Skip to content

clang crashes -O3 with -g on x86_64-linux-gnu: Assertion `virtReg.isVirtual()' failed #208229

Open
Bug
Open
clang crashes -O3 with -g on x86_64-linux-gnu: Assertion `virtReg.isVirtual()' failed#208229
Bug
Labels
confirmedVerified by a second partycrash-on-validllvm:codegen

Description

@zhendongsu
zhendongsu
opened on Jul 8, 2026

Compiler Explorer: https://godbolt.org/z/Pdn95hEYG

Note:

[513] % clangtk -v
clang version 23.0.0git (https://github.com/llvm/llvm-project.git e0093262487e101d3c13773bf313cd3641544cd8)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/11
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/12
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/12
Candidate multilib: .;@m64
Candidate multilib: 32;@m32
Candidate multilib: x32;@mx32
Selected multilib: .;@m64
Found CUDA installation: /usr/local/cuda, version 12.1
[514] % 
[514] % clangtk -O3 -g -c -w small.c
clangtk: /local/suz-local/software/clangbuild/llvm-project/llvm/include/llvm/CodeGen/VirtRegMap.h:173: int llvm::VirtRegMap::getStackSlot(llvm::Register) const: Assertion `virtReg.isVirtual()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0.	Program arguments: clangtk -I/usr/local/include -I/local/suz-local/software/local/include -O3 -g -c -w small.c
1.	<eof> parser at end of file
2.	Code generation
3.	Running pass 'Function Pass Manager' on module 'small.c'.
4.	Running pass 'Virtual Register Rewriter' on function '@m'
 #0 0x000055a8f8758b19 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x44bbb19)
 #1 0x000055a8f875586c llvm::sys::RunSignalHandlers() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x44b886c)
 #2 0x000055a8f87560c2 llvm::sys::CleanupOnSignal(unsigned long) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x44b90c2)
 #3 0x000055a8f868faa8 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #4 0x00007fd438211520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #5 0x00007fd4382659fc __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
 #6 0x00007fd4382659fc __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
 #7 0x00007fd4382659fc pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
 #8 0x00007fd438211476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #9 0x00007fd4381f77f3 abort ./stdlib/./stdlib/abort.c:81:7
#10 0x00007fd4381f771b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#11 0x00007fd438208e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#12 0x000055a8f78cf57c llvm::LiveDebugVariables::LDVImpl::emitDebugValues(llvm::VirtRegMap*) (.part.0) LiveDebugVariables.cpp:0:0
#13 0x000055a8f7d0225e (anonymous namespace)::VirtRegRewriter::run(llvm::MachineFunction&) VirtRegMap.cpp:0:0
#14 0x000055a8f7d028e6 (anonymous namespace)::VirtRegRewriterLegacy::runOnMachineFunction(llvm::MachineFunction&) VirtRegMap.cpp:0:0
#15 0x000055a8f7998cfc llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#16 0x000055a8f8002115 llvm::FPPassManager::runOnFunction(llvm::Function&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x3d65115)
#17 0x000055a8f80026f9 llvm::FPPassManager::runOnModule(llvm::Module&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x3d656f9)
#18 0x000055a8f80030e2 (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) LegacyPassManager.cpp:0:0
#19 0x000055a8f800381b llvm::legacy::PassManagerImpl::run(llvm::Module&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x3d6681b)
#20 0x000055a8f8b7e79f (anonymous namespace)::EmitAssemblyHelper::TimeCodegenPasses(llvm::function_ref<void ()>) BackendUtil.cpp:0:0
#21 0x000055a8f8b8d148 (anonymous namespace)::EmitAssemblyHelper::emitAssembly(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream> >, clang::BackendConsumer*) BackendUtil.cpp:0:0
#22 0x000055a8f8b8d4d8 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream> >, clang::BackendConsumer*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x48f04d8)
#23 0x000055a8f926dbca clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x4fd0bca)
#24 0x000055a8fadbc95c clang::ParseAST(clang::Sema&, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x6b1f95c)
#25 0x000055a8f95c72b1 clang::FrontendAction::Execute() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x532a2b1)
#26 0x000055a8f9551085 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x52b4085)
#27 0x000055a8f96c3293 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x5426293)
#28 0x000055a8f50d41d6 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0xe371d6)
#29 0x000055a8f50c9cda ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>) driver.cpp:0:0
#30 0x000055a8f50c9e6f int llvm::function_ref<int (llvm::SmallVectorImpl<char const*>&)>::callback_fn<clang_main(int, char**, llvm::ToolContext const&)::'lambda'(llvm::SmallVectorImpl<char const*>&)>(long, llvm::SmallVectorImpl<char const*>&) driver.cpp:0:0
#31 0x000055a8f92e659d void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#32 0x000055a8f868fec0 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x43f2ec0)
#33 0x000055a8f92e73a3 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, bool*) const (.part.0) Job.cpp:0:0
#34 0x000055a8f929f1f7 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x50021f7)
#35 0x000055a8f92a02df clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*> >&, bool) const (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x50032df)
#36 0x000055a8f92afdd4 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*> >&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x5012dd4)
#37 0x000055a8f50cf643 clang_main(int, char**, llvm::ToolContext const&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0xe32643)
#38 0x000055a8f4fea451 main (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0xd4d451)
#39 0x00007fd4381f8d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#40 0x00007fd4381f8e40 call_init ./csu/../csu/libc-start.c:128:20
#41 0x00007fd4381f8e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#42 0x000055a8f50c9305 _start (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0xe2c305)
clangtk: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 23.0.0git (https://github.com/llvm/llvm-project.git e0093262487e101d3c13773bf313cd3641544cd8)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
clangtk: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING CRASH REPRODUCER FILES TO THE BUG REPORT:
clangtk: note: diagnostic msg: /tmp/small-5ec762.c
clangtk: note: diagnostic msg: /tmp/small-5ec762.sh
clangtk: note: diagnostic msg: 

