts?



What I am seeing is a large number of error reports like this:

Instruction does not dominate all uses!
  %.i0385 = phi i64 [ <badref>, <badref> ], [ %.i0664, %2236 ], [ %.i0381,
%2227 ], !dbg !30427
  %.upto04194 = insertelement <4 x i64> undef, i64 %.i0385, i32 0

terminating in the following message and stack dump.

PHI nodes not grouped at top of basic block!
  %.i0345 = phi i64 [ <badref>, <badref> ], [ %.i0679, %2236 ], [ %.i0341,
%2227 ]
label %2370
in function _ZN4test9run_tests17h3c40b1ee8455d4dbE
LLVM ERROR: Broken function found, compilation aborted!
 #0 0x00007efc61604f8f llvm::sys::PrintStackTrace(llvm::raw_ostream&)
(/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xbd0f8f)
 #1 0x00007efc616032c2 llvm::sys::RunSignalHandlers()
(/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xbcf2c2)
 #2 0x00007efc61605465 (/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xbd1465)
 #3 0x00007efc60597d60 (/lib/x86_64-linux-gnu/libc.so.6+0x3bd60)
 #4 0x00007efc60597ce1 raise
./signal/../sysdeps/unix/sysv/linux/raise.c:51:1
 #5 0x00007efc60581537 abort ./stdlib/abort.c:81:7
 #6 0x00007efc61554d68 (/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xb20d68)
 #7 0x00007efc61554b88 (/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xb20b88)
 #8 0x00007efc61781b8f (/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xd4db8f)
 #9 0x00007efc61714059 llvm::FPPassManager::runOnFunction(llvm::Function&)
(/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xce0059)
#10 0x00007efc61719603 llvm::FPPassManager::runOnModule(llvm::Module&)
(/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xce5603)
#11 0x00007efc61714670 llvm::legacy::PassManagerImpl::run(llvm::Module&)
(/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xce0670)
#12 0x000056428d2b590b klee::KModule::checkModule()
/usr/local/google/home/adreid/rust/klee/lib/Module/KModule.cpp:378:3
#13 0x000056428d260f50 std::__uniq_ptr_impl<klee::KModule,
std::default_delete<klee::KModule> >::_M_ptr() const
/usr/include/c++/10/bits/unique_ptr.h:173:58
#14 0x000056428d260f50 std::unique_ptr<klee::KModule,
std::default_delete<klee::KModule> >::get() const
/usr/include/c++/10/bits/unique_ptr.h:422:27
#15 0x000056428d260f50 std::unique_ptr<klee::KModule,
std::default_delete<klee::KModule> >::operator->() const
/usr/include/c++/10/bits/unique_ptr.h:416:12
#16 0x000056428d260f50
klee::Executor::setModule(std::vector<std::unique_ptr<llvm::Module,
std::default_delete<llvm::Module> >,
std::allocator<std::unique_ptr<llvm::Module,
std::default_delete<llvm::Module> > > >&, klee::Interpreter::ModuleOptions
const&) /usr/local/google/home/adreid/rust/klee/lib/Core/Executor.cpp:567:20
#17 0x000056428d23fbe0 main
/usr/local/google/home/adreid/rust/klee/tools/klee/main.cpp:1415:46
#18 0x00007efc60582d0a __libc_start_main ./csu/../csu/libc-start.c:308:16
#19 0x000056428d24f56a _start (bin/klee+0x3a56a)
Aborted
-------------- next part --------------
HTML attachment scrubbed and removed