Skip to content

Panic in lowering: self.value_lowered_uses[*result] == 0 #14271

Description

@alexcrichton

This input:

Details
;; Run test case

test interpret
test run
set regalloc_checker=true
set enable_alias_analysis=false
set enable_nan_canonicalization=true
set enable_llvm_abi_extensions=true
set enable_multi_ret_implicit_sret=true
set preserve_frame_pointers=true
set machine_code_cfg_info=true
target x86_64 has_sse3 has_ssse3 has_cmpxchg16b has_sse41 has_sse42 has_avx has_avx2 has_fma has_avx_vnni has_popcnt has_bmi1 has_bmi2 has_lzcnt

function u1:0(i32x4, i32x4, i16x8, f64, f32x4, i64x2, i128 sext, i32 sext, i64 sext, f32, i16 uext, i64x2, i16 sext, i32x4, i8 sext, i8x16) -> i8x16, i32x4, i32x4, i32x4, i32x4, f64, i32x4, i32x4, i32x4, i32x4, i32x4, i32x4, i32x4, i8, i8, i32 system_v {
    ss0 = explicit_slot 120, align = 1024
    ss1 = explicit_slot 120, align = 1024
    ss2 = explicit_slot 120, align = 1024
    ss3 = explicit_slot 2, align = 2
    ss4 = explicit_slot 2, align = 2
    ss5 = explicit_slot 8, align = 8
    ss6 = explicit_slot 8, align = 8
    sig0 = (f32) -> f32 system_v
    sig1 = (f64) -> f64 system_v
    sig2 = (f32) -> f32 system_v
    sig3 = (f64) -> f64 system_v
    sig4 = (f32) -> f32 system_v
    sig5 = (f64) -> f64 system_v
    fn0 = %CeilF32 sig0
    fn1 = %CeilF64 sig1
    fn2 = %FloorF32 sig2
    fn3 = %FloorF64 sig3
    fn4 = %TruncF32 sig4
    fn5 = %TruncF64 sig5

block0(v0: i32x4, v1: i32x4, v2: i16x8, v3: f64, v4: f32x4, v5: i64x2, v6: i128, v7: i32, v8: i64, v9: f32, v10: i16, v11: i64x2, v12: i16, v13: i32x4, v14: i8, v15: i8x16):
    v175 -> v0
    v191 -> v2
    v192 -> v3
    v193 -> v4
    v172 -> v6
    v187 -> v8
    v182 -> v9
    v194 -> v11
    v195 -> v11
    v190 -> v13
    v197 -> v13
    v196 -> v15
    v270 = stack_addr.i64 ss6
    store notrap aligned v8, v270
    v142 = iconst.i64 0x7878_7878_7878_7878
    v186 -> v142
    v269 = stack_addr.i64 ss5
    store notrap aligned v142, v269  ; v142 = 0x7878_7878_7878_7878
    v143 = iconst.i8 0
    v144 = iconst.i16 0
    v145 = iconst.i32 0
    v146 = iconst.i64 0
    v147 = uextend.i128 v146  ; v146 = 0
    v148 = stack_addr.i64 ss0
    store notrap v147, v148
    v149 = stack_addr.i64 ss0+16
    store notrap v147, v149
    v150 = stack_addr.i64 ss0+32
    store notrap v147, v150
    v151 = stack_addr.i64 ss0+48
    store notrap v147, v151
    v152 = stack_addr.i64 ss0+64
    store notrap v147, v152
    v153 = stack_addr.i64 ss0+80
    store notrap v147, v153
    v154 = stack_addr.i64 ss0+96
    store notrap v147, v154
    v155 = stack_addr.i64 ss0+112
    store notrap v146, v155  ; v146 = 0
    v156 = stack_addr.i64 ss1
    store notrap v147, v156
    v157 = stack_addr.i64 ss1+16
    store notrap v147, v157
    v158 = stack_addr.i64 ss1+32
    store notrap v147, v158
    v159 = stack_addr.i64 ss1+48
    store notrap v147, v159
    v160 = stack_addr.i64 ss1+64
    store notrap v147, v160
    v161 = stack_addr.i64 ss1+80
    store notrap v147, v161
    v162 = stack_addr.i64 ss1+96
    store notrap v147, v162
    v163 = stack_addr.i64 ss1+112
    store notrap v146, v163  ; v146 = 0
    v164 = stack_addr.i64 ss2
    store notrap v147, v164
    v165 = stack_addr.i64 ss2+16
    store notrap v147, v165
    v166 = stack_addr.i64 ss2+32
    store notrap v147, v166
    v167 = stack_addr.i64 ss2+48
    store notrap v147, v167
    v168 = stack_addr.i64 ss2+64
    store notrap v147, v168
    v169 = stack_addr.i64 ss2+80
    store notrap v147, v169
    v170 = stack_addr.i64 ss2+96
    store notrap v147, v170
    v171 = stack_addr.i64 ss2+112
    store notrap v146, v171  ; v146 = 0
    brif v10, block1(v14, v14, v14, v14, v12, v14, v10, v14, v12, v14, v10, v11, v10, v14), block1(v14, v14, v14, v14, v12, v14, v10, v14, v10, v14, v10, v11, v10, v14)

