[BOLT] Segmentation fault when optimizing static-pie RELR binary using BOLT

[Andarwinux]

For sampling BOLT, BOLT optimized binary Segmentation fault.

Tested with llvm main, any static-pie binary can reproduce this, but normal static binary has no problem.

[yota9]

Hi. Please provide arch, log, binary to reproduce.

[Andarwinux]

kvtest.c.txt
sqlite3.c.txt

cpu 11800H tigerlake
arch x86_64
system cachyos on wsl2

clang -static-pie -O3 -Wl,-q,-zpack-relative-relocs sqlite3.c kvtest.c -fdebug-info-for-profiling -gline-tables-only -funique-internal-linkage-names

perf record --event cycles:u --branch-filter any,u -- ./a.out --help
Usage: kvtest COMMAND ARGS...

   kvtest init DBFILE --count N --size M --pagesize X

        Generate a new test database file named DBFILE containing N
        BLOBs each of size M bytes.  The page size of the new database
        file will be X.  Additional options:

           --variance V           Randomly vary M by plus or minus V

   kvtest export DBFILE DIRECTORY [--tree]

        Export all the blobs in the kv table of DBFILE into separate
        files in DIRECTORY.  DIRECTORY is created if it does not previously
        exist.  If the --tree option is used, then the blobs are written
        into a hierarchy of directories, using names like 00/00/00,
        00/00/01, 00/00/02, and so forth.  Without the --tree option, all
        files are in the top-level directory with names like 000000, 000001,
        000002, and so forth.

   kvtest stat DBFILE [options]

        Display summary information about DBFILE.  Options:

           --vacuum               Run VACUUM on the database file

   kvtest run DBFILE [options]

        Run a performance test.  DBFILE can be either the name of a
        database or a directory containing sample files.  Options:

           --asc                  Read blobs in ascending order
           --blob-api             Use the BLOB API
           --cache-size N         Database cache size
           --count N              Read N blobs
           --desc                 Read blobs in descending order
           --fsync                Synchronous file writes
           --integrity-check      Run "PRAGMA integrity_check" after test
           --max-id N             Maximum blob key to use
           --mmap N               Mmap as much as N bytes of DBFILE
           --multitrans           Each read or write in its own transaction
           --nocheckpoint         Omit the checkpoint on WAL mode writes
           --nosync               Set "PRAGMA synchronous=OFF"
           --jmode MODE           Set MODE journal mode prior to starting
           --random               Read blobs in a random order
           --start N              Start reading with this blob key
           --stats                Output operating stats before exiting
           --update               Do an overwrite test
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.003 MB perf.data (10 samples) ]