********************
Aborted

int a, b, d, aa, o, p;
float n;
long ab, *ac, q, r, **s;
char *t;
void c(int, int u) { a = u; }
int e(int) {}
void f(int, int) {}
int g() {}
char h(int) {}
void i(int) {}
void j(short, int, double);
void k(int, int) {}
int l(int, int, int, int, int) {}
int m(int, int, int, int, int) { j(0, 65, 0); }
void j(short v, int u, double w) {
  char ai = 1;
  __attribute__((__vector_size__(4 * sizeof(long)))) long aj;
  int ak = l(0, 0, 0, 0, 0) + 7;
  t = &ai;
  b = **s;
  (a < 4) > o;
  if (!t)
    __builtin_trap();
  if (__builtin_object_size(t, 0) && __builtin_object_size(t, 0) < t)
    __builtin_trap();
  if (5 * ai + *t)
    goto an;
  goto ao;
an:
  ak = 124276037 * -u;
ap:
  *t = 1 + ai;
  *t = 8 / ai - 020 - 2;
  p = 7 + v << 8 >> 8;
  if (21 * u - ~ak <= (1 >> u) + 70799987)
    goto aq;
  goto ar;
aq:
  ab = 4 + ai << 6 >> 6;
  ab = 8 + ai << 6 >> 6 + ak << 2 >> 2;
  if (1 / -v)
    goto as;
  goto at;
as:
au:
  aj[3] = ak = -(5 * u);
  if (5 + (w >= 0 ? a : 6079194117335))
    goto aw;
  if (s)
    __builtin_trap();
  if (__builtin_object_size(s, 0) && (s, 0) < s)
    __builtin_trap();
  ac = *s;
  if (-u == 0 ?: 4 >= v + 3271532716 ^ v)
    goto ar;
  goto ap;
ar:
  *ac = a + 8 * a + 909 >> a;
  r = a + ({
        if (ac)
          if (__builtin_object_size(c, 0) && __builtin_object_size(c, 0) < c)
            __builtin_trap();
        *ac;
      }) + 4095178122 <
      a - 1071117696702 * -(4079532423982981706 > ab);
  aj[0] = ab - ((long)u > 2) - 4007640243192377;
  if ((short)((unsigned short)v >> v) - v <=
      v + (0 != m(0, ai, 0, 0, 0) ?: -23809))
    if (ak + ai ?: 2 + 6 * ak + 1008463959903676123 ^ -ak)
      goto az;
ao:
  g(n) ?: -ak ?: 1 + ak ?: -(u <= 0 ?: n ?: ak) - a - (w ?: 7);
  f((w ?: 4 >> u) - ak - aa, ai ?: -w ?: 7);
  k(0, 0);
  i(2 / ak + 7053191 * ak > -a - 8 + ab - b + -u - ak + ak * a);
  p = 6 * ak + ((long)ai << 6 >> 6) +
      e(508242036 * ak + v >= 0 ?: --d - 8 << a) - (1 < u);
  if (3 * v + 31114529064 * (v > e) - v * v)
    a = (ai << 6 >> 6) + 4 + 807293886 - 601326873229 - 102347628363495700;
  *ac = ab - 404162581959962 * ab + 2058719587384 - -(u == 0 ?: 10980800746);
  if (9 * ai + 3 & ai - 1 + ab - (ai > 6) - 4 * ai)
    goto bb;
aw:
  q = ai > 6;
  aj * 5010805477576880131 * a &ai;
  if (ac)
    __builtin_trap();
  if (+v - 4026783476109504208 % a)
  at:
    t - ai;
  *ac = ab = -ai << 6 >> 6 & ak == 0 ?: 109930979088391 - -h(7 + a) - ~ai;
bb:
  if (!ac)
    __builtin_trap();
  if (__builtin_object_size(c, 0) && __builtin_object_size(ac, 0) < ac)
    __builtin_trap();
  aj[2] = *ac;
  if (4 * a)
    goto au;
az:
  c(0, aj[1]);
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    confirmedVerified by a second partycrash-on-validllvm:codegen

    Type

    Bug

    Fields

    No fields configured for Bug.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions