Skip to content

[Attributor] Only follow addrspacecasts in AAPointerInfo - #225290

Merged
nikic merged 4 commits into
llvm:mainfrom
LiRunGuo:attributor-ptrtoaddr-crash
Oct 13, 2026
Merged

nikic merged 4 commits into
llvm:mainfrom
LiRunGuo:attributor-ptrtoaddr-crash

Conversation

@LiRunGuo

@LiRunGuo LiRunGuo commented Sep 22, 2026 •

Copy link
Copy Markdown
Contributor

AAPointerInfo followed every cast of a pointer except ptrtoint instructions. A ptrtoaddr, a ptrtoint/ptrtoaddr constant expression, or a bitcast to a byte type thus produced a non-pointer value that was tracked as a pointer, which asserted in getPointerAddressSpace() once it reached a PHI.

Only follow addrspacecasts, the only casts that preserve the pointer.

Fixes #221852.

Assisted-by: Claude

AAPointerInfoFloating treated ptrtoaddr instructions, as well as ptrtoint
and ptrtoaddr constant expressions, as pointer pass-through users. It then
tracked the resulting integer as if it were a pointer and asserted in
getPointerAddressSpace() once it reached a PHI.

Handle all of them like a ptrtoint instruction, which already stops the
analysis.

Fixes llvm#221852.
@github-actions

Copy link
Copy Markdown

Hello @LiRunGuo 👋

Thank you for submitting a Pull Request (PR) to the LLVM Project. Since this is your first PR, here are a few useful links covering our main contribution policies and review practices.

  • All contributions to LLVM must follow our LLVM AI Tool Use Policy. In particular, if you used AI while working on this PR, remember to add a note to the PR description.
  • The LLVM Code-Review Policy and Practices document contains practical information about the PR process, including how patches are reviewed and accepted, and who can review a PR.
  • Our LLVM Developer Policy describes our expectations for code quality, commit summaries and contains notes on our CI system.

Please reply to this message to confirm that you have read these policies, especially the LLVM AI Tool Use Policy, and that any AI tool usage has been noted in the PR description.


Frequently asked questions

How do I add reviewers?

This PR will be automatically labeled, and the relevant teams will be notified. For some parts of the project, reviewers may also be added automatically.

You can also add reviewers manually using the Reviewers section on this page. If you cannot use that section, it is probably because you do not have write permissions for the repository. In that case, you can request a review by tagging reviewers in a comment using @ followed by their GitHub username.

What if there are no comments?

If you have not received any comments on your PR after a week, you can request a review by pinging the PR with a comment such as “Ping”. The common courtesy ping rate is once a week. Please remember that you are asking for volunteer time from other developers.

Are any special GitHub settings required to contribute to LLVM?

We only require contributors to have a public email address associated with their GitHub commits, see this section of LLVM Developer Policy for details.


If you have questions, feel free to leave a comment on this PR, or ask on LLVM Discord or LLVM Discourse.

Thank you,
The LLVM Community

@llvmorg-github-actions

Copy link
Copy Markdown

@llvm/pr-subscribers-llvm-transforms

Author: Gawr Gura 0721 (LiRunGuo)

Changes

AAPointerInfoFloating treated ptrtoaddr instructions, as well as ptrtoint and
ptrtoaddr constant expressions, as pointer pass-through users. It then tracked
the resulting integer as if it were a pointer and asserted in
getPointerAddressSpace() once the integer reached a PHI (#221852).

The ptrtoint instruction was already excluded; this handles ptrtoaddr and the
constant-expression forms the same way (conservatively giving up), using
PtrToIntOperator/PtrToAddrOperator so that instructions and constant
expressions share one check.

The constant-expression ptrtoint case is a separate crash with the same root
cause, e.g. phi i64 [ ptrtoint (ptr @<!-- -->g to i64), ... ] on an internal global.

Fixes #221852.

Testing: check-llvm passes (Release+Asserts); added regression tests to
Attributor/pointer-info.ll for both the module and CGSCC Attributor.