perf2bolt -p perf.data -o perf.fdata a.out
BOLT-INFO: shared object or position-independent executable detected
PERF2BOLT: Starting data aggregation job for perf.data
PERF2BOLT: spawning perf job to read branch events
PERF2BOLT: spawning perf job to read mem events
PERF2BOLT: spawning perf job to read process events
PERF2BOLT: spawning perf job to read task events
BOLT-INFO: Target architecture: x86_64
BOLT-INFO: BOLT version: 9145514fde484916971e6bb147c18f9235a9f2b5
BOLT-INFO: first alloc address is 0x0
BOLT-INFO: creating new program header table at address 0x400000, offset 0x400000
BOLT-INFO: enabling relocation mode
BOLT-INFO: enabling strict relocation mode for aggregation purposes
BOLT-WARNING: split function detected on input : __assert_fail_base.cold. The support is limited in relocation mode
BOLT-ERROR: function __restore_rt/1 is in conflict with FDE [173b5f, 173b69). Skipping.
BOLT-WARNING: sizes differ for function __clone/1. FDE : 52; symbol table : 95. Using max size.
BOLT-WARNING: sizes differ for function clone. FDE : 52; symbol table : 95. Using max size.
BOLT-WARNING: sizes differ for function __clone3/1. FDE : 27; symbol table : 71. Using max size.
BOLT-WARNING: sizes differ for function clone3. FDE : 27; symbol table : 71. Using max size.
BOLT-ERROR: function _dl_tlsdesc_undefweak/1 is in conflict with FDE [1f0e39, 1f0e52). Skipping.
BOLT-WARNING: FDE [0x1d4f6e, 0x1d4f7e) conflicts with function __clone/1(*3)
BOLT-WARNING: FDE [0x1d4f7e, 0x1d4f8f) conflicts with function __clone/1(*3)
BOLT-WARNING: FDE [0x1d4fb5, 0x1d4fc6) conflicts with function __clone3/1(*3)
BOLT-WARNING: FDE [0x1d4fc6, 0x1d4fd7) conflicts with function __clone3/1(*3)
BOLT-ERROR: symbol seen in the middle of the function __BOLT_FDE_FUNCat173b5f. Skipping.
BOLT-ERROR: symbol seen in the middle of the function __BOLT_FDE_FUNCat1f0e39. Skipping.
BOLT-INFO: pre-processing profile using perf data aggregator
BOLT-INFO: binary build-id is:     544f4f41d203e85d
PERF2BOLT: spawning perf job to read buildid list
PERF2BOLT: matched build-id and file name
PERF2BOLT: waiting for perf mmap events collection to finish...
PERF2BOLT: parsing perf-script mmap events output
PERF2BOLT: waiting for perf task events collection to finish...
PERF2BOLT: parsing perf-script task events output
PERF2BOLT: input binary is associated with 1 PID(s)
PERF2BOLT: waiting for perf events collection to finish...
PERF2BOLT: parse branch events...
PERF2BOLT: read 10 samples and 65 LBR entries
PERF2BOLT: 0 samples (0.0%) were ignored
PERF2BOLT: traces mismatching disassembled function contents: 0 (0.0%)
PERF2BOLT: out of range traces involving unknown regions: 0 (0.0%)
PERF2BOLT: waiting for perf mem events collection to finish...
BOLT-INFO: forcing -jump-tables=move as PIC jump table was detected in function sqlite3_db_status
PERF2BOLT: processing branch events...
PERF2BOLT: wrote 29 objects and 0 memory objects to perf.fdata
BOLT-INFO: 6 out of 2745 functions in the binary (0.2%) have non-empty execution profile
BOLT-INFO: 10 functions have instructions with unknown control flow. Use -print-unknown to see the list.

llvm-bolt ./a.out -o a.bolt --dyno-stats --eliminate-unreachable --frame-opt=hot --icf=1 --plt=hot --reorder-blocks=ext-tsp --split-all-cold --split-eh --split-functions --use-gnu-stack --data ./perf.fdata
BOLT-INFO: shared object or position-independent executable detected
BOLT-INFO: Target architecture: x86_64
BOLT-INFO: BOLT version: 9145514fde484916971e6bb147c18f9235a9f2b5
BOLT-INFO: first alloc address is 0x0
BOLT-WARNING: debug info will be stripped from the binary. Use -update-debug-sections to keep it.
BOLT-INFO: enabling relocation mode
BOLT-INFO: enabling lite mode
BOLT-WARNING: split function detected on input : __assert_fail_base.cold. The support is limited in relocation mode
BOLT-ERROR: function __restore_rt/1 is in conflict with FDE [173b5f, 173b69). Skipping.
BOLT-WARNING: sizes differ for function __clone/1. FDE : 52; symbol table : 95. Using max size.
BOLT-WARNING: sizes differ for function clone. FDE : 52; symbol table : 95. Using max size.
BOLT-WARNING: sizes differ for function __clone3/1. FDE : 27; symbol table : 71. Using max size.
BOLT-WARNING: sizes differ for function clone3. FDE : 27; symbol table : 71. Using max size.
BOLT-ERROR: function _dl_tlsdesc_undefweak/1 is in conflict with FDE [1f0e39, 1f0e52). Skipping.
BOLT-WARNING: FDE [0x1d4f6e, 0x1d4f7e) conflicts with function __clone/1(*3)
BOLT-WARNING: FDE [0x1d4f7e, 0x1d4f8f) conflicts with function __clone/1(*3)
BOLT-WARNING: FDE [0x1d4fb5, 0x1d4fc6) conflicts with function __clone3/1(*3)
BOLT-WARNING: FDE [0x1d4fc6, 0x1d4fd7) conflicts with function __clone3/1(*3)
BOLT-ERROR: symbol seen in the middle of the function __BOLT_FDE_FUNCat173b5f. Skipping.
BOLT-ERROR: symbol seen in the middle of the function __BOLT_FDE_FUNCat1f0e39. Skipping.
BOLT-INFO: pre-processing profile using branch profile reader
BOLT-INFO: forcing -jump-tables=move as PIC jump table was detected in function init_cpu_features.constprop.0/1(*2)
BOLT-INFO: 5 out of 2745 functions in the binary (0.2%) have non-empty execution profile
BOLT-INFO: 1 function with profile could not be optimized
BOLT-INFO: the input contains 4 (dynamic count : 1) opportunities for macro-fusion optimization. Will fix instances on a hot path.
BOLT-INFO: 200 instructions were shortened
BOLT-INFO: removed 11 empty blocks
BOLT-INFO: basic block reordering modified layout of 3 functions (60.00% of profiled, 0.11% of total)
BOLT-INFO: splitting separates 414 hot bytes from 4741 cold bytes (8.03% of split functions is hot).
BOLT-INFO: 0 Functions were reordered by LoopInversionPass
BOLT-INFO: program-wide dynostats after all optimizations before SCTC and FOP:

