[klee-dev] Phi nodes and LLVM11

[Cristian Cadar]

Hi Alastair,

I think your suspicions are reasonable, but perhaps the first thing 
would be to report a small code example that triggers this issue.  Have 
you tried C-Reduce?

Best,
Cristian

On 28/06/2021 15:02, Alastair Reid wrote:
> Hi,
> 
> I am seeing KLEE crash on a large example generated by the Rust compiler 
> with LLVM11 and wonder if you could help suggest some ways to narrow 
> down what is going wrong so that I can submit a usable bug report.
> 
> Given the repeated mention of phi nodes in the error output (below), I 
> wonder if I should be looking in the PhiCleaner pass?
> Or, given the mention of insertelement, I wonder if I should be looking 
> at the Scalarizer pass (because I know that rustc and LLVM11 are 
> aggressively using LLVM11's generic vector intrinsics.
> Any thoughts?
> 
> 
> 
> What I am seeing is a large number of error reports like this:
> 
> Instruction does not dominate all uses!
>    %.i0385 = phi i64 [ <badref>, <badref> ], [ %.i0664, %2236 ], [ 
> %.i0381, %2227 ], !dbg !30427
>    %.upto04194 = insertelement <4 x i64> undef, i64 %.i0385, i32 0
> 
> terminating in the following message and stack dump.
> 
> PHI nodes not grouped at top of basic block!
>    %.i0345 = phi i64 [ <badref>, <badref> ], [ %.i0679, %2236 ], [ 
> %.i0341, %2227 ]
> label %2370
> in function _ZN4test9run_tests17h3c40b1ee8455d4dbE
> LLVM ERROR: Broken function found, compilation aborted!
>   #0 0x00007efc61604f8f llvm::sys::PrintStackTrace(llvm::raw_ostream&) 
> (/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xbd0f8f)
>   #1 0x00007efc616032c2 llvm::sys::RunSignalHandlers() 
> (/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xbcf2c2)
>   #2 0x00007efc61605465 (/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xbd1465)
>   #3 0x00007efc60597d60 (/lib/x86_64-linux-gnu/libc.so.6+0x3bd60)
>   #4 0x00007efc60597ce1 raise 
> ./signal/../sysdeps/unix/sysv/linux/raise.c:51:1
>   #5 0x00007efc60581537 abort ./stdlib/abort.c:81:7
>   #6 0x00007efc61554d68 (/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xb20d68)
>   #7 0x00007efc61554b88 (/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xb20b88)
>   #8 0x00007efc61781b8f (/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xd4db8f)
>   #9 0x00007efc61714059 
> llvm::FPPassManager::runOnFunction(llvm::Function&) 
> (/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xce0059)
> #10 0x00007efc61719603 llvm::FPPassManager::runOnModule(llvm::Module&) 
> (/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xce5603)
> #11 0x00007efc61714670 llvm::legacy::PassManagerImpl::run(llvm::Module&) 
> (/usr/lib/llvm-11/lib/libLLVM-11.so.1+0xce0670)
> #12 0x000056428d2b590b klee::KModule::checkModule() 
> /usr/local/google/home/adreid/rust/klee/lib/Module/KModule.cpp:378:3
> #13 0x000056428d260f50 std::__uniq_ptr_impl<klee::KModule, 
> std::default_delete<klee::KModule> >::_M_ptr() const 
> /usr/include/c++/10/bits/unique_ptr.h:173:58
> #14 0x000056428d260f50 std::unique_ptr<klee::KModule, 
> std::default_delete<klee::KModule> >::get() const 
> /usr/include/c++/10/bits/unique_ptr.h:422:27
> #15 0x000056428d260f50 std::unique_ptr<klee::KModule, 
> std::default_delete<klee::KModule> >::operator->() const 
> /usr/include/c++/10/bits/unique_ptr.h:416:12
> #16 0x000056428d260f50 
> klee::Executor::setModule(std::vector<std::unique_ptr<llvm::Module, 
> std::default_delete<llvm::Module> >, 
> std::allocator<std::unique_ptr<llvm::Module, 
> std::default_delete<llvm::Module> > > >&, 
> klee::Interpreter::ModuleOptions const&) 
> /usr/local/google/home/adreid/rust/klee/lib/Core/Executor.cpp:567:20
> #17 0x000056428d23fbe0 main 
> /usr/local/google/home/adreid/rust/klee/tools/klee/main.cpp:1415:46
> #18 0x00007efc60582d0a __libc_start_main ./csu/../csu/libc-start.c:308:16
> #19 0x000056428d24f56a _start (bin/klee+0x3a56a)
> Aborted
> 
> 
> 
> _______________________________________________
> klee-dev mailing list
> klee-dev at imperial.ac.uk
> https://mailman.ic.ac.uk/mailman/listinfo/klee-dev
>