clang crashes at -Os on x86_64-linux-gnu: Assertion `UnscheduledDeps >= 0 && "invariant"' failed

[zhendongsu]

It's a very recent regression as it doesn't reproduce with the latest Compiler Explorer build.

[525] % clangtk -v
clang version 22.0.0git (https://github.com/llvm/llvm-project.git 4f15debe13af14e0fd668ee4861aff6dbc5283df)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/11
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/12
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/12
Candidate multilib: .;@m64
Selected multilib: .;@m64
Found CUDA installation: /usr/local/cuda, version 12.1
[526] % 
[526] % clangtk -Os small.c
clang-22: /local/suz-local/software/clangbuild/llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:5052: int llvm::slpvectorizer::BoUpSLP::ScheduleCopyableData::incrementUnscheduledDeps(int): Assertion `UnscheduledDeps >= 0 && "invariant"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -Os -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name small.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/local/suz-local/software/emitesting/bugs/bug147/red2 -fcoverage-compilation-dir=/local/suz-local/software/emitesting/bugs/bug147/red2 -resource-dir /local/home/suz/suz-local/software/local/clang-trunk/lib/clang/22 -I /usr/local/include -I /local/suz-local/software/local/include -internal-isystem /local/home/suz/suz-local/software/local/clang-trunk/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fmessage-length=130 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/small-d03d6d.o -x c small.c
1.	<eof> parser at end of file
2.	Optimizer
3.	Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O2>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "small.c"
4.	Running pass "slp-vectorizer" on function "main"
 #0 0x000055dc377df650 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x4265650)
 #1 0x000055dc377dc2ff llvm::sys::RunSignalHandlers() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x42622ff)
 #2 0x000055dc377dc452 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x00007fe412c00520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007fe412c549fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x00007fe412c549fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x00007fe412c549fc pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x00007fe412c00476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x00007fe412be67f3 abort ./stdlib/abort.c:81:7
 #9 0x00007fe412be671b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x00007fe412bf7e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x000055dc3936cc45 void llvm::slpvectorizer::BoUpSLP::BlockScheduling::schedule<llvm::SetVector<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::SmallVector<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, 0u>, llvm::DenseSet<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::DenseMapInfo<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, void>>, 0u>>(llvm::slpvectorizer::BoUpSLP const&, (anonymous namespace)::InstructionsState const&, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&, llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::SetVector<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::SmallVector<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, 0u>, llvm::DenseSet<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::DenseMapInfo<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, void>>, 0u>&)::'lambda'(llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::ArrayRef<llvm::slpvectorizer::BoUpSLP::ScheduleBundle*>)::operator()(llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::ArrayRef<llvm::slpvectorizer::BoUpSLP::ScheduleBundle*>) const SLPVectorizer.cpp:0:0
#12 0x000055dc3936fc0e llvm::slpvectorizer::BoUpSLP::BlockScheduling::tryScheduleBundle(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP*, (anonymous namespace)::InstructionsState const&, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&)::'lambda0'(bool, llvm::slpvectorizer::BoUpSLP::ScheduleBundle&)::operator()(bool, llvm::slpvectorizer::BoUpSLP::ScheduleBundle&) const SLPVectorizer.cpp:0:0
#13 0x000055dc39371ab9 llvm::slpvectorizer::BoUpSLP::BlockScheduling::tryScheduleBundle(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP*, (anonymous namespace)::InstructionsState const&, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&) SLPVectorizer.cpp:0:0
#14 0x000055dc3937367e llvm::slpvectorizer::BoUpSLP::buildTreeRec(llvm::ArrayRef<llvm::Value*>, unsigned int, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&, unsigned int) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x5df967e)
#15 0x000055dc39375899 llvm::slpvectorizer::BoUpSLP::buildTreeRec(llvm::ArrayRef<llvm::Value*>, unsigned int, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&, unsigned int) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x5dfb899)
#16 0x000055dc393749b7 llvm::slpvectorizer::BoUpSLP::buildTreeRec(llvm::ArrayRef<llvm::Value*>, unsigned int, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&, unsigned int) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x5dfa9b7)
#17 0x000055dc393b0905 llvm::SLPVectorizerPass::tryToVectorizeList(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP&, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x5e36905)
#18 0x000055dc393b5d31 bool tryToVectorizeSequence<llvm::Value>(llvm::SmallVectorImpl<llvm::Value*>&, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::ArrayRef<llvm::Value*>, bool)>, bool, llvm::slpvectorizer::BoUpSLP&) (.constprop.0) SLPVectorizer.cpp:0:0
#19 0x000055dc393b74a4 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x5e3d4a4)
#20 0x000055dc393bf696 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (.part.0) SLPVectorizer.cpp:0:0
#21 0x000055dc393c0271 llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x5e46271)
#22 0x000055dc388c6556 llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x534c556)
#23 0x000055dc3711f507 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x3ba5507)
#24 0x000055dc34874766 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x12fa766)
#25 0x000055dc3711fa29 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x3ba5a29)
#26 0x000055dc34874e56 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x12fae56)
#27 0x000055dc3711d844 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x3ba3844)
#28 0x000055dc37a85d03 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#29 0x000055dc37a8a2a3 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x45102a3)
#30 0x000055dc3818428f clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x4c0a28f)
#31 0x000055dc39bebe4c clang::ParseAST(clang::Sema&, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x6671e4c)
#32 0x000055dc384a1989 clang::FrontendAction::Execute() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x4f27989)
#33 0x000055dc3841d255 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x4ea3255)
#34 0x000055dc385925b8 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x50185b8)
#35 0x000055dc343f4db8 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0xe7adb8)
#36 0x000055dc343eb36a ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#37 0x000055dc343efe74 clang_main(int, char**, llvm::ToolContext const&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0xe75e74)
#38 0x000055dc342bbf7b main (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0xd41f7b)
#39 0x00007fe412be7d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#40 0x00007fe412be7e40 call_init ./csu/../csu/libc-start.c:128:20
#41 0x00007fe412be7e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#42 0x000055dc343eaa95 _start (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0xe70a95)
clangtk: error: unable to execute command: Aborted
clangtk: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.0.0git (https://github.com/llvm/llvm-project.git 4f15debe13af14e0fd668ee4861aff6dbc5283df)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
clangtk: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clangtk: note: diagnostic msg: /tmp/small-e9202f.c
clangtk: note: diagnostic msg: /tmp/small-e9202f.sh
clangtk: note: diagnostic msg: 

********************
[527] % cat small.c
int a, d, e, g, h, i, j = 0, k = 1, l = 0, m = 0;
int n(int p[]) {
  for (int b = 0; b < 3; b++)
    for (int c = 0; c < 3; c++)
      if (p[c])
        return b;
  return 0;
}
int main() {
  while (1) {
    int f = j, o[] = {l, f, 0};
    h = i = n(o);
    k = j = e - k + 1;
    l = e + 1 + g + 1;
    do {
      if (a + l)
        return 0;
      g = 2 * i - 1;
      for (; m < d; ++m)
        e = a;
    } while (a);
  }
  return 0;
}

[zhendongsu]

Hi Alexey (@alexey-bataev), thanks for triaging and fixing these SLPVectorizer issues! I just built the latest Clang/LLVM, and it seems that the test still causes the same assertion failure.

[519] % clangtk -v
clang version 22.0.0git (https://github.com/llvm/llvm-project.git 0b04168948d00baf9c656ce02a85dc5cf6703581)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/software/local/clang-trunk/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/14
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/14
Candidate multilib: .;@m64
Selected multilib: .;@m64
Found CUDA installation: /usr/local/cuda, version 
[520] % 
[520] % clangtk -Os small.c
clang-22: /local/suz-local/software/clangbuild/llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:5052: int llvm::slpvectorizer::BoUpSLP::ScheduleCopyableData::incrementUnscheduledDeps(int): Assertion `UnscheduledDeps >= 0 && "invariant"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /local/home/suz/software/local/clang-trunk/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -Os -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name small.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/home/suz -fcoverage-compilation-dir=/home/suz -resource-dir /local/home/suz/software/local/clang-trunk/lib/clang/22 -I /usr/local/include -I /local/suz-local/software/local/include -internal-isystem /local/home/suz/software/local/clang-trunk/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fmessage-length=130 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/small-6e13cc.o -x c small.c
1.	<eof> parser at end of file
2.	Optimizer
3.	Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O2>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "small.c"
4.	Running pass "slp-vectorizer" on function "main"
 #0 0x00005ef843844f32 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x42e1f32)
 #1 0x00005ef843841c2f llvm::sys::RunSignalHandlers() (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x42dec2f)
 #2 0x00005ef843841d7c SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x00007cbc86645330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
 #4 0x00007cbc8669eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x00007cbc8669eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x00007cbc8669eb2c pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x00007cbc8664527e raise ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x00007cbc866288ff abort ./stdlib/abort.c:81:7
 #9 0x00007cbc8662881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x00007cbc8663b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#11 0x00005ef84543ab16 void llvm::slpvectorizer::BoUpSLP::BlockScheduling::schedule<llvm::SetVector<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::SmallVector<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, 0u>, llvm::DenseSet<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::DenseMapInfo<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, void>>, 0u>>(llvm::slpvectorizer::BoUpSLP const&, (anonymous namespace)::InstructionsState const&, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&, llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::SetVector<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::SmallVector<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, 0u>, llvm::DenseSet<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::DenseMapInfo<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, void>>, 0u>&)::'lambda'(llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::ArrayRef<llvm::slpvectorizer::BoUpSLP::ScheduleBundle*>)::operator()(llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::ArrayRef<llvm::slpvectorizer::BoUpSLP::ScheduleBundle*>) const SLPVectorizer.cpp:0:0
#12 0x00005ef84543afcd llvm::slpvectorizer::BoUpSLP::BlockScheduling::tryScheduleBundle(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP*, (anonymous namespace)::InstructionsState const&, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&)::'lambda'(bool, llvm::slpvectorizer::BoUpSLP::ScheduleBundle&)::operator()(bool, llvm::slpvectorizer::BoUpSLP::ScheduleBundle&) const SLPVectorizer.cpp:0:0
#13 0x00005ef84543c5e8 llvm::slpvectorizer::BoUpSLP::BlockScheduling::tryScheduleBundle(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP*, (anonymous namespace)::InstructionsState const&, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&) SLPVectorizer.cpp:0:0
#14 0x00005ef84543e977 llvm::slpvectorizer::BoUpSLP::buildTreeRec(llvm::ArrayRef<llvm::Value*>, unsigned int, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&, unsigned int) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5edb977)
#15 0x00005ef84544135c llvm::slpvectorizer::BoUpSLP::buildTreeRec(llvm::ArrayRef<llvm::Value*>, unsigned int, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&, unsigned int) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5ede35c)
#16 0x00005ef84544039e llvm::slpvectorizer::BoUpSLP::buildTreeRec(llvm::ArrayRef<llvm::Value*>, unsigned int, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&, unsigned int) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5edd39e)
#17 0x00005ef84546bad4 llvm::SLPVectorizerPass::tryToVectorizeList(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP&, bool) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5f08ad4)
#18 0x00005ef845470e9a bool tryToVectorizeSequence<llvm::Value>(llvm::SmallVectorImpl<llvm::Value*>&, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::ArrayRef<llvm::Value*>, bool)>, bool, llvm::slpvectorizer::BoUpSLP&) (.constprop.0) SLPVectorizer.cpp:0:0
#19 0x00005ef8454725b4 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5f0f5b4)
#20 0x00005ef84547c065 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5f19065)
#21 0x00005ef84547cd36 llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5f19d36)
#22 0x00005ef84494fca5 llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x53ecca5)
#23 0x00005ef8431688dd llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x3c058dd)
#24 0x00005ef8408a51f5 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x13421f5)
#25 0x00005ef843168cc7 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x3c05cc7)
#26 0x00005ef8408a58e5 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x13428e5)
#27 0x00005ef843169e6d llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x3c06e6d)
#28 0x00005ef843af44a7 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#29 0x00005ef843af7ab9 (anonymous namespace)::EmitAssemblyHelper::emitAssembly(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) BackendUtil.cpp:0:0
#30 0x00005ef843af8afc clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x4595afc)
#31 0x00005ef8441f5906 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x4c92906)
#32 0x00005ef845cbda1c clang::ParseAST(clang::Sema&, bool, bool) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x675aa1c)
#33 0x00005ef844522dc7 clang::FrontendAction::Execute() (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x4fbfdc7)
#34 0x00005ef8444a3ebd clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x4f40ebd)
#35 0x00005ef84461629b clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x50b329b)
#36 0x00005ef84042fbf0 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0xeccbf0)
#37 0x00005ef840425377 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#38 0x00005ef840429e1a clang_main(int, char**, llvm::ToolContext const&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0xec6e1a)
#39 0x00005ef8402c435a main (/local/home/suz/software/local/clang-trunk/bin/clang-22+0xd6135a)
#40 0x00007cbc8662a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#41 0x00007cbc8662a28b call_init ./csu/../csu/libc-start.c:128:20
#42 0x00007cbc8662a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#43 0x00005ef8404248f5 _start (/local/home/suz/software/local/clang-trunk/bin/clang-22+0xec18f5)
clangtk: error: unable to execute command: Aborted
clangtk: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.0.0git (https://github.com/llvm/llvm-project.git 0b04168948d00baf9c656ce02a85dc5cf6703581)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/software/local/clang-trunk/bin
Build config: +assertions
clangtk: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clangtk: note: diagnostic msg: /tmp/small-59af5b.c
clangtk: note: diagnostic msg: /tmp/small-59af5b.sh
clangtk: note: diagnostic msg: 

********************
[521] % 
[521] % cat small.c
int a, d, e, g, h, i, j = 0, k = 1, l = 0, m = 0;
int n(int p[]) {
  for (int b = 0; b < 3; b++)
    for (int c = 0; c < 3; c++)
      if (p[c])
        return b;
  return 0;
}
int main() {
  while (1) {
    int f = j, o[] = {l, f, 0};
    h = i = n(o);
    k = j = e - k + 1;
    l = e + 1 + g + 1;
    do {
      if (a + l)
        return 0;
      g = 2 * i - 1;
      for (; m < d; ++m)
        e = a;
    } while (a);
  }
  return 0;
}

[alexey-bataev]

Hi Alexey (@alexey-bataev), thanks for triaging and fixing these SLPVectorizer issues! I just built the latest Clang/LLVM, and it seems that the test still causes the same assertion failure.

[519] % clangtk -v
clang version 22.0.0git (https://github.com/llvm/llvm-project.git 0b04168948d00baf9c656ce02a85dc5cf6703581)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/software/local/clang-trunk/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/14
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/14
Candidate multilib: .;@m64
Selected multilib: .;@m64
Found CUDA installation: /usr/local/cuda, version 
[520] % 
[520] % clangtk -Os small.c
clang-22: /local/suz-local/software/clangbuild/llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:5052: int llvm::slpvectorizer::BoUpSLP::ScheduleCopyableData::incrementUnscheduledDeps(int): Assertion `UnscheduledDeps >= 0 && "invariant"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /local/home/suz/software/local/clang-trunk/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -Os -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name small.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/home/suz -fcoverage-compilation-dir=/home/suz -resource-dir /local/home/suz/software/local/clang-trunk/lib/clang/22 -I /usr/local/include -I /local/suz-local/software/local/include -internal-isystem /local/home/suz/software/local/clang-trunk/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fmessage-length=130 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/small-6e13cc.o -x c small.c
1.	<eof> parser at end of file
2.	Optimizer
3.	Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O2>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "small.c"
4.	Running pass "slp-vectorizer" on function "main"
 #0 0x00005ef843844f32 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x42e1f32)
 #1 0x00005ef843841c2f llvm::sys::RunSignalHandlers() (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x42dec2f)
 #2 0x00005ef843841d7c SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x00007cbc86645330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
 #4 0x00007cbc8669eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x00007cbc8669eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x00007cbc8669eb2c pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x00007cbc8664527e raise ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x00007cbc866288ff abort ./stdlib/abort.c:81:7
 #9 0x00007cbc8662881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x00007cbc8663b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#11 0x00005ef84543ab16 void llvm::slpvectorizer::BoUpSLP::BlockScheduling::schedule<llvm::SetVector<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::SmallVector<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, 0u>, llvm::DenseSet<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::DenseMapInfo<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, void>>, 0u>>(llvm::slpvectorizer::BoUpSLP const&, (anonymous namespace)::InstructionsState const&, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&, llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::SetVector<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::SmallVector<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, 0u>, llvm::DenseSet<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::DenseMapInfo<llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, void>>, 0u>&)::'lambda'(llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::ArrayRef<llvm::slpvectorizer::BoUpSLP::ScheduleBundle*>)::operator()(llvm::slpvectorizer::BoUpSLP::ScheduleEntity*, llvm::ArrayRef<llvm::slpvectorizer::BoUpSLP::ScheduleBundle*>) const SLPVectorizer.cpp:0:0
#12 0x00005ef84543afcd llvm::slpvectorizer::BoUpSLP::BlockScheduling::tryScheduleBundle(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP*, (anonymous namespace)::InstructionsState const&, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&)::'lambda'(bool, llvm::slpvectorizer::BoUpSLP::ScheduleBundle&)::operator()(bool, llvm::slpvectorizer::BoUpSLP::ScheduleBundle&) const SLPVectorizer.cpp:0:0
#13 0x00005ef84543c5e8 llvm::slpvectorizer::BoUpSLP::BlockScheduling::tryScheduleBundle(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP*, (anonymous namespace)::InstructionsState const&, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&) SLPVectorizer.cpp:0:0
#14 0x00005ef84543e977 llvm::slpvectorizer::BoUpSLP::buildTreeRec(llvm::ArrayRef<llvm::Value*>, unsigned int, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&, unsigned int) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5edb977)
#15 0x00005ef84544135c llvm::slpvectorizer::BoUpSLP::buildTreeRec(llvm::ArrayRef<llvm::Value*>, unsigned int, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&, unsigned int) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5ede35c)
#16 0x00005ef84544039e llvm::slpvectorizer::BoUpSLP::buildTreeRec(llvm::ArrayRef<llvm::Value*>, unsigned int, llvm::slpvectorizer::BoUpSLP::EdgeInfo const&, unsigned int) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5edd39e)
#17 0x00005ef84546bad4 llvm::SLPVectorizerPass::tryToVectorizeList(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP&, bool) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5f08ad4)
#18 0x00005ef845470e9a bool tryToVectorizeSequence<llvm::Value>(llvm::SmallVectorImpl<llvm::Value*>&, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::ArrayRef<llvm::Value*>, bool)>, bool, llvm::slpvectorizer::BoUpSLP&) (.constprop.0) SLPVectorizer.cpp:0:0
#19 0x00005ef8454725b4 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5f0f5b4)
#20 0x00005ef84547c065 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5f19065)
#21 0x00005ef84547cd36 llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x5f19d36)
#22 0x00005ef84494fca5 llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x53ecca5)
#23 0x00005ef8431688dd llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x3c058dd)
#24 0x00005ef8408a51f5 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x13421f5)
#25 0x00005ef843168cc7 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x3c05cc7)
#26 0x00005ef8408a58e5 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x13428e5)
#27 0x00005ef843169e6d llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x3c06e6d)
#28 0x00005ef843af44a7 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#29 0x00005ef843af7ab9 (anonymous namespace)::EmitAssemblyHelper::emitAssembly(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) BackendUtil.cpp:0:0
#30 0x00005ef843af8afc clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x4595afc)
#31 0x00005ef8441f5906 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x4c92906)
#32 0x00005ef845cbda1c clang::ParseAST(clang::Sema&, bool, bool) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x675aa1c)
#33 0x00005ef844522dc7 clang::FrontendAction::Execute() (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x4fbfdc7)
#34 0x00005ef8444a3ebd clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x4f40ebd)
#35 0x00005ef84461629b clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0x50b329b)
#36 0x00005ef84042fbf0 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0xeccbf0)
#37 0x00005ef840425377 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#38 0x00005ef840429e1a clang_main(int, char**, llvm::ToolContext const&) (/local/home/suz/software/local/clang-trunk/bin/clang-22+0xec6e1a)
#39 0x00005ef8402c435a main (/local/home/suz/software/local/clang-trunk/bin/clang-22+0xd6135a)
#40 0x00007cbc8662a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#41 0x00007cbc8662a28b call_init ./csu/../csu/libc-start.c:128:20
#42 0x00007cbc8662a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#43 0x00005ef8404248f5 _start (/local/home/suz/software/local/clang-trunk/bin/clang-22+0xec18f5)
clangtk: error: unable to execute command: Aborted
clangtk: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.0.0git (https://github.com/llvm/llvm-project.git 0b04168948d00baf9c656ce02a85dc5cf6703581)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/software/local/clang-trunk/bin
Build config: +assertions
clangtk: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clangtk: note: diagnostic msg: /tmp/small-59af5b.c
clangtk: note: diagnostic msg: /tmp/small-59af5b.sh
clangtk: note: diagnostic msg: 

********************
[521] % 
[521] % cat small.c
int a, d, e, g, h, i, j = 0, k = 1, l = 0, m = 0;
int n(int p[]) {
  for (int b = 0; b < 3; b++)
    for (int c = 0; c < 3; c++)
      if (p[c])
        return b;
  return 0;
}
int main() {
  while (1) {
    int f = j, o[] = {l, f, 0};
    h = i = n(o);
    k = j = e - k + 1;
    l = e + 1 + g + 1;
    do {
      if (a + l)
        return 0;
      g = 2 * i - 1;
      for (; m < d; ++m)
        e = a;
    } while (a);
  }
  return 0;
}

Thanks for checking, fixed