Function inline pass core dump when removing a function


In this case, I wanted to hack globalopt pass to require ScalarEvolution analysis. It seems ScalarEvolution is not released after globalopt pass, and it will hold a reference to the basicblocks. Later when the function is removed(by inline pass), coredump happened:
opt test.bc -mem2reg -globalopt -inline -loop-unroll -debug-pass Details -o out.bc >& log

So it seems to me if a pass wanted to require ScalarEvolution, ScalarEvolution::releaseMemory should be called every time after the pass is called. Is that right?

Steps to reproduce(In case some of you do not have clang installed, test.bc attached):

  1. The makefile:

clang test.c -disable-llvm-optzns -emit-llvm -S
llvm-as test.s -o test.bc
opt test.bc -mem2reg -globalopt -inline -loop-unroll -debug-pass Details -o out.bc >& log
llvm-dis < out.bc > out.ll

  1. test.c:

#include <stdio.h>

int A[100];
static int toBeInlined(int A[100]) {
int ans = 0;
for (int i=0; i<100; ++i)
return ans;

int main() {
for (int i=0; i<100; ++i)
if (i%3==0)
A[i] = i;
A[i] = i+1;
int ans = toBeInlined(A);
printf("%d\n", ans);
return 0;

  1. Hack to globalopt pass:

using namespace llvm;

@@ -63,6 +65,7 @@
struct GlobalOpt : public ModulePass {
virtual void getAnalysisUsage(AnalysisUsage &AU) const {

  • AU.addRequired();
    static char ID; // Pass identification, replacement for typeid
    GlobalOpt() : ModulePass(ID) {
    @@ -92,6 +95,7 @@
    INITIALIZE_PASS_BEGIN(GlobalOpt, “globalopt”,
    “Global Variable Optimizer”, false, false)
    INITIALIZE_PASS_END(GlobalOpt, “globalopt”,
    “Global Variable Optimizer”, false, false)

@@ -2084,6 +2088,14 @@
for (Module::iterator FI = M.begin(), E = M.end(); FI != E; ) {
Function *F = FI++;
// Functions without names cannot be referenced outside this module.

  • if (!F->isDeclaration()) {
  • ScalarEvolution *SE = &getAnalysis(*F);
  • for(inst_iterator i = inst_begin(F), e = inst_end(F); i != e; ++i) {
  • Instruction *I = &*i;
  • if (I->getType()->isIntegerTy() || I->getType()->isPointerTy())
  • const SCEV* SS = SE->getSCEV(I);
  • }
  • }
    if (!F->hasName() && !F->isDeclaration())
  1. The coredump:

(gdb) bt
#0 0x000000386de30265 in raise () from /lib64/
#1 0x000000386de31d10 in abort () from /lib64/
#2 0x0000000000aa93e6 in llvm::llvm_unreachable_internal (
msg=0xcce748 “An asserting value handle still pointed to this value!”,
file=0xccde18 “/home/xchen/llvm/lib/VMCore/Value.cpp”, line=620)
at /home/xchen/llvm/lib/Support/ErrorHandling.cpp:98
#3 0x0000000000a6d369 in llvm::ValueHandleBase::ValueIsDeleted (V=0x10f7050)
at /home/xchen/llvm/lib/VMCore/Value.cpp:619
#4 0x0000000000a6e631 in llvm::Value::~Value (this=0x10f7050, __in_chrg=)
at /home/xchen/llvm/lib/VMCore/Value.cpp:59
#5 0x00000000009401fd in llvm::BasicBlock::~BasicBlock (this=0x10f7050, __in_chrg=)
at /home/xchen/llvm/lib/VMCore/BasicBlock.cpp:83
#6 0x000000000068503d in llvm::ilist_node_traitsllvm::BasicBlock::deleteNode (V=0x10f7050)
at /home/xchen/llvm/include/llvm/ADT/ilist.h:112
#7 0x0000000000686ed3 in llvm::iplist<llvm::BasicBlock, llvm::ilist_traitsllvm::BasicBlock >::erase (
this=0x10f3f68, where=…) at /home/xchen/llvm/include/llvm/ADT/ilist.h:463
#8 0x00000000009400a6 in llvm::BasicBlock::eraseFromParent (this=0x10f7050)
at /home/xchen/llvm/lib/VMCore/BasicBlock.cpp:101
#9 0x0000000000a155a7 in llvm::Function::dropAllReferences (this=0x10f3f10)
at /home/xchen/llvm/lib/VMCore/Function.cpp:242
#10 0x0000000000a15701 in llvm::Function::~Function (this=0x10f3f10, __in_chrg=)
at /home/xchen/llvm/lib/VMCore/Function.cpp:188
#11 0x0000000000598107 in llvm::Inliner::runOnSCC (this=0x10e9780, SCC=…)
at /home/xchen/llvm/lib/Transforms/IPO/Inliner.cpp:487
#12 0x000000000079a828 in (anonymous namespace)::CGPassManager::RunPassOnSCC (this=0x10e9f80, P=0x10e9780,
CurSCC=…, CG=…, CallGraphUpToDate=@0x7fffffffd0af, DevirtualizedCall=@0x7fffffffd1f7)
at /home/xchen/llvm/lib/Analysis/IPA/CallGraphSCCPass.cpp:121
#13 0x000000000079ac71 in (anonymous namespace)::CGPassManager::RunAllPassesOnSCC (this=0x10e9f80,
CurSCC=…, CG=…, DevirtualizedCall=@0x7fffffffd1f7)
at /home/xchen/llvm/lib/Analysis/IPA/CallGraphSCCPass.cpp:402
#14 0x000000000079b046 in (anonymous namespace)::CGPassManager::runOnModule (this=0x10e9f80, M=…)
at /home/xchen/llvm/lib/Analysis/IPA/CallGraphSCCPass.cpp:457
#15 0x0000000000a50d49 in llvm::MPPassManager::runOnModule (this=0x10f4100, M=…)
at /home/xchen/llvm/lib/VMCore/PassManager.cpp:1572
—Type to continue, or q to quit—
#16 0x0000000000a521b9 in llvm::PassManagerImpl::run (this=0x10f4460, M=…)
at /home/xchen/llvm/lib/VMCore/PassManager.cpp:1655
#17 0x0000000000a5221b in llvm::PassManager::run (this=0x7fffffffd4b0, M=…)
at /home/xchen/llvm/lib/VMCore/PassManager.cpp:1684
#18 0x0000000000541e77 in main (argc=10, argv=0x7fffffffd718) at /home/xchen/llvm/tools/opt/opt.cpp:745

test.bc (1.14 KB)