SIGSEGV during benchmark but build succeeds

[AuroransSolis]

I've fallen victim to the Wordle bug and started writing a thing to analyse winning games for initial guesses and such. After getting to a certain point I decided to try benchmarking parts of it, and wrote a little file to do so. Then when I ran cargo criterion, I ended up getting:

/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-74fd03a38d82f654.so(+0x4c1b43)[0x7ffff47acb43]
/lib64/libpthread.so.0(+0x12170)[0x7ffff3f30170]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-14-rust-1.61.0-nightly.so(_ZN4llvm12SelectionDAG18ReplaceAllUsesWithEPNS_6SDNodeEPKNS_7SDValueE+0x108)[0x7ffff1621be8]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-14-rust-1.61.0-nightly.so(+0x299e066)[0x7ffff15d9066]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-14-rust-1.61.0-nightly.so(_ZN4llvm12SelectionDAG7CombineENS_12CombineLevelEPNS_9AAResultsENS_10CodeGenOpt5LevelE+0x18b3)[0x7ffff15ba063]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-14-rust-1.61.0-nightly.so(_ZN4llvm16SelectionDAGISel17CodeGenAndEmitDAGEv+0x60)[0x7ffff15a65c0]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-14-rust-1.61.0-nightly.so(_ZN4llvm16SelectionDAGISel20SelectAllBasicBlocksERKNS_8FunctionE+0x7cf)[0x7ffff15997bf]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-14-rust-1.61.0-nightly.so(_ZN4llvm16SelectionDAGISel20runOnMachineFunctionERNS_15MachineFunctionE+0x4ec)[0x7ffff159631c]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-14-rust-1.61.0-nightly.so(+0x295ae14)[0x7ffff1595e14]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-14-rust-1.61.0-nightly.so(_ZN4llvm19MachineFunctionPass13runOnFunctionERNS_8FunctionE+0xaa)[0x7ffff1b96d3a]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-14-rust-1.61.0-nightly.so(_ZN4llvm13FPPassManager13runOnFunctionERNS_8FunctionE+0x681)[0x7ffff19b2fb1]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-14-rust-1.61.0-nightly.so(_ZN4llvm13FPPassManager11runOnModuleERNS_6ModuleE+0x2f)[0x7ffff19b290f]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-14-rust-1.61.0-nightly.so(_ZN4llvm6legacy15PassManagerImpl3runERNS_6ModuleE+0x289)[0x7ffff1eaecb9]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-74fd03a38d82f654.so(+0x23e62a4)[0x7ffff66d12a4]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-74fd03a38d82f654.so(+0x23d7197)[0x7ffff66c2197]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-74fd03a38d82f654.so(+0x23da386)[0x7ffff66c5386]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-74fd03a38d82f654.so(+0x2377238)[0x7ffff6662238]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-74fd03a38d82f654.so(+0x2371337)[0x7ffff665c337]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-74fd03a38d82f654.so(+0x2391732)[0x7ffff667c732]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/librustc_driver-74fd03a38d82f654.so(+0x2380bc7)[0x7ffff666bbc7]
/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/libstd-1b64d5fe7a3c3d7f.so(rust_metadata_std_b2e3e412d3925f11+0xab5b3)[0x7ffff40265b3]
/lib64/libpthread.so.0(+0x7d00)[0x7ffff3f25d00]
/lib64/libc.so.6(clone+0x3f)[0x7ffff3e41bef]
warning: `wordle-guesser` (bench "wordle-bench") generated 10 warnings (3 duplicates)
error: could not compile `wordle-guesser`; 10 warnings emitted

Caused by:
  process didn't exit successfully: `rustc --crate-name wordle_bench --edition=2021 src/bench.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --emit=dep-info,link -C opt-level=3 -C lto -C codegen-units=1 --cfg test -C metadata=dd75e050583d5687 -C extra-filename=-dd75e050583d5687 --out-dir /storage/projects/wordle-guesser/target/release/deps -L dependency=/storage/projects/wordle-guesser/target/release/deps --extern criterion=/storage/projects/wordle-guesser/target/release/deps/libcriterion-665c1f4541b730cc.rlib --extern rand=/storage/projects/wordle-guesser/target/release/deps/librand-695392017e6e432c.rlib` (signal: 11, SIGSEGV: invalid memory reference)
Error: 'cargo bench' returned an error (exit status: 101); unable to continue.

or something similar. Note the signal: 11, SIGSEGV: invalid memory reference way off to the right - just wanna bring attention to it since it's a pretty darn wide message. Anywho. I also attempted to run a stacktrace of it in gdb, which didn't yield a whole lot. The whole log when run with the core dump is:

GNU gdb (Gentoo 11.2 vanilla) 11.2
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://bugs.gentoo.org/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Registered pretty printers for UE4 classes
Reading symbols from /home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/rustc...

warning: Can't open file /storage/projects/wordle-guesser/target/release/deps/libserde_derive-5037928b72dfeb41.so during file-backed mapping note processing
[New LWP 15384]
[New LWP 14965]
[New LWP 14966]
[New LWP 15002]
[New LWP 15001]

warning: Could not load shared library symbols for /storage/projects/wordle-guesser/target/release/deps/libserde_derive-5037928b72dfeb41.so.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/rustc --crat'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f425f070be8 in llvm::SelectionDAG::ReplaceAllUsesWith(llvm::SDNode*, llvm::SDValue const*) ()
   from /home/auro/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/../lib/../lib/libLLVM-14-rust-1.61.0-nightly.so
[Current thread is 1 (Thread 0x7f4247dff640 (LWP 15384))]

Also weird is the sheer amount of time it takes to produce that. Even from a clean build, cargo build --release takes only some 8-10 seconds (and succeeds, unlike cargo criterion), but from an incremental build with all the dependencies already compiled, cargo criterion takes 5-7 minutes.

Meta

rustc --version --verbose:

rustc 1.61.0-nightly (1eb72580d 2022-03-08)binary: rustc
commit-hash: 1eb72580d076935a3e590deb6e5813a5aef3eca4
commit-date: 2022-03-08
host: x86_64-unknown-linux-gnu
release: 1.61.0-nightly
LLVM version: 14.0.0

[nikic]

Extracted bitcode still crashes llc on LLVM trunk.

[nikic]

Okay, this is less interesting than I thought. Reduced test case:

define void @test([70000 x i8]* %a) {
  %x = load volatile [70000 x i8], [70000 x i8]* %a
  ret void
}

Asserts with:

llc: /home/npopov/repos/llvm-project/llvm/include/llvm/CodeGen/SelectionDAGNodes.h:1069: llvm::SDNode::SDNode(unsigned int, unsigned int, llvm::DebugLoc, llvm::SDVTList): Assertion `NumValues == VTs.NumVTs && "NumValues wasn't wide enough for its operands!"' failed.

The problem being that SDNodes only support up to 2^16 values, and we're performing a load with more than many constituent parts.

It looks like there are already a few upstream reports for this issue: llvm/llvm-project#53164 and llvm/llvm-project#40691

As the issue is exotic, I don't expect this to gain much traction.

[AuroransSolis]

Nice finds! Strange that it only causes the SIGSEGV on cargo bench, though. I can do just about anything I want with cargo run or cargo build and it compiles just fine.

[apiraino]

I'll tentatively assign a P-low based on @nikic comment, discussion is on Zulip thread of the Prioritization Working Group, can be re-evaluated if necessary.

@rustbot label -I-prioritize +P-low