                   7 : executed forward branches
                   2 : taken forward branches
                  86 : executed backward branches
                  28 : taken backward branches
                   0 : executed unconditional branches
                   6 : all function calls
                   0 : indirect calls
                   0 : PLT calls
                 407 : executed instructions
                  71 : executed load instructions
                  22 : executed store instructions
                   0 : taken jump table branches
                   0 : taken unknown indirect branches
                  93 : total branches
                  30 : taken branches
                  63 : non-taken conditional branches
                  30 : taken conditional branches
                  93 : all conditional branches

                  41 : executed forward branches (+485.7%)
                   1 : taken forward branches (-50.0%)
                  52 : executed backward branches (-39.5%)
                  20 : taken backward branches (-28.6%)
                   7 : executed unconditional branches (+600.0%)
                   6 : all function calls (=)
                   0 : indirect calls (=)
                   0 : PLT calls (=)
                 428 : executed instructions (+5.2%)
                  71 : executed load instructions (=)
                  22 : executed store instructions (=)
                   0 : taken jump table branches (=)
                   0 : taken unknown indirect branches (=)
                 100 : total branches (+7.5%)
                  28 : taken branches (-6.7%)
                  72 : non-taken conditional branches (+14.3%)
                  21 : taken conditional branches (-30.0%)
                  93 : all conditional branches (=)

BOLT-INFO: FOP optimized 0 redundant load(s) and 0 unused store(s)
BOLT-INFO: Frequency of redundant loads is 0 and frequency of unused stores is 0
BOLT-INFO: Frequency of loads changed to use a register is 0 and frequency of loads changed to use an immediate is 0
BOLT-INFO: FOP deleted 0 load(s) (dyn count: 0) and 0 store(s)
BOLT-INFO: FRAME ANALYSIS: 2740 function(s) were not optimized.
BOLT-INFO: FRAME ANALYSIS: 3 function(s) (92.4% dyn cov) could not have its frame indices restored.
BOLT-INFO: Shrink wrapping moved 0 spills inserting load/stores and 0 spills inserting push/pops
BOLT-INFO: Shrink wrapping reduced 0 store executions (0.0% total instructions executed, 0.0% store instructions)
BOLT-INFO: Shrink wrapping failed at reducing 0 store executions (0.0% total instructions executed, 0.0% store instructions)
BOLT-INFO: Allocation combiner: 0 empty spaces coalesced (dyn count: 0).
BOLT-INFO: patched build-id (flipped last bit)

./a.bolt
Segmentation fault (core dumped)

[yota9]

Most likely would be fixed by #100866
But also turned out that sometimes BOLT is currently limited on opt static binaries so it would just abort during optimisation when this patch would be applied #100801 So currently closing the issue as I'm quite sure it duplicates other static-related issues as #100096 . Fill free to re-open it if you've got further questions