C语言 LLVM:为什么在构建调用时会出现段错误

Question

我正在使用LLVM的C API。我想我一定是用错LLVMBuildCall因为我对它进行的大多数调用都出现了段错误。我在下面发布一个最小的例子。但是我还有其他例子，我正在使用更复杂的LLVMBuildCall调用，并且它没有段错误。

代码有点长，但大部分都是样板的; 也许可以转到注释// Here's the function type we'll use。这是段错误的调用LLVMBuildCall(builder, f, params, PARAM_COUNT, "call")。代码如下：

#include <stdio.h>
#include <llvm-c/Analysis.h>
#include <llvm-c/Core.h>
#include <llvm-c/Target.h>
#include <llvm-c/TargetMachine.h>
int
main() {
    // a lot of setup...
    LLVMInitializeNativeTarget();
    LLVMInitializeNativeAsmPrinter();
    char* triple = LLVMGetDefaultTargetTriple();
    char* error;
    LLVMTargetRef target_ref;
    if (LLVMGetTargetFromTriple(triple, &target_ref, &error)) {
        printf("Error: %sn", error);
        return 1;
    }
    LLVMTargetMachineRef tm_ref = LLVMCreateTargetMachine(
      target_ref,
      triple,
      "",
      "",
      LLVMCodeGenLevelDefault,
      LLVMRelocStatic,
      LLVMCodeModelJITDefault);
    LLVMDisposeMessage(triple);
    LLVMContextRef context = LLVMContextCreate();
    LLVMModuleRef module = LLVMModuleCreateWithNameInContext("module_name", context);
    LLVMBuilderRef builder = LLVMCreateBuilderInContext(context);
    LLVMTypeRef i64t = LLVMInt64TypeInContext(context);
    const int PARAM_COUNT = 1;
    LLVMTypeRef param_types[PARAM_COUNT] = {
      i64t,
    };
    // Here's the function type we'll use
    LLVMTypeRef func_type = LLVMFunctionType(i64t, param_types, PARAM_COUNT, 0);
    // start building it
    LLVMValueRef func = LLVMAddFunction(module, "func1", func_type);
    LLVMBasicBlockRef entry = LLVMAppendBasicBlockInContext(context, func, "entry");
    LLVMPositionBuilderAtEnd(builder, entry);
    LLVMValueRef c = LLVMConstInt(i64t, 0, 0);
    // If I try to call, I get a seg fault
    LLVMValueRef f = LLVMBuildBitCast(builder, c, func_type, "cast");
    LLVMValueRef params[PARAM_COUNT];
    for (int i = 0; i < PARAM_COUNT; i++) {
        params[i] = LLVMGetParam(f, i);
    }
    LLVMValueRef call = LLVMBuildCall(builder, f, params, PARAM_COUNT, "call");
    LLVMBuildRet(builder, call);
    // but if I comment the above and uncomment this, it works fine
    // LLVMBuildRet(builder, c);
    LLVMVerifyModule(module, LLVMAbortProcessAction, &error);
    LLVMDisposeMessage(error);
}

以及我如何运行它：

$ llvm-config --version
8.0.0
$ clang++ trash.cpp `llvm-config --cflags --ldflags` `llvm-config --libs` `llvm-config --system-libs`
$ ./a.out 
Segmentation fault: 11

FWIW，当我运行 valgrind 的 memcheck 时，我得到了这个(剪掉了额外的东西(：

==58974== Invalid read of size 8
==58974==    at 0x10084DA72: llvm::Use* llvm::copy<llvm::ArrayRef<llvm::Value*>&, llvm::Use*>(llvm::ArrayRef<llvm::Value*>&, llvm::Use*) (in ./a.out)
==58974==    by 0x10084D9E2: llvm::CallInst::init(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::ArrayRef<llvm::OperandBundleDefT<llvm::Value*> >, llvm::Twine const&) (in ./a.out)
==58974==    by 0x100814CCA: llvm::CallInst::Create(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::ArrayRef<llvm::OperandBundleDefT<llvm::Value*> >, llvm::Twine const&, llvm::Instruction*) (in ./a.out)
==58974==    by 0x1008137FD: llvm::IRBuilder<llvm::ConstantFolder, llvm::IRBuilderDefaultInserter>::CreateCall(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::Twine const&, llvm::MDNode*) (in ./a.out)
==58974==    by 0x1008137B9: LLVMBuildCall (in ./a.out)
==58974==    by 0x10000281A: main (trash.cpp:62)
==58974==  Address 0x0 is not stack'd, malloc'd or (recently) free'd

所以我想有些东西正在访问空指针。

再补充一点信息：每 20 次运行中就有一次，这不会出错。所以我插入了代码来查找变量call的LLVMTypeKind，它与返回类型的f是不同的LLVMTypeKind。我认为不应该。

Answer 1

事实证明，与其使用 LLVMBuildBitCast，不如使用 LLVMConstIntToPtr 。从LLVMBuildBitCast中出来的东西看起来像一个函数指针，但以某种方式损坏了。