block1(v16: i8, v17: i8, v18: i8, v19: i8, v20: i16, v21: i8, v22: i16, v23: i8, v24: i16, v25: i8, v26: i16, v27: i64x2, v28: i16, v29: i8) cold:
    v267 = stack_addr.i64 ss3
    store notrap aligned v20, v267
    v268 = stack_addr.i64 ss4
    store notrap aligned v28, v268
    v173 = bmask.i32 v172
    v174 = stack_addr.i64 ss2+65
    store.i32x4 v175, v174+35
    v176 = select_spectre_guard v172, v173, v173
    v177 = select_spectre_guard v172, v176, v176
    v178 = select_spectre_guard v172, v177, v177
    v179 = select_spectre_guard v172, v178, v178
    v180 = select_spectre_guard v172, v179, v179
    v181 = bxor.i32x4 v175, v175
    v198 -> v181
    v183 = func_addr.i64 fn0
    v184 = call_indirect sig0, v183(v182), stack_map=[i64 @ ss6+0, i16 @ ss3+0, i16 @ ss4+0, i64 @ ss5+0]
    v185 = select_spectre_guard v172, v180, v180
    v263 = stack_addr.i64 ss5
    v264 = load.i64 notrap aligned v263
    v265 = stack_addr.i64 ss6
    v266 = load.i64 notrap aligned v265
    v188, v189 = uadd_overflow v264, v266
    v255 = stack_addr.i64 ss3
    v256 = load.i16 notrap aligned v255
    v257 = stack_addr.i64 ss3
    v258 = load.i16 notrap aligned v257
    v259 = stack_addr.i64 ss3
    v260 = load.i16 notrap aligned v259
    v261 = stack_addr.i64 ss4
    v262 = load.i16 notrap aligned v261
    brif v189, block2(v13, v2, v3, v4, v13, v6, v189, v185, v189, v188, v2, v184, v256, v2, v11, v258), block2(v0, v2, v3, v4, v0, v6, v189, v185, v189, v188, v2, v184, v260, v2, v27, v262)