Full diff: https://github.com/llvm/llvm-project/pull/225290.diff

2 Files Affected:

  • (modified) llvm/lib/Transforms/IPO/AttributorAttributes.cpp (+4-2)
  • (modified) llvm/test/Transforms/Attributor/pointer-info.ll (+123-4)
The server is unavailable at this time. Please wait a few minutes before you try again.

@LiRunGuo

Copy link
Copy Markdown
Contributor Author

Hi @shiltian, could you please review this when you get a chance?

AAPointerInfo currently treats ptrtoaddr instructions, as well as ptrtoint/ptrtoaddr constant expressions, as pointer pass-through users, and then asserts once the resulting integer reaches a PHI (#221852). This patch handles them the same way as a ptrtoint instruction.

In line with the LLVM AI Tool Use Policy, I've noted in the description that AI assistance was used.

Assisted-by: Claude

Thanks!

@shiltian shiltian left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. PtrToAddrInst is a new thing after these AA work. It is very likely that other places that only check PtrToIntInst would need similar fix.

@nikic nikic left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it would be preferable if this didn't do "follow all casts apart from ptrtoint and ptrtoaddr" and instead explicitly supported the casts that are supported.

The only casts this can reasonably follow are bitcast and addrspacecast.

For bitcast something to keep in mind is that a pointer can be casted to a byte type nowadays -- does this code handle that correctly? If not, it probably just shouldn't follow though bitcasts either, because pointer-to-pointer bitcasts do not naturally occur post opaque pointers.

So in that case it should just follow addrspacecasts and nothing else.

@shiltian

Copy link
Copy Markdown
Contributor

That is a good point. I think that makes sense too. I'm fine with landing this PR as is and then I'll do a follow up on it.

@LiRunGuo LiRunGuo changed the title [Attributor] Don't follow pointer-to-integer casts in AAPointerInfo [Attributor] Only follow addrspacecasts in AAPointerInfo Sep 29, 2026
@LiRunGuo

Copy link
Copy Markdown
Contributor Author

Thanks @shiltian and @nikic! I've updated the patch to only follow addrspacecasts. Following a bitcast to a byte type did hit the same assertion once it reached a PHI, so I added a test for that. The only other test change is in value-simplify-local-remote.ll, which relied on a leftover no-op bitcast ptr to ptr.

I don't have commit access, so once CI passes, could one of you merge this on my behalf?

Assisted-by: Claude

@LiRunGuo

LiRunGuo commented Oct 5, 2026

Copy link
Copy Markdown
Contributor Author

Ping. @nikic, does the updated version look good to you? @shiltian, could you approve the CI run? Once it passes, could one of you merge this on my behalf? I don't have commit access. Thanks!

Assisted-by: Claude

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you can drop this entire block now. None of the following cases will match, and it will fall through to the unknown user case at the bottom.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can probably keep existing behavior on this test by dropping the %tmp20 = bitcast ptr %y to ptr line (replacing %tmp20 with %y).

@LiRunGuo

Copy link
Copy Markdown
Contributor Author

Thanks @nikic! I've dropped the ConstantExpr block and removed the leftover bitcast from the test, so value-simplify-local-remote.ll keeps its existing output. I don't have commit access, so could you merge this on my behalf once CI passes?

Assisted-by: Claude

@nikic
nikic enabled auto-merge (squash) October 12, 2026 19:56
@github-actions

Copy link
Copy Markdown

🐧 Linux x64 Test Results

  • 155540 tests passed
  • 3561 tests skipped
  • 1 test failed

Failed Tests

(click on a test name to see its output)

