Skip to content

Conversation

@dev-priyanshu15
Copy link

[LLVM][LoopVectorize] Fix SIGFPE crash in getPredBlockCostDivisor

When computing block frequency division in getPredBlockCostDivisor,
the function could perform division by zero if BBFreq equals 0.
This caused a floating point exception crash when processing blocks
with zero block frequency information.

Add a guard check to return 1 when BBFreq is 0, avoiding the undefined
behavior while maintaining correct cost model behavior. A divisor of 1
indicates the block is executed at the same frequency as the header,
which is a safe default when frequency information is unavailable.

Fixes issue #172049

…arget integer

When handling TARGET variables in dummy arguments, the code was calling
getFuncArgName() unconditionally. This could cause an assertion failure
when getUniqName() returns an unengaged optional for TARGET variables.

Move getFuncArgName() call to only execute when the variable is not a
TARGET or POINTER, avoiding the assertion error.

Fixes issue llvm#172075
When auto is used as a function parameter type, clang-c API was
incorrectly reporting it as TypeRef with kind unexposed instead of
reporting it as CXType_Auto.

The issue was that CursorVisitor did not have a handler for AutoTypeLoc,
so it fell back to default behavior which resulted in unexposed types.

Add VisitAutoTypeLoc method to properly handle auto type locations in
function parameters. This brings consistency with how auto is handled
in variable declarations.

Fixes issue llvm#172072
When computing block frequency division in getPredBlockCostDivisor,
the function could perform division by zero if BBFreq equals 0.
This caused a floating point exception crash when processing blocks
with zero block frequency information.

Add a guard check to return 1 when BBFreq is 0, avoiding the undefined
behavior while maintaining correct cost model behavior. A divisor of 1
indicates the block is executed at the same frequency as the header,
which is a safe default when frequency information is unavailable.

Fixes issue llvm#172049
@github-actions
Copy link

Thank you for submitting a Pull Request (PR) to the LLVM Project!

This PR will be automatically labeled and the relevant teams will be notified.

If you wish to, you can add reviewers by using the "Reviewers" section on this page.

If this is not working for you, it is probably because you do not have write permissions for the repository. In which case you can instead tag reviewers by name in a comment by using @ followed by their GitHub username.

If you have received no comments on your PR for a week, you can request a review by "ping"ing the PR by adding a comment “Ping”. The common courtesy "ping" rate is once a week. Please remember that you are asking for valuable time from other developers.

If you have further questions, they may be answered by the LLVM GitHub User Guide.

You can also ask questions in a comment on this PR, on the LLVM Discord or on the forums.

@llvmbot llvmbot added clang:as-a-library libclang and C++ API vectorizers flang Flang issues not falling into any other category flang:fir-hlfir llvm:transforms labels Dec 12, 2025
@llvmbot
Copy link
Member

llvmbot commented Dec 12, 2025

@llvm/pr-subscribers-vectorizers

@llvm/pr-subscribers-llvm-transforms

Author: Priyanshu Singh (dev-priyanshu15)

Changes

[LLVM][LoopVectorize] Fix SIGFPE crash in getPredBlockCostDivisor

When computing block frequency division in getPredBlockCostDivisor,
the function could perform division by zero if BBFreq equals 0.
This caused a floating point exception crash when processing blocks
with zero block frequency information.

Add a guard check to return 1 when BBFreq is 0, avoiding the undefined
behavior while maintaining correct cost model behavior. A divisor of 1
indicates the block is executed at the same frequency as the header,
which is a safe default when frequency information is unavailable.

Fixes issue #172049


Full diff: https://github.com/llvm/llvm-project/pull/172094.diff

6 Files Affected:

  • (added) clang/test/Index/auto-function-param.cpp (+14)
  • (modified) clang/tools/libclang/CIndex.cpp (+9)
  • (modified) flang/lib/Optimizer/Transforms/AddAliasTags.cpp (+12-8)
  • (added) flang/test/Transforms/alias-tags-master-private-target.f90 (+26)
  • (modified) llvm/lib/Transforms/Vectorize/LoopVectorize.cpp (+4)
  • (added) llvm/test/Transforms/LoopVectorize/crash-sigfpe-zero-freq.ll (+39)
diff --git a/clang/test/Index/auto-function-param.cpp b/clang/test/Index/auto-function-param.cpp
new file mode 100644
index 0000000000000..5366d8468007e
--- /dev/null
+++ b/clang/test/Index/auto-function-param.cpp
@@ -0,0 +1,14 @@
+// Test case for auto function parameter reported as CXType_Auto
+// This test verifies that auto parameters in function declarations
+// are properly reported as CXType_Auto in the libclang C API
+// See issue #172072
+
+// RUN: c-index-test -test-type %s | FileCheck %s
+
+// Function with auto parameter
+int bar(auto p) {
+  return p;
+}
+
+// CHECK: FunctionDecl=bar:{{.*}} CXType_FunctionProto
+// CHECK: ParmDecl=p:{{.*}} CXType_Auto
diff --git a/clang/tools/libclang/CIndex.cpp b/clang/tools/libclang/CIndex.cpp
index 32e84248c1b27..bb0816b0447a9 100644
--- a/clang/tools/libclang/CIndex.cpp
+++ b/clang/tools/libclang/CIndex.cpp
@@ -1789,6 +1789,15 @@ bool CursorVisitor::VisitAdjustedTypeLoc(AdjustedTypeLoc TL) {
   return Visit(TL.getOriginalLoc());
 }
 
+bool CursorVisitor::VisitAutoTypeLoc(AutoTypeLoc TL) {
+  // AutoTypeLoc represents the location of an auto type specifier.
+  // We do not visit children because the auto type itself is complete.
+  // This handler ensures that auto function parameters are properly
+  // reported as CXType_Auto in the libclang C API, rather than being
+  // incorrectly reported as TypeRef/unexposed.
+  return false;
+}
+
 bool CursorVisitor::VisitDeducedTemplateSpecializationTypeLoc(
     DeducedTemplateSpecializationTypeLoc TL) {
   if (VisitTemplateName(TL.getTypePtr()->getTemplateName(),
diff --git a/flang/lib/Optimizer/Transforms/AddAliasTags.cpp b/flang/lib/Optimizer/Transforms/AddAliasTags.cpp
index 3718848c05775..a0b10d1858a92 100644
--- a/flang/lib/Optimizer/Transforms/AddAliasTags.cpp
+++ b/flang/lib/Optimizer/Transforms/AddAliasTags.cpp
@@ -702,20 +702,24 @@ void AddAliasTagsPass::runOnAliasInterface(fir::FirAliasTagOpInterface op,
              source.kind == fir::AliasAnalysis::SourceKind::Argument) {
     LLVM_DEBUG(llvm::dbgs().indent(2)
                << "Found reference to dummy argument at " << *op << "\n");
-    std::string name = getFuncArgName(llvm::cast<mlir::Value>(source.origin.u));
     // POINTERS can alias with any POINTER or TARGET. Assume that TARGET dummy
     // arguments might alias with each other (because of the "TARGET" hole for
     // dummy arguments). See flang/docs/Aliasing.md.
+    // If it is a TARGET or POINTER, then we do not care about the name,
+    // because the tag points to the root of the subtree currently.
     if (source.isTargetOrPointer()) {
       tag = state.getFuncTreeWithScope(func, scopeOp).targetDataTree.getTag();
-    } else if (!name.empty()) {
-      tag = state.getFuncTreeWithScope(func, scopeOp)
-                .dummyArgDataTree.getTag(name);
     } else {
-      LLVM_DEBUG(llvm::dbgs().indent(2)
-                 << "WARN: couldn't find a name for dummy argument " << *op
-                 << "\n");
-      tag = state.getFuncTreeWithScope(func, scopeOp).dummyArgDataTree.getTag();
+      std::string name = getFuncArgName(llvm::cast<mlir::Value>(source.origin.u));
+      if (!name.empty()) {
+        tag = state.getFuncTreeWithScope(func, scopeOp)
+                  .dummyArgDataTree.getTag(name);
+      } else {
+        LLVM_DEBUG(llvm::dbgs().indent(2)
+                   << "WARN: couldn't find a name for dummy argument " << *op
+                   << "\n");
+        tag = state.getFuncTreeWithScope(func, scopeOp).dummyArgDataTree.getTag();
+      }
     }
 
     // TBAA for global variables without descriptors
diff --git a/flang/test/Transforms/alias-tags-master-private-target.f90 b/flang/test/Transforms/alias-tags-master-private-target.f90
new file mode 100644
index 0000000000000..0251376476c64
--- /dev/null
+++ b/flang/test/Transforms/alias-tags-master-private-target.f90
@@ -0,0 +1,26 @@
+! Test case for regression in OpenMP master region with private target integer
+! This test was failing with an assertion error in AddAliasTags.cpp
+! See issue #172075
+
+! RUN: %flang -fopenmp -c -O1 %s -o %t.o 2>&1 | FileCheck %s --allow-empty
+
+module test
+contains
+subroutine omp_master_repro()
+  implicit none
+  integer, parameter :: nim = 4
+  integer, parameter :: nvals = 8
+  integer, target :: ui
+  integer :: hold1(nvals, nim)
+  hold1 = 0
+  !$OMP PARALLEL DEFAULT(NONE) &
+  !$OMP PRIVATE(ui) &
+  !$OMP SHARED(hold1, nim)
+  !$OMP MASTER
+  do ui = 1, nim
+     hold1(:, ui) = 1
+  end do
+  !$OMP END MASTER
+  !$OMP END PARALLEL
+end subroutine omp_master_repro
+end module test
diff --git a/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp b/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
index 0108351f821f4..ed83aa3447bf9 100644
--- a/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
+++ b/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
@@ -2907,6 +2907,10 @@ uint64_t LoopVectorizationCostModel::getPredBlockCostDivisor(
   uint64_t BBFreq = getBFI().getBlockFreq(BB).getFrequency();
   assert(HeaderFreq >= BBFreq &&
          "Header has smaller block freq than dominated BB?");
+  // Guard against division by zero when BBFreq is 0.
+  // In such cases, return 1 to avoid undefined behavior.
+  if (BBFreq == 0)
+    return 1;
   return std::round((double)HeaderFreq / BBFreq);
 }
 
diff --git a/llvm/test/Transforms/LoopVectorize/crash-sigfpe-zero-freq.ll b/llvm/test/Transforms/LoopVectorize/crash-sigfpe-zero-freq.ll
new file mode 100644
index 0000000000000..3b6f3b67d23c5
--- /dev/null
+++ b/llvm/test/Transforms/LoopVectorize/crash-sigfpe-zero-freq.ll
@@ -0,0 +1,39 @@
+; Test case for crash with Floating point Exception in loop-vectorize pass
+; This test verifies that the loop vectorizer does not crash with SIGFPE
+; when processing blocks with zero block frequency.
+; See issue #172049
+
+; RUN: opt -passes=loop-vectorize -S %s
+
+; ModuleID = 'reduced.ll'
+source_filename = "reduced.ll"
+target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128-ni:1-p2:32:8:8:32-ni:2"
+target triple = "x86_64-unknown-linux-gnu"
+
+define ptr addrspace(1) @wombat() gc "statepoint-example" {
+bb:
+  br label %bb2
+
+bb1:
+  ret ptr addrspace(1) null
+
+bb2:
+  %phi = phi i64 [ %add, %bb6 ], [ 0, %bb ]
+  br i1 false, label %bb3, label %bb6
+
+bb3:
+  br i1 false, label %bb4, label %bb5, !prof !0
+
+bb4:
+  br label %bb6
+
+bb5:
+  br label %bb6
+
+bb6:
+  %add = add i64 %phi, 1
+  %icmp = icmp eq i64 %phi, 0
+  br i1 %icmp, label %bb2, label %bb1
+}
+
+!0 = !{!"branch_weights", i32 1, i32 0}

@llvmbot
Copy link
Member

llvmbot commented Dec 12, 2025

@llvm/pr-subscribers-flang-fir-hlfir

Author: Priyanshu Singh (dev-priyanshu15)

Changes

[LLVM][LoopVectorize] Fix SIGFPE crash in getPredBlockCostDivisor

When computing block frequency division in getPredBlockCostDivisor,
the function could perform division by zero if BBFreq equals 0.
This caused a floating point exception crash when processing blocks
with zero block frequency information.

Add a guard check to return 1 when BBFreq is 0, avoiding the undefined
behavior while maintaining correct cost model behavior. A divisor of 1
indicates the block is executed at the same frequency as the header,
which is a safe default when frequency information is unavailable.

Fixes issue #172049


Full diff: https://github.com/llvm/llvm-project/pull/172094.diff

6 Files Affected:

  • (added) clang/test/Index/auto-function-param.cpp (+14)
  • (modified) clang/tools/libclang/CIndex.cpp (+9)
  • (modified) flang/lib/Optimizer/Transforms/AddAliasTags.cpp (+12-8)
  • (added) flang/test/Transforms/alias-tags-master-private-target.f90 (+26)
  • (modified) llvm/lib/Transforms/Vectorize/LoopVectorize.cpp (+4)
  • (added) llvm/test/Transforms/LoopVectorize/crash-sigfpe-zero-freq.ll (+39)
diff --git a/clang/test/Index/auto-function-param.cpp b/clang/test/Index/auto-function-param.cpp
new file mode 100644
index 0000000000000..5366d8468007e
--- /dev/null
+++ b/clang/test/Index/auto-function-param.cpp
@@ -0,0 +1,14 @@
+// Test case for auto function parameter reported as CXType_Auto
+// This test verifies that auto parameters in function declarations
+// are properly reported as CXType_Auto in the libclang C API
+// See issue #172072
+
+// RUN: c-index-test -test-type %s | FileCheck %s
+
+// Function with auto parameter
+int bar(auto p) {
+  return p;
+}
+
+// CHECK: FunctionDecl=bar:{{.*}} CXType_FunctionProto
+// CHECK: ParmDecl=p:{{.*}} CXType_Auto
diff --git a/clang/tools/libclang/CIndex.cpp b/clang/tools/libclang/CIndex.cpp
index 32e84248c1b27..bb0816b0447a9 100644
--- a/clang/tools/libclang/CIndex.cpp
+++ b/clang/tools/libclang/CIndex.cpp
@@ -1789,6 +1789,15 @@ bool CursorVisitor::VisitAdjustedTypeLoc(AdjustedTypeLoc TL) {
   return Visit(TL.getOriginalLoc());
 }
 
+bool CursorVisitor::VisitAutoTypeLoc(AutoTypeLoc TL) {
+  // AutoTypeLoc represents the location of an auto type specifier.
+  // We do not visit children because the auto type itself is complete.
+  // This handler ensures that auto function parameters are properly
+  // reported as CXType_Auto in the libclang C API, rather than being
+  // incorrectly reported as TypeRef/unexposed.
+  return false;
+}
+
 bool CursorVisitor::VisitDeducedTemplateSpecializationTypeLoc(
     DeducedTemplateSpecializationTypeLoc TL) {
   if (VisitTemplateName(TL.getTypePtr()->getTemplateName(),
diff --git a/flang/lib/Optimizer/Transforms/AddAliasTags.cpp b/flang/lib/Optimizer/Transforms/AddAliasTags.cpp
index 3718848c05775..a0b10d1858a92 100644
--- a/flang/lib/Optimizer/Transforms/AddAliasTags.cpp
+++ b/flang/lib/Optimizer/Transforms/AddAliasTags.cpp
@@ -702,20 +702,24 @@ void AddAliasTagsPass::runOnAliasInterface(fir::FirAliasTagOpInterface op,
              source.kind == fir::AliasAnalysis::SourceKind::Argument) {
     LLVM_DEBUG(llvm::dbgs().indent(2)
                << "Found reference to dummy argument at " << *op << "\n");
-    std::string name = getFuncArgName(llvm::cast<mlir::Value>(source.origin.u));
     // POINTERS can alias with any POINTER or TARGET. Assume that TARGET dummy
     // arguments might alias with each other (because of the "TARGET" hole for
     // dummy arguments). See flang/docs/Aliasing.md.
+    // If it is a TARGET or POINTER, then we do not care about the name,
+    // because the tag points to the root of the subtree currently.
     if (source.isTargetOrPointer()) {
       tag = state.getFuncTreeWithScope(func, scopeOp).targetDataTree.getTag();
-    } else if (!name.empty()) {
-      tag = state.getFuncTreeWithScope(func, scopeOp)
-                .dummyArgDataTree.getTag(name);
     } else {
-      LLVM_DEBUG(llvm::dbgs().indent(2)
-                 << "WARN: couldn't find a name for dummy argument " << *op
-                 << "\n");
-      tag = state.getFuncTreeWithScope(func, scopeOp).dummyArgDataTree.getTag();
+      std::string name = getFuncArgName(llvm::cast<mlir::Value>(source.origin.u));
+      if (!name.empty()) {
+        tag = state.getFuncTreeWithScope(func, scopeOp)
+                  .dummyArgDataTree.getTag(name);
+      } else {
+        LLVM_DEBUG(llvm::dbgs().indent(2)
+                   << "WARN: couldn't find a name for dummy argument " << *op
+                   << "\n");
+        tag = state.getFuncTreeWithScope(func, scopeOp).dummyArgDataTree.getTag();
+      }
     }
 
     // TBAA for global variables without descriptors
diff --git a/flang/test/Transforms/alias-tags-master-private-target.f90 b/flang/test/Transforms/alias-tags-master-private-target.f90
new file mode 100644
index 0000000000000..0251376476c64
--- /dev/null
+++ b/flang/test/Transforms/alias-tags-master-private-target.f90
@@ -0,0 +1,26 @@
+! Test case for regression in OpenMP master region with private target integer
+! This test was failing with an assertion error in AddAliasTags.cpp
+! See issue #172075
+
+! RUN: %flang -fopenmp -c -O1 %s -o %t.o 2>&1 | FileCheck %s --allow-empty
+
+module test
+contains
+subroutine omp_master_repro()
+  implicit none
+  integer, parameter :: nim = 4
+  integer, parameter :: nvals = 8
+  integer, target :: ui
+  integer :: hold1(nvals, nim)
+  hold1 = 0
+  !$OMP PARALLEL DEFAULT(NONE) &
+  !$OMP PRIVATE(ui) &
+  !$OMP SHARED(hold1, nim)
+  !$OMP MASTER
+  do ui = 1, nim
+     hold1(:, ui) = 1
+  end do
+  !$OMP END MASTER
+  !$OMP END PARALLEL
+end subroutine omp_master_repro
+end module test
diff --git a/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp b/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
index 0108351f821f4..ed83aa3447bf9 100644
--- a/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
+++ b/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
@@ -2907,6 +2907,10 @@ uint64_t LoopVectorizationCostModel::getPredBlockCostDivisor(
   uint64_t BBFreq = getBFI().getBlockFreq(BB).getFrequency();
   assert(HeaderFreq >= BBFreq &&
          "Header has smaller block freq than dominated BB?");
+  // Guard against division by zero when BBFreq is 0.
+  // In such cases, return 1 to avoid undefined behavior.
+  if (BBFreq == 0)
+    return 1;
   return std::round((double)HeaderFreq / BBFreq);
 }
 
diff --git a/llvm/test/Transforms/LoopVectorize/crash-sigfpe-zero-freq.ll b/llvm/test/Transforms/LoopVectorize/crash-sigfpe-zero-freq.ll
new file mode 100644
index 0000000000000..3b6f3b67d23c5
--- /dev/null
+++ b/llvm/test/Transforms/LoopVectorize/crash-sigfpe-zero-freq.ll
@@ -0,0 +1,39 @@
+; Test case for crash with Floating point Exception in loop-vectorize pass
+; This test verifies that the loop vectorizer does not crash with SIGFPE
+; when processing blocks with zero block frequency.
+; See issue #172049
+
+; RUN: opt -passes=loop-vectorize -S %s
+
+; ModuleID = 'reduced.ll'
+source_filename = "reduced.ll"
+target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128-ni:1-p2:32:8:8:32-ni:2"
+target triple = "x86_64-unknown-linux-gnu"
+
+define ptr addrspace(1) @wombat() gc "statepoint-example" {
+bb:
+  br label %bb2
+
+bb1:
+  ret ptr addrspace(1) null
+
+bb2:
+  %phi = phi i64 [ %add, %bb6 ], [ 0, %bb ]
+  br i1 false, label %bb3, label %bb6
+
+bb3:
+  br i1 false, label %bb4, label %bb5, !prof !0
+
+bb4:
+  br label %bb6
+
+bb5:
+  br label %bb6
+
+bb6:
+  %add = add i64 %phi, 1
+  %icmp = icmp eq i64 %phi, 0
+  br i1 %icmp, label %bb2, label %bb1
+}
+
+!0 = !{!"branch_weights", i32 1, i32 0}

Copy link
Contributor

@lukel97 lukel97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi thanks for submitting a PR for this. Unfortunately I think the issue that was filed for this may be using a version of opt that's slightly out of date. Were you definitely able to recreate the crash after 0fbb45e?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

clang:as-a-library libclang and C++ API flang:fir-hlfir flang Flang issues not falling into any other category llvm:transforms vectorizers

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants