Skip to content

[llvm-cov][MC/DC] "Out-of-bounds Bit access." when run with binary profile correlation #97385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
whentojump opened this issue Jul 2, 2024 · 0 comments · May be fixed by #136437
Open

[llvm-cov][MC/DC] "Out-of-bounds Bit access." when run with binary profile correlation #97385

whentojump opened this issue Jul 2, 2024 · 0 comments · May be fixed by #136437
Labels
crash Prefer [crash-on-valid] or [crash-on-invalid] tools:llvm-cov

Comments

@whentojump
Copy link
Member 

$ clang --version

clang version 19.0.0git (/media/wd-sn580-2t-1/llvm/trunk/src/clang 91c0ef6f67821eb7298cb05988045e92354ac77b)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /media/wd-sn580-2t-1/llvm/trunk/src/build/bin
Build config: +assertions

How to reproduce:

cat << EOF > test.c
int main(void) {
    int a = 0;
    int b = 0;
    return a && b;
}
EOF

clang -fprofile-instr-generate -fcoverage-mapping -fcoverage-mcdc \
        -mllvm -profile-correlate=binary \
        test.c -o test.exe
./test.exe
llvm-profdata merge default.profraw --binary-file test.exe -o default.profdata
llvm-cov show --show-mcdc -instr-profile default.profdata test.exe

Log

llvm-cov: /media/wd-sn580-2t-1/llvm/trunk/src/llvm/include/llvm/ADT/BitVector.h:450: bool llvm::BitVector::operator[](unsigned int) const: Assertion `Idx < Size && "Out-of-bounds Bit access."' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: llvm-cov "llvm-cov show" --show-mcdc -instr-profile default.profdata test.exe
 #0 0x00005a3126ed5daf llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/lib/Support/Unix/Signals.inc:727:3
 #1 0x00005a3126ed3a9f llvm::sys::RunSignalHandlers() /media/wd-sn580-2t-1/llvm/trunk/src/llvm/lib/Support/Signals.cpp:105:20
 #2 0x00005a3126ed3df6 SignalHandler(int) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/lib/Support/Unix/Signals.inc:413:1
 #3 0x000076aa61a42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x000076aa61a969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x000076aa61a42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x000076aa61a287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x000076aa61a2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #8 0x000076aa61a39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #9 0x00005a3126f6d80b llvm::SmallVectorTemplateCommon<std::array<int, 2ul>, void>::operator[](unsigned long) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/include/llvm/ADT/BitVector.h:450:5
#10 0x00005a3126f6d80b (anonymous namespace)::MCDCRecordProcessor::buildTestVector(llvm::coverage::MCDCRecord::TestVector&, short, int) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/lib/ProfileData/Coverage/CoverageMapping.cpp:412:42
#11 0x00005a3126f6fced findExecutedTestVectors /media/wd-sn580-2t-1/llvm/trunk/src/llvm/lib/ProfileData/Coverage/CoverageMapping.cpp:446:5
#12 0x00005a3126f6fced processMCDCRecord /media/wd-sn580-2t-1/llvm/trunk/src/llvm/lib/ProfileData/Coverage/CoverageMapping.cpp:513:28
#13 0x00005a3126f6fced llvm::coverage::CounterMappingContext::evaluateMCDCRegion(llvm::coverage::CounterMappingRegion const&, llvm::ArrayRef<llvm::coverage::CounterMappingRegion const*>, bool) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/lib/ProfileData/Coverage/CoverageMapping.cpp:533:41
#14 0x00005a3126f727da llvm::Expected<llvm::coverage::MCDCRecord>::takeError() /media/wd-sn580-2t-1/llvm/trunk/src/llvm/include/llvm/Support/Error.h:610:15
#15 0x00005a3126f727da llvm::coverage::CoverageMapping::loadFunctionRecord(llvm::coverage::CoverageMappingRecord const&, llvm::IndexedInstrProfReader&) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/lib/ProfileData/Coverage/CoverageMapping.cpp:901:35
#16 0x00005a3126f73a20 llvm::Error::setChecked(bool) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/include/llvm/Support/Error.h:310:22
#17 0x00005a3126f73a20 llvm::Error::operator bool() /media/wd-sn580-2t-1/llvm/trunk/src/llvm/include/llvm/Support/Error.h:242:15
#18 0x00005a3126f73a20 llvm::coverage::CoverageMapping::loadFromReaders(llvm::ArrayRef<std::unique_ptr<llvm::coverage::CoverageMappingReader, std::default_delete<llvm::coverage::CoverageMappingReader>>>, llvm::IndexedInstrProfReader&, llvm::coverage::CoverageMapping&) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/lib/ProfileData/Coverage/CoverageMapping.cpp:944:71
#19 0x00005a3126f74079 llvm::Error::setChecked(bool) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/include/llvm/Support/Error.h:310:22
#20 0x00005a3126f74079 llvm::Error::operator bool() /media/wd-sn580-2t-1/llvm/trunk/src/llvm/include/llvm/Support/Error.h:242:15
#21 0x00005a3126f74079 llvm::coverage::CoverageMapping::loadFromFile(llvm::StringRef, llvm::StringRef, llvm::StringRef, llvm::IndexedInstrProfReader&, llvm::coverage::CoverageMapping&, bool&, llvm::SmallVectorImpl<llvm::SmallVector<unsigned char, 10u>>*) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/lib/ProfileData/Coverage/CoverageMapping.cpp:1003:66
#22 0x00005a3126f74b1d llvm::Error::setChecked(bool) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/include/llvm/Support/Error.h:310:22
#23 0x00005a3126f74b1d llvm::Error::operator bool() /media/wd-sn580-2t-1/llvm/trunk/src/llvm/include/llvm/Support/Error.h:242:15
#24 0x00005a3126f74b1d llvm::coverage::CoverageMapping::load(llvm::ArrayRef<llvm::StringRef>, llvm::StringRef, llvm::vfs::FileSystem&, llvm::ArrayRef<llvm::StringRef>, llvm::StringRef, llvm::object::BuildIDFetcher const*, bool) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/lib/ProfileData/Coverage/CoverageMapping.cpp:1031:80
#25 0x00005a3126cc1182 llvm::Expected<std::unique_ptr<llvm::coverage::CoverageMapping, std::default_delete<llvm::coverage::CoverageMapping>>>::takeError() /media/wd-sn580-2t-1/llvm/trunk/src/llvm/include/llvm/Support/Error.h:610:15
#26 0x00005a3126cc1182 (anonymous namespace)::CodeCoverageTool::load() /media/wd-sn580-2t-1/llvm/trunk/src/llvm/tools/llvm-cov/CodeCoverage.cpp:486:41
#27 0x00005a3126cc4f02 (anonymous namespace)::CodeCoverageTool::doShow(int, char const**, llvm::function_ref<int (int, char const**)>) (.constprop.0) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/tools/llvm-cov/CodeCoverage.cpp:1143:3
#28 0x00005a3126ccae48 (anonymous namespace)::CodeCoverageTool::run((anonymous namespace)::CodeCoverageTool::Command, int, char const**) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/tools/llvm-cov/CodeCoverage.cpp:980:18
#29 0x00005a3126ccb73f showMain(int, char const**) /media/wd-sn580-2t-1/llvm/trunk/src/llvm/tools/llvm-cov/CodeCoverage.cpp:1348:1
#30 0x00005a3126cad063 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::~basic_string() /usr/include/c++/11/bits/basic_string.h:672:19
#31 0x00005a3126cad063 main /media/wd-sn580-2t-1/llvm/trunk/src/llvm/tools/llvm-cov/llvm-cov.cpp:82:5
#32 0x000076aa61a29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#33 0x000076aa61a29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#34 0x00005a3126cac5e5 _start (/media/wd-sn580-2t-1/llvm/trunk/src/build/bin/llvm-cov+0x2895e5)
[1]    462045 IOT instruction (core dumped)  llvm-cov show --show-mcdc -instr-profile default.profdata test.exe

Removing either MC/DC options or binary profile correlation can run successfully.
@EugeneZelenko EugeneZelenko added the crash Prefer [crash-on-valid] or [crash-on-invalid] label Jul 2, 2024
belyaevrd added a commit to belyaevrd/llvm-project that referenced this issue Apr 19, 2025
@belyaevrd
[MC/DC][Coverage] Enable profile correlation for MC/DC
ab27578 
When using the `-fcoverage-mcdc` option in profile correlation mode MC/DC
coverage is not actually collected.

In binary profile correlation mode this completes elements of a vector of
per-function profile data structures called `Data` with BitmapPtr and
NumBitmapBytes values that are taken from profile data section in the same way
as it is done for Counters.

In debug info correlation mode this adds new `Profile Bitmap Type` DIEs to
DWARFContext. These entries contain FunctionName and NumBitmapBits for
functions. They are used by `correlateProfileDataImpl()` function to obtain
BitmapPtr and NumBitmapBytes values to complete the corresponding elements of
the vector of per-function profile data structures called `Data`. Creating and
reading these new DIEs occur in the same way as it is done for DIEs of the type
`Profile Data Type`.

Fixes llvm#97385
@belyaevrd belyaevrd linked a pull request Apr 19, 2025 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
crash Prefer [crash-on-valid] or [crash-on-invalid] tools:llvm-cov
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[MC/DC][Coverage] Enable profile correlation for MC/DC belyaevrd/llvm-project
2 participants
@EugeneZelenko @whentojump