LLVM

LLVM.CodeGen/AMDGPU/waterfall-loop-exec-update-terminator.mir
Exit Code: 1

Command Output (stdout):
--
# RUN: at line 2
/home/gha/actions-runner/_work/llvm-project/llvm-project/build/bin/llc -mtriple=amdgpu10.10-amd-amdhsa -mattr=+wavefrontsize32 --run-pass=si-fix-sgpr-copies,livevars,phi-node-elimination -o - /home/gha/actions-runner/_work/llvm-project/llvm-project/llvm/test/CodeGen/AMDGPU/waterfall-loop-exec-update-terminator.mir | /home/gha/actions-runner/_work/llvm-project/llvm-project/build/bin/FileCheck /home/gha/actions-runner/_work/llvm-project/llvm-project/llvm/test/CodeGen/AMDGPU/waterfall-loop-exec-update-terminator.mir --check-prefixes=W32
# executed command: /home/gha/actions-runner/_work/llvm-project/llvm-project/build/bin/llc -mtriple=amdgpu10.10-amd-amdhsa -mattr=+wavefrontsize32 --run-pass=si-fix-sgpr-copies,livevars,phi-node-elimination -o - /home/gha/actions-runner/_work/llvm-project/llvm-project/llvm/test/CodeGen/AMDGPU/waterfall-loop-exec-update-terminator.mir
# note: command had no output on stdout or stderr
# executed command: /home/gha/actions-runner/_work/llvm-project/llvm-project/build/bin/FileCheck /home/gha/actions-runner/_work/llvm-project/llvm-project/llvm/test/CodeGen/AMDGPU/waterfall-loop-exec-update-terminator.mir --check-prefixes=W32
# .---command stderr------------
# | /home/gha/actions-runner/_work/llvm-project/llvm-project/llvm/test/CodeGen/AMDGPU/waterfall-loop-exec-update-terminator.mir:52:14: error: W32-NEXT: expected string not found in input
# |  ; W32-NEXT: [[BUFFER_LOAD_FORMAT_X_IDXEN:%[0-9]+]]:vgpr_32 = BUFFER_LOAD_FORMAT_X_IDXEN [[COPY]], killed [[REG_SEQUENCE3]], 0, 0, 0, 0, implicit $exec
# |              ^
# | <stdin>:180:2: note: scanning from here
# |  
# |  ^
# | <stdin>:180:2: note: with "COPY" equal to "%4"
# |  
# |  ^
# | <stdin>:180:2: note: with "REG_SEQUENCE3" equal to "%22"
# |  
# |  ^
# | <stdin>:180:2: note: pattern attempts to capture variables: "BUFFER_LOAD_FORMAT_X_IDXEN"
# |  
# |  ^
# | <stdin>:181:2: note: possible intended match here
# |  %6:vgpr_32 = BUFFER_LOAD_FORMAT_X_IDXEN %4, %22, 0, 0, 0, 0, implicit $exec
# |  ^
# | 
# | Input file: <stdin>
# | Check file: /home/gha/actions-runner/_work/llvm-project/llvm-project/llvm/test/CodeGen/AMDGPU/waterfall-loop-exec-update-terminator.mir
# | 
# | -dump-input=help explains the following input dump.
# | 
# | Input was:
# | <<<<<<
# |            .
# |            .
# |            .
# |          175:  V_CMPX_EQ_U64_nosdst_e32_term %18, %11.sub0_sub1, implicit-def $exec, implicit $exec 
# |          176:  V_CMPX_EQ_U64_nosdst_e32_term %21, %11.sub2_sub3, implicit-def $exec, implicit $exec 
# |          177:   
# |          178:  bb.2: 
# |          179:  successors: %bb.1(0x40000000), %bb.3(0x40000000) 
# |          180:   
# | next:52'0     {   search range start (exclusive)
# | next:52'1         error: no match found in search range
# | next:52'2         with "COPY" equal to "%4"
# | next:52'3         with "REG_SEQUENCE3" equal to "%22"
# | next:52'4         pattern attempts to capture variables: "BUFFER_LOAD_FORMAT_X_IDXEN"
# |          181:  %6:vgpr_32 = BUFFER_LOAD_FORMAT_X_IDXEN %4, %22, 0, 0, 0, 0, implicit $exec 
# | next:52'5      ?                                                                             possible intended match
# |          182:  %14:sreg_32_xm0_xexec = S_ANDN2_B32 %13, $exec_lo, implicit-def dead $scc 
# |          183:  %23:sreg_32_xm0_xexec = COPY %14 
# |          184:  $exec_lo = S_MOV_B32_term %14 
# |          185:  SI_WATERFALL_LOOP %bb.1, implicit $exec 
# |          186:   
# |          187:  bb.3: 
# |          188:  $exec_lo = S_MOV_B32 %12 
# |          189:  $vgpr0 = COPY %6 
# |          190:  S_ENDPGM 0, implicit $vgpr0 
# |          191: ... 
# | next:52'6         } search range end (exclusive)
# | >>>>>>
# `-----------------------------
# error: command failed with exit status: 1

--

If these failures are unrelated to your changes (for example tests are broken or flaky at HEAD), please open an issue at https://github.com/llvm/llvm-project/issues and add the infrastructure label.

@nikic
nikic merged commit cc4c1f9 into llvm:main Oct 13, 2026
10 of 11 checks passed
@github-actions

Copy link
Copy Markdown

@LiRunGuo Congratulations on having your first Pull Request (PR) merged into the LLVM Project!

Your changes will be combined with recent changes from other authors, then tested by our build bots. If there is a problem with a build, you may receive a report in an email or a comment on this PR.

Please check whether problems have been caused by your change specifically, as the builds can include changes from many authors. It is not uncommon for your change to be included in a build that fails due to someone else's changes, or infrastructure issues.

How to do this, and the rest of the post-merge process, is covered in detail here.

If your change does cause a problem, it may be reverted, or you can revert it yourself. This is a normal part of LLVM development. You can fix your changes and open a new PR to merge them again.

If you don't get any reports, no action is required from you. Your changes are working as expected, well done!

ram-NK pushed a commit to ram-NK/llvm-project that referenced this pull request Oct 14, 2026
AAPointerInfo followed every cast of a pointer except ptrtoint
instructions. A ptrtoaddr, a ptrtoint/ptrtoaddr constant expression, or
a bitcast to a byte type thus produced a non-pointer value that was
tracked as a pointer, which asserted in getPointerAddressSpace() once it
reached a PHI.

Only follow addrspacecasts, the only casts that preserve the pointer.

Fixes llvm#221852.

Assisted-by: Claude
MazenEwiss pushed a commit to MazenEwiss/llvm-project that referenced this pull request Oct 14, 2026
AAPointerInfo followed every cast of a pointer except ptrtoint
instructions. A ptrtoaddr, a ptrtoint/ptrtoaddr constant expression, or
a bitcast to a byte type thus produced a non-pointer value that was
tracked as a pointer, which asserted in getPointerAddressSpace() once it
reached a PHI.

Only follow addrspacecasts, the only casts that preserve the pointer.

Fixes llvm#221852.

Assisted-by: Claude
StarOne01 pushed a commit to StarOne01/llvm-project that referenced this pull request Oct 15, 2026
AAPointerInfo followed every cast of a pointer except ptrtoint
instructions. A ptrtoaddr, a ptrtoint/ptrtoaddr constant expression, or
a bitcast to a byte type thus produced a non-pointer value that was
tracked as a pointer, which asserted in getPointerAddressSpace() once it
reached a PHI.

Only follow addrspacecasts, the only casts that preserve the pointer.

Fixes llvm#221852.

Assisted-by: Claude
milkHongYe pushed a commit to milkHongYe/llvm-project that referenced this pull request Oct 18, 2026
AAPointerInfo followed every cast of a pointer except ptrtoint
instructions. A ptrtoaddr, a ptrtoint/ptrtoaddr constant expression, or
a bitcast to a byte type thus produced a non-pointer value that was
tracked as a pointer, which asserted in getPointerAddressSpace() once it
reached a PHI.

Only follow addrspacecasts, the only casts that preserve the pointer.

Fixes llvm#221852.

Assisted-by: Claude
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Attributor] AAPointerInfo mistreats ptrtoaddr as pointer-preserving cast

3 participants