block2(v30: i32x4, v31: i16x8, v32: f64, v33: f32x4, v34: i32x4, v35: i128, v36: i8, v37: i32, v38: i8, v39: i64, v40: i16x8, v41: f32, v42: i16, v43: i16x8, v44: i64x2, v45: i16) cold:
    v200 -> v33
    v199 -> v37
    v201 -> v43
    v206 -> v44
    v227 -> v44
    v228 -> v44
    v203 -> v45
    v225 -> v45
    br_table v37, block3(v38, v38, v196, v196, v34, v34, v38, v198, v32, v34), [block11(v33, v33, v33, v33, v33, v33, v44, v33, v33, v33, v33, v45, v38, v196, v34, v198, v32, v37), block11(v33, v33, v33, v33, v33, v33, v195, v33, v33, v33, v33, v45, v38, v196, v34, v198, v32, v37), block3(v38, v38, v196, v196, v197, v198, v38, v197, v32, v198), block4(v197, v198, v198, v34, v38, v38, v38, v38, v37, v38, v38, v38, v38, v198, v34, v198, v32, v196), block5(v33, v33, v33, v33, v33, v33, v43, v38, v38, v38, v32, v198, v37, v196), block10(v33, v45, v33, v33, v33, v33, v33, v33, v195, v33, v33, v38, v196, v34, v198, v32, v37), block7(v37, v38, v45, v37, v38, v44, v38, v45, v38, v45, v38, v45, v38, v45, v33, v196, v34, v198, v32), block11(v33, v33, v33, v33, v33, v33, v44, v33, v33, v33, v33, v45, v38, v196, v34, v198, v32, v37), block5(v33, v33, v33, v33, v33, v33, v43, v38, v38, v38, v32, v198, v37, v196)]

block3(v46: i8, v47: i8, v48: i8x16, v49: i8x16, v50: i32x4, v51: i32x4, v52: i8, v53: i32x4, v54: f64, v55: i32x4):
    jump block4(v53, v53, v53, v55, v52, v52, v52, v52, v199, v52, v52, v52, v52, v53, v53, v53, v54, v49)

block4(v56: i32x4, v57: i32x4, v58: i32x4, v59: i32x4, v60: i8, v61: i8, v62: i8, v63: i8, v64: i32, v65: i8, v66: i8, v67: i8, v68: i8, v69: i32x4, v70: i32x4, v71: i32x4, v202: f64, v233: i8x16):
    jump block5(v200, v200, v200, v200, v200, v200, v201, v68, v68, v68, v202, v71, v64, v233)

block5(v72: f32x4, v73: f32x4, v74: f32x4, v75: f32x4, v76: f32x4, v77: f32x4, v78: i16x8, v79: i8, v80: i8, v81: i8, v82: f64, v204: i32x4, v226: i32, v232: i8x16):
    v205 -> v226
    jump block6(v81, v82, v203, v203, v81, v81, v78, v78, v78, v204)

block6(v83: i8, v84: f64, v85: i16, v86: i16, v87: i8, v88: i8, v89: i16x8, v90: i16x8, v91: i16x8, v92: i32x4):
    jump block7(v205, v88, v86, v205, v88, v206, v88, v86, v88, v86, v88, v86, v88, v86, v77, v232, v92, v204, v84)

block7(v93: i32, v94: i8, v95: i16, v96: i32, v97: i8, v98: i64x2, v99: i8, v100: i16, v101: i8, v102: i16, v103: i8, v104: i16, v105: i8, v106: i16, v207: f32x4, v231: i8x16, v238: i32x4, v243: i32x4, v248: f64):
    v211 -> v96
    v209 -> v98
    v214 -> v98
    v210 -> v106
    v213 -> v106
    v208 -> v207
    v212 -> v207
    br_table v96, block8(v105), [block13(v105, v231, v238, v243, v248, v96), block13(v105, v231, v238, v243, v248, v96), block13(v105, v231, v238, v243, v248, v96), block13(v105, v231, v238, v243, v248, v96), block13(v105, v231, v238, v243, v248, v96), block13(v105, v231, v238, v243, v248, v96), block13(v105, v231, v238, v243, v248, v96), block13(v105, v231, v238, v243, v248, v96), block11(v207, v207, v207, v207, v207, v207, v98, v207, v207, v207, v207, v106, v105, v231, v238, v243, v248, v96), block13(v105, v231, v238, v243, v248, v96)]

block8(v107: i8):
    v215 -> v107
    br_table v211, block9, [block11(v208, v208, v208, v208, v208, v208, v209, v208, v208, v208, v208, v210, v107, v231, v238, v243, v248, v211), block11(v208, v208, v208, v208, v208, v208, v209, v208, v208, v208, v208, v210, v107, v231, v238, v243, v248, v211), block9, block10(v208, v210, v208, v208, v208, v208, v208, v208, v209, v208, v208, v107, v231, v238, v243, v248, v211), block10(v208, v210, v208, v208, v208, v208, v208, v208, v209, v208, v208, v107, v231, v238, v243, v248, v211), block10(v208, v210, v208, v208, v208, v208, v208, v208, v209, v208, v208, v107, v231, v238, v243, v248, v211), block10(v208, v210, v208, v208, v208, v208, v208, v208, v209, v208, v208, v107, v231, v238, v243, v248, v211), block10(v208, v210, v208, v208, v208, v208, v208, v208, v209, v208, v208, v107, v231, v238, v243, v248, v211), block10(v208, v210, v208, v208, v208, v208, v208, v208, v209, v208, v208, v107, v231, v238, v243, v248, v211)]

block9 cold:
    brif.i8 v215, block10(v212, v213, v212, v212, v212, v212, v212, v212, v214, v212, v212, v215, v231, v238, v243, v248, v211), block11(v212, v212, v212, v212, v212, v212, v214, v212, v212, v212, v212, v213, v215, v231, v238, v243, v248, v211)

block10(v108: f32x4, v109: i16, v110: f32x4, v111: f32x4, v112: f32x4, v113: f32x4, v114: f32x4, v115: f32x4, v116: i64x2, v117: f32x4, v118: f32x4, v216: i8, v230: i8x16, v237: i32x4, v242: i32x4, v247: f64, v252: i32) cold:
    brif v216, block11(v118, v118, v118, v118, v118, v118, v116, v118, v118, v118, v118, v109, v216, v230, v237, v242, v247, v252), block12(v118, v118, v118, v118, v109, v216, v109, v216, v109, v216, v109, v230, v237, v242, v247, v252)

block11(v119: f32x4, v120: f32x4, v121: f32x4, v122: f32x4, v123: f32x4, v124: f32x4, v125: i64x2, v126: f32x4, v127: f32x4, v128: f32x4, v129: f32x4, v217: i16, v218: i8, v234: i8x16, v239: i32x4, v244: i32x4, v249: f64, v253: i32) cold:
    brif v218, block12(v129, v129, v129, v129, v217, v218, v217, v218, v217, v218, v217, v234, v239, v244, v249, v253), block13(v218, v234, v239, v244, v249, v253)

block12(v130: f32x4, v131: f32x4, v132: f32x4, v133: f32x4, v134: i16, v135: i8, v136: i16, v137: i8, v138: i16, v139: i8, v140: i16, v229: i8x16, v236: i32x4, v241: i32x4, v246: f64, v251: i32) cold:
    brif v139, block13(v139, v229, v236, v241, v246, v251), block14(v229, v236, v241, v246, v139, v251)

block13(v141: i8, v235: i8x16, v240: i32x4, v245: i32x4, v250: f64, v254: i32):
    brif v141, block14(v235, v240, v245, v250, v141, v254), block14(v235, v240, v245, v250, v141, v254)

block14(v219: i8x16, v220: i32x4, v221: i32x4, v222: f64, v223: i8, v224: i32) cold:
    return v219, v220, v221, v220, v220, v222, v220, v220, v221, v220, v220, v220, v220, v223, v223, v224
}


; Note: the results in the below test cases are simply a placeholder and probably will be wrong

panics with:

$ cargo run -p cranelift-tools test out.clif
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.07s
     Running `target/debug/clif-util test out.clif`

thread 'worker #3' (911352) panicked at cranelift/codegen/src/machinst/lower.rs:1820:13:
assertion failed: self.value_lowered_uses[*result] == 0
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
[2026-09-02T20:12:13Z ERROR cranelift_filetests::concurrent] FAIL: panicked in worker #3: assertion failed: self.value_lowered_uses[*result] == 0
FAIL out.clif: panicked in worker #3: assertion failed: self.value_lowered_uses[*result] == 0
1 tests
Error: 1 failure

Bisection points to #14228 (cc @cfallin) and the corresponding fuzz bug is https://oss-fuzz.com/testcase-detail/6094041310363648

Metadata

Metadata

Assignees

No one assigned

    Labels

    fuzz-bugBugs found by a fuzzer

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions