A/F: `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' after fa24213

[dyung]

We have an internal test that started failing recently with an assertion failure which I bisected back to commit fa24213.

Consider the following code:

int a[]{};
const int b = sizeof(0);
struct c {
  int d;
} e;
struct f {
  f(c *g) : h(g) {}
  c *h;
};
struct j {
  c *k;
  c *l;
  c *m(int g) { return k + g; }
  void n(int g) {
    c *o = (c *)operator new(sizeof(c) * g);
    k = o;
    l = o + g;
  }
};
void p(f g, f q, f r) {
  for (; g.h != q.h; ++r.h, ++g.h)
    *r.h = *g.h;
}
void s(f g, f q, f r) { p(g, q, r); }
int main() {
  j c;
  c.n(b);
  for (int i = 0; i < b; ++i)
    c.m(i)->d = a[i];
  s(c.k + 2, c.l, &e);
}

When compiled with optimizations and a compiler that does not include fa24213, the compilation passes:

$ ~/src/upstream/840e857a1969927f513a17e46445bf9a56cf81ba-linux/bin/clang -c -O1 test.cpp
$

But if we attempt to compile this with a compiler that includes fa24213, we hit an assertion failure:

$ ~/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang -c -O1 test.cpp                                                                                                                                   
clang: /home/dyung/src/upstream/llvm_clean_git/llvm/include/llvm/Support/Casting.h:578: decltype(auto) llvm::cast(From*) [with To = llvm::Instruction; From = llvm::Value]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.                                                                                                       
Stack dump:
0.      Program arguments: /home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang -c -O1 test.cpp
1.      <eof> parser at end of file
2.      Optimizer
3.      Running pass "require<globals-aa>,function(invalidate<aa>),require<profile-summary>,cgscc(devirt<4>(inline,function-attrs<skip-non-recursive-function-attrs>,function<eager-inv;no-rerun>(sroa<modify-cfg>,early-cse<memssa>,simplifycfg<bonus-inst-thresh
old=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-sink-common-insts;speculate-blocks;simplify-cond-branch>,instcombine<max-iterations=1;no-use-loop-info;no-verify-fixpoint>,libcalls-shrinkwrap,simplifyc
fg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-sink-common-insts;speculate-blocks;simplify-cond-branch>,reassociate,loop-mssa(loop-instsimplify,loop-simplifycfg,licm<no-allowspecu
lation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allowspeculation>,simple-loop-unswitch<no-nontrivial;trivial>),simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts
;no-sink-common-insts;speculate-blocks;simplify-cond-branch>,instcombine<max-iterations=1;no-use-loop-info;no-verify-fixpoint>,loop(loop-idiom,indvars,loop-deletion,loop-unroll-full),sroa<modify-cfg>,memcpyopt,sccp,bdce,instcombine<max-iterations=1;no-use-lo
op-info;no-verify-fixpoint>,coro-elide,adce,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-sink-common-insts;speculate-blocks;simplify-cond-branch>,instcombine<max-iterat
ions=1;no-use-loop-info;no-verify-fixpoint>),function-attrs,function(require<should-not-run-function-passes>),coro-split)),function(invalidate<should-not-run-function-passes>),cgscc(devirt<4>())" on module "test.cpp"
4.      Running pass "cgscc(devirt<4>(inline,function-attrs<skip-non-recursive-function-attrs>,function<eager-inv;no-rerun>(sroa<modify-cfg>,early-cse<memssa>,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;
keep-loops;no-hoist-common-insts;no-sink-common-insts;speculate-blocks;simplify-cond-branch>,instcombine<max-iterations=1;no-use-loop-info;no-verify-fixpoint>,libcalls-shrinkwrap,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;
no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-sink-common-insts;speculate-blocks;simplify-cond-branch>,reassociate,loop-mssa(loop-instsimplify,loop-simplifycfg,licm<no-allowspeculation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allows
peculation>,simple-loop-unswitch<no-nontrivial;trivial>),simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-sink-common-insts;speculate-blocks;simplify-cond-branch>,instcombi
ne<max-iterations=1;no-use-loop-info;no-verify-fixpoint>,loop(loop-idiom,indvars,loop-deletion,loop-unroll-full),sroa<modify-cfg>,memcpyopt,sccp,bdce,instcombine<max-iterations=1;no-use-loop-info;no-verify-fixpoint>,coro-elide,adce,simplifycfg<bonus-inst-thr
eshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-sink-common-insts;speculate-blocks;simplify-cond-branch>,instcombine<max-iterations=1;no-use-loop-info;no-verify-fixpoint>),function-attrs,function(r
equire<should-not-run-function-passes>),coro-split))" on module "test.cpp"
5.      Running pass "memcpyopt" on function "main"
 #0 0x0000563ea39d7bbf llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x419abbf)
 #1 0x0000563ea39d571c llvm::sys::CleanupOnSignal(unsigned long) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x419871c)
 #2 0x0000563ea391ac08 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007f105bc74420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #4 0x00007f105b74100b raise /build/glibc-LcI20x/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
 #5 0x00007f105b720859 abort /build/glibc-LcI20x/glibc-2.31/stdlib/abort.c:81:7
 #6 0x00007f105b720729 get_sysdep_segment_value /build/glibc-LcI20x/glibc-2.31/intl/loadmsgcat.c:509:8
 #7 0x00007f105b720729 _nl_load_domain /build/glibc-LcI20x/glibc-2.31/intl/loadmsgcat.c:970:34
 #8 0x00007f105b731fd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
 #9 0x0000563ea7cd5c5e llvm::MemCpyOptPass::processMemCpyMemCpyDependence(llvm::MemCpyInst*, llvm::MemCpyInst*, llvm::BatchAAResults&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x8498c5e)
#10 0x0000563ea7cd6ece llvm::MemCpyOptPass::processMemCpy(llvm::MemCpyInst*, llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>&) (.part.0) MemCpyOptimizer.cpp:0:0
#11 0x0000563ea7cd95b6 llvm::MemCpyOptPass::iterateOnFunction(llvm::Function&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x849c5b6)
#12 0x0000563ea7cd99a6 llvm::MemCpyOptPass::runImpl(llvm::Function&, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::AssumptionCache*, llvm::DominatorTree*, llvm::PostDominatorTree*, llvm::MemorySSA*) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50
dbfab643130-linux/bin/clang+0x849c9a6)                                                                                           
#13 0x0000563ea7cd9e4e llvm::MemCpyOptPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x849ce4e)
#14 0x0000563ea4e320e6 llvm::detail::PassModel<llvm::Function, llvm::MemCpyOptPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/
bin/clang+0x55f50e6)                                                                                                             
#15 0x0000563ea3380261 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x3b43261)       
#16 0x0000563ea0f482e6 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dyung/src/ups
tream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x170b2e6)                                                        
#17 0x0000563ea2865ce1 llvm::CGSCCToFunctionPassAdaptor::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/home/dyung/src/upstream/fa2421392802025e842454a3
1ed50dbfab643130-linux/bin/clang+0x3028ce1)
#18 0x0000563ea0f49886 llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::CGSCCToFunctionPassAdaptor, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, 
llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x170c886)                                             
#19 0x0000563ea285df9f llvm::PassManager<llvm::LazyCallGraph::SCC, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGrap
h::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x3020f9f)                                                                                     
#20 0x0000563ea4e30666 llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::PassManager<llvm::LazyCallGraph::SCC, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>, llvm::AnalysisManager
<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/home/d
yung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x55f3666)                                            
#21 0x0000563ea28625bd llvm::DevirtSCCRepeatedPass::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50
dbfab643130-linux/bin/clang+0x30255bd)                                                                                                                                                                                                                            
#22 0x0000563ea4e306b6 llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::DevirtSCCRepeatedPass, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm:
:AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x55f36b6)
#23 0x0000563ea286038b llvm::ModuleToPostOrderCGSCCPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x302338b)
#24 0x0000563ea4e30616 llvm::detail::PassModel<llvm::Module, llvm::ModuleToPostOrderCGSCCPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab6
43130-linux/bin/clang+0x55f3616)
#25 0x0000563ea337cd71 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x3b3fd71)               
#26 0x0000563ea502fcc5 llvm::ModuleInlinerWrapperPass::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x57f2cc5)                                                     
#27 0x0000563ea4e2fda6 llvm::detail::PassModel<llvm::Module, llvm::ModuleInlinerWrapperPass, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-lin
ux/bin/clang+0x55f2da6)                                                                                                                                                                                                                                           
#28 0x0000563ea337cd71 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x3b3fd71)               
#29 0x0000563ea3c8cfa8 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete
<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0                                                                                                                                                                                            
#30 0x0000563ea3c90315 (anonymous namespace)::EmitAssemblyHelper::EmitAssembly(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) BackendUtil.cpp:0:0                         
#31 0x0000563ea3c909b6 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::In
trusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x44539b6)           
#32 0x0000563ea430633c clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x4ac933c)                                                                            
#33 0x0000563ea60fd8ac clang::ParseAST(clang::Sema&, bool, bool) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x68c08ac)                                                                                                    
#34 0x0000563ea4306748 clang::CodeGenAction::ExecuteAction() (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x4ac9748)                                                                                                        
#35 0x0000563ea459b609 clang::FrontendAction::Execute() (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x4d5e609)
#36 0x0000563ea451e16e clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x4ce116e)
#37 0x0000563ea46871f6 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x4e4a1f6)
#38 0x0000563ea0b2df65 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x12f0f65)
#39 0x0000563ea0b26f7a ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#40 0x0000563ea434bb2d void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>
(long) Job.cpp:0:0                                                                                                               
#41 0x0000563ea391b110 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x40de110)
#42 0x0000563ea434c14f clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#43 0x0000563ea431048c clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x4ad348c)
#44 0x0000563ea4310f1d clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clan
g+0x4ad3f1d)                                                                                                                                                                                                                                                      
#45 0x0000563ea4318ff5 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x4adbff5)
#46 0x0000563ea0b2b1db clang_main(int, char**, llvm::ToolContext const&) (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x12ee1db)
#47 0x0000563ea0a1de1b main (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x11e0e1b)                                                                                                                                         
#48 0x00007f105b722083 __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/../csu/libc-start.c:342:3                                                                                                                                                             
#49 0x0000563ea0b26a0e _start (/home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin/clang+0x12e9a0e)                                                                                                                                       
clang: error: clang frontend command failed with exit code 134 (use -v to see invocation)                                                                                                                                                                         
clang version 19.0.0 (https://github.com/llvm/llvm-project.git fa2421392802025e842454a31ed50dbfab643130)                                                                                                                                                          
Target: x86_64-unknown-linux-gnu                                                                                                                                                                                                                                  
Thread model: posix                                                                                                                                                                                                                                               
InstalledDir: /home/dyung/src/upstream/fa2421392802025e842454a31ed50dbfab643130-linux/bin                                                                                                                                                                         
Build config: +assertions

[dtcxzyw]

Fixed by #98686.