Crash with LoopAnalysis (llvm14-15)

I have a very weird crash I do not understand when just calling LoopAnalysis in an clang pass but not doing anything. This crash happens with llvm 14 and most current 15-dev.

Any insight is really appreciated …

I boiled it down to this most simple setup:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#include "llvm/ADT/Statistic.h"
#include "llvm/IR/IRBuilder.h"
#include "llvm/IR/Module.h"
#include "llvm/Support/Debug.h"
#include "llvm/Support/raw_ostream.h"
#include "llvm/Pass.h"
#include "llvm/InitializePasses.h"
#include "llvm/Passes/PassPlugin.h"
#include "llvm/Passes/PassBuilder.h"
#include "llvm/IR/PassManager.h"
#include "llvm/Analysis/EHPersonalities.h"
#include "llvm/Analysis/PostDominators.h"
#include "llvm/Analysis/LoopInfo.h"
#include "llvm/Analysis/LoopPass.h"
#include "llvm/Transforms/Utils/BasicBlockUtils.h"
#include "llvm/Analysis/ValueTracking.h"
#include "llvm/Passes/OptimizationLevel.h"
#include "llvm/IR/Verifier.h"

using namespace llvm;

namespace {

using LoopInfoCallback = function_ref<const LoopInfo *(Function &F)>;

class Example : public PassInfoMixin<Example> {
 public:
  Example() { }
  PreservedAnalyses run(Module &M, ModuleAnalysisManager &MAM);
 private:
  void workModule(Module &M, LoopInfoCallback LCallback);
};

}  // namespace

extern "C" ::llvm::PassPluginLibraryInfo LLVM_ATTRIBUTE_WEAK
llvmGetPassPluginInfo() {
  return {LLVM_PLUGIN_API_VERSION, "example", "v0.1", [](PassBuilder &PB) {
            PB.registerOptimizerLastEPCallback(
                [](ModulePassManager &MPM, OptimizationLevel OL) {
                  MPM.addPass(Example());
                });
          }};
}

void Example::workModule(Module &M, LoopInfoCallback LCallback) {
  int count = 0;
  for (auto &F : M) {
    const LoopInfo *LI = LCallback(F);  // this triggers the crash
    for (auto &BB : F) {
      for (auto &IN : BB) {
        count++;
      }
    }
  }
  fprintf(stderr, "in: %d\n", count);
}

PreservedAnalyses Example::run(Module &M, ModuleAnalysisManager &MAM) {
  auto &FAM = MAM.getResult<FunctionAnalysisManagerModuleProxy>(M).getManager();
  auto  LoopCallback = [&FAM](Function &F) -> const LoopInfo * {
    return &FAM.getResult<LoopAnalysis>(F);
  };
  workModule(M, LoopCallback);
  verifyModule(M);
  return PreservedAnalyses::all();
}

To compile:
clang+±14 llvm-config-14 --cxxflags -fno-rtti -fPIC -O3 -fPIC -g -Wl,-znodelete -shared test.cc -o test.so llvm-config-14 --ldflags

Using this pass on any program with a loop will produce a crash, e.g.:

#include <stdio.h>
#include <stdlib.h>
int main(int argc, char**argv) {
  int i;
  for (i = 0; i < atoi(argv[1]); ++i) {
    printf("%d\n", i);
  }
  return i;
}

clang-14 -fexperimental-new-pass-manager -fpass-plugin=./test.so -O1 -o test test.c

 #0 0x00007ffff1752e41 PrintStackTraceSignalHandler(void*) Signals.cpp:0:0
 #1 0x00007ffff175070e SignalHandler(int) Signals.cpp:0:0
 #2 0x00007ffff0c22920 (/lib/x86_64-linux-gnu/libc.so.6+0x3c920)
 #3 0x00007ffff1535b32 llvm::BasicBlock::getTerminator() const (.cold) BasicBlock.cpp:0:0
 #4 0x00007ffff1839e98 llvm::iterator_range<llvm::GraphTraits<llvm::BasicBlock*>::ChildIteratorType> llvm::children<llvm::BasicBlock*>(llvm::GraphTraits<llvm::BasicBlock*>::NodeRef const&) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libLLVM-14.so+0x83ae98)
 #5 0x00007ffff183ae2c llvm::SmallVector<llvm::BasicBlock*, 8u> llvm::DomTreeBuilder::SemiNCAInfo<llvm::DominatorTreeBase<llvm::BasicBlock, false> >::getChildren<false>(llvm::BasicBlock*, llvm::DomTreeBuilder::SemiNCAInfo<llvm::DominatorTreeBase<llvm::BasicBlock, false> >::BatchUpdateInfo*) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libLLVM-14.so+0x83be2c)
 #6 0x00007ffff18469ed unsigned int llvm::DomTreeBuilder::SemiNCAInfo<llvm::DominatorTreeBase<llvm::BasicBlock, false> >::runDFS<false, bool (*)(llvm::BasicBlock*, llvm::BasicBlock*)>(llvm::BasicBlock*, unsigned int, bool (*)(llvm::BasicBlock*, llvm::BasicBlock*), unsigned int, llvm::DenseMap<llvm::BasicBlock*, unsigned int, llvm::DenseMapInfo<llvm::BasicBlock*, void>, llvm::detail::DenseMapPair<llvm::BasicBlock*, unsigned int> > const*) (.isra.0) Dominators.cpp:0:0
 #7 0x00007ffff18471bd llvm::DomTreeBuilder::SemiNCAInfo<llvm::DominatorTreeBase<llvm::BasicBlock, false> >::CalculateFromScratch(llvm::DominatorTreeBase<llvm::BasicBlock, false>&, llvm::DomTreeBuilder::SemiNCAInfo<llvm::DominatorTreeBase<llvm::BasicBlock, false> >::BatchUpdateInfo*) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libLLVM-14.so+0x8481bd)
 #8 0x00007ffff184727a llvm::DominatorTreeAnalysis::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libLLVM-14.so+0x84827a)
 #9 0x00007ffff23b644d llvm::detail::AnalysisPassModel<llvm::Function, llvm::DominatorTreeAnalysis, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>::Invalidator>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libLLVM-14.so+0x13b744d)
#10 0x00007ffff18f8425 llvm::AnalysisManager<llvm::Function>::getResultImpl(llvm::AnalysisKey*, llvm::Function&) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libLLVM-14.so+0x8f9425)
#11 0x00007ffff2fcd3e4 llvm::LoopAnalysis::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libLLVM-14.so+0x1fce3e4)
#12 0x00007ffff23b6984 llvm::detail::AnalysisPassModel<llvm::Function, llvm::LoopAnalysis, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>::Invalidator>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libLLVM-14.so+0x13b7984)
#13 0x00007ffff18f8425 llvm::AnalysisManager<llvm::Function>::getResultImpl(llvm::AnalysisKey*, llvm::Function&) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libLLVM-14.so+0x8f9425)
#14 0x00007fffeeab25c0 llvm::LoopAnalysis::Result& llvm::AnalysisManager<llvm::Function>::getResult<llvm::LoopAnalysis>(llvm::Function&) /prg/tmp/llvm-project-llvmorg-14.0.0-rc1/llvm/include/llvm/IR/PassManager.h:0:9
#15 0x00007fffeeab25c0 (anonymous namespace)::Example::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&)::$_1::operator()(llvm::Function&) const /prg/dev/test.cc:75:17
#16 0x00007fffeeab25c0 llvm::LoopInfo const* llvm::function_ref<llvm::LoopInfo const* (llvm::Function&)>::callback_fn<(anonymous namespace)::Example::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&)::$_1>(long, llvm::Function&) /prg/tmp/llvm-project-llvmorg-14.0.0-rc1/llvm/include/llvm/ADT/STLFunctionalExtras.h:45:12
#17 0x00007fffeeab25c0 llvm::function_ref<llvm::LoopInfo const* (llvm::Function&)>::operator()(llvm::Function&) const /prg/tmp/llvm-project-llvmorg-14.0.0-rc1/llvm/include/llvm/ADT/STLFunctionalExtras.h:68:12
#18 0x00007fffeeab25c0 (anonymous namespace)::Example::workModule(llvm::Module&, llvm::function_ref<llvm::LoopInfo const* (llvm::Function&)>) /prg/dev/test.cc:57:26
#19 0x00007fffeeab25c0 (anonymous namespace)::Example::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /prg/dev/test.cc:78:3
#20 0x00007fffeeab25c0 llvm::detail::PassModel<llvm::Module, (anonymous namespace)::Example, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module> >::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /prg/tmp/llvm-project-llvmorg-14.0.0-rc1/llvm/include/llvm/IR/PassManagerInternal.h:88:17
#21 0x00007ffff18f2ae1 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module> >::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libLLVM-14.so+0x8f3ae1)
#22 0x00007ffff62cea33 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream> >&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile> >&) (.constprop.0) BackendUtil.cpp:0:0
#23 0x00007ffff62d35f4 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream> >) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libclang-cpp.so.14+0x19295f4)
#24 0x00007ffff6690651 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libclang-cpp.so.14+0x1ce6651)
#25 0x00007ffff52feef9 clang::ParseAST(clang::Sema&, bool, bool) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libclang-cpp.so.14+0x954ef9)
#26 0x00007ffff6e0f289 clang::FrontendAction::Execute() (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libclang-cpp.so.14+0x2465289)
#27 0x00007ffff6d8d69b clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libclang-cpp.so.14+0x23e369b)
#28 0x00007ffff6e89120 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/../lib/libclang-cpp.so.14+0x24df120)
#29 0x00005555555674d4 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/clang-14+0x134d4)
#30 0x0000555555564445 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&) driver.cpp:0:0
#31 0x0000555555560ab2 main (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/clang-14+0xcab2)
#32 0x00007ffff0c0d7fd __libc_start_main ./csu/../csu/libc-start.c:332:16
#33 0x0000555555563dba _start (/prg/tmp/llvm-project-llvmorg-14.0.0-rc1/build/bin/clang-14+0xfdba)
clang-14: error: unable to execute command: Segmentation fault