Segfault in 'Simplify the CFG' pass with Pony 0.22.6

[burjui]

Got a segfault compiling my hobby project on Arch Linux x86_64:
https://bitbucket.org/bytefu/funky/src/simplify-cfg-fail/

$ ponyc
Building builtin -> /usr/lib/pony/0.22.6/packages/builtin
Building . -> /home/burjui/Devel/funky
Building libfunky -> /home/burjui/Devel/funky/libfunky
Building files -> /usr/lib/pony/0.22.6/packages/files
Building time -> /usr/lib/pony/0.22.6/packages/time
Building collections -> /usr/lib/pony/0.22.6/packages/collections
Building ponytest -> /usr/lib/pony/0.22.6/packages/ponytest
Building buffered -> /usr/lib/pony/0.22.6/packages/buffered
Building term -> /usr/lib/pony/0.22.6/packages/term
Building promises -> /usr/lib/pony/0.22.6/packages/promises
Building strings -> /usr/lib/pony/0.22.6/packages/strings
Building signals -> /usr/lib/pony/0.22.6/packages/signals
Building capsicum -> /usr/lib/pony/0.22.6/packages/capsicum
Building format -> /usr/lib/pony/0.22.6/packages/format
Building itertools -> /usr/lib/pony/0.22.6/packages/itertools
Building libfunky/ast -> /home/burjui/Devel/funky/libfunky/ast
Generating
 Reachability
 Selector painting
 Data prototypes
 Data types
 Function prototypes
 Functions
 Descriptors
Optimising
Stack dump:
0.      Running pass 'Simplify the CFG' on function '@Main_val_process_ooo'
[1]    9226 segmentation fault (core dumped)  ponyc

Though the segfault goes away after uncommenting the line 66 in main.pony:

token_count = token_count + 1

GDB shows the following stacktrace:

#0  0x00007ffff4f747c4 in llvm::removeUnreachableBlocks(llvm::Function&, llvm::LazyValueInfo*) () from /usr/lib/libLLVM-6.0.so
#1  0x00007ffff5376dab in ?? () from /usr/lib/libLLVM-6.0.so
#2  0x00007ffff47efdc1 in llvm::FPPassManager::runOnFunction(llvm::Function&) ()
   from /usr/lib/libLLVM-6.0.so
#3  0x00007ffff47efebd in llvm::legacy::FunctionPassManagerImpl::run(llvm::Function&)
    () from /usr/lib/libLLVM-6.0.so
#4  0x00007ffff47f0405 in llvm::legacy::FunctionPassManager::run(llvm::Function&) ()
   from /usr/lib/libLLVM-6.0.so
#5  0x00005555555fc8b4 in optimise(compile_t*, bool) ()
#6  0x00005555555fca40 in genopt ()
#7  0x000055555560b031 in genexe ()
#8  0x000055555559a96e in codegen ()
#9  0x0000555555579be7 in compile_package ()
#10 0x000055555557978d in main ()

[SeanTAllen]

It would appear to be read code removing a giant chunk of the program and then getting angry.

What was the last version of Pony that you know this compiled with?

[SeanTAllen]

@burjui could you try to create a more minimal example?

[SeanTAllen]

This was introduced by 9222f08 and my fix for #2735 which was also caused by the same commit didn't fix this. A minimal example would go a long way to helping with this.

[SeanTAllen]

Here's a minimal example that I think is the same.

actor Main
  new create(env: Env) => 
    var token = U8(1)
    repeat
      (token, let source) = (U8(1), U8(2))
    until token == 2 end

[SeanTAllen]

So the problem here is in genreference.c

changing:

    if(value == GEN_NOVALUE)
    {

      ponyint_pool_free_size(buf_size, elements);
      return GEN_NOVALUE;
    }

to

    if(value == GEN_NOVALUE)
    {
      ponyint_pool_free_size(buf_size, elements);
      return GEN_NOTNEEDED;
    }

fixes the problem BUT...

that would reopen this issue: #2662

[SeanTAllen]

@jemc @Praetonus I think this one is past my current compiler knowledge paygrade.

[SeanTAllen]

changing the return type at the end of gen_localdecl to GEN_NOTNEEDED fixes this bug.

AND... the tests all pass, so, i'm going to open a PR for review.

[SeanTAllen]

@burjui #2763 fixes your issue. I've tested both my minimal example and your full project.

[burjui]

I tested the fix and it works, thank you. I have never seen bugfixes coming that soon after reporting an issue, wonderful!

[burjui]

Found another case that causes a segfault even with the fix (tested on issue-2760 branch):

actor Main
  new create(env: Env) =>
    let x: (None | U8) = 1
    while true do
      let _: None = match x
        | let _: U8 => None
      end
    end

$ ponyc
...
0.      Running pass 'Simplify the CFG' on function '@Main_tag_create_oo'
[1]    18802 segmentation fault (core dumped)  ponyc

Same backtrace

[SeanTAllen]

Interesting. Its looking like a different bug. But I need more time to triage. @burjui I might ask you to open a different issue.

[SeanTAllen]

@burjui this is a different bug that appears in the same kind of way. can you open an issue for it?

[SeanTAllen]

This existed at least as far back as 0.21.3

[SeanTAllen]

This goes back to the introduction of the _ as valid syntax. Without that, this compiles now, so when opening a new issue, we should note that.

[burjui]

Created an issue: #2767