[BOLT] llvm-bolt segmentation fault during Python optimization with -frame-opt=hot after allocation combiner pass

[ashm-dev]

Environment

• BOLT version: Ubuntu LLVM version 20.1.2 (Optimized build)
• BOLT revision: <unknown>
• Target: x86_64
• OS: Linux (Ubuntu)
• Binary: CPython (main branch)

Issue Description

llvm-bolt crashes with a segmentation fault during the final optimization phase when building an optimized Python binary. The crash occurs immediately after the allocation combiner pass completes successfully.

Steps to Reproduce

1. Build CPython with PGO and BOLT optimization enabled (--enable-optimizations --enable-bolt)
2. Collect profile data by running Python test suite (9,675 tests executed)
3. Merge profile data files using merge-fdata
4. Run llvm-bolt with the following command:

llvm-bolt python.prebolt -o python.bolt \
  -data=python.fdata \
  -update-debug-sections \
  -skip-funcs=_PyEval_EvalFrameDefault,sre_ucs1_match/1,sre_ucs2_match/1,sre_ucs4_match/1 \
  -reorder-blocks=ext-tsp \
  -reorder-functions=cdsort \
  -split-functions \
  -icf=1 \
  -inline-all \
  -split-eh \
  -reorder-functions-use-hot-size \
  -peepholes=none \
  -jump-tables=aggressive \
  -inline-ap \
  -indirect-call-promotion=all \
  -dyno-stats \
  -use-gnu-stack \
  -frame-opt=hot

Expected Behavior

BOLT should complete optimization and produce python.bolt binary successfully.

Actual Behavior

Process crashes with segmentation fault (exit code 139). The crash occurs immediately after the allocation combiner reports completion.

Optimization Results Before Crash

BOLT successfully completed all optimization passes with impressive results:

• Profile coverage: 5927 out of 9939 functions (59.6%) optimized
• ICF: Folded 322 functions, saved 29.44 KB
• Inlining: 2,095,463 calls inlined at 67 call sites
• Code splitting: 2,039,151 hot bytes separated from 1,831,964 cold bytes
• Shrink wrapping: Reduced 1,819,858,098 store executions (5.7% of stores)
• Performance improvements:
  • Taken forward branches: -82.2%
  • Indirect calls: -22.1%
  • Taken branches: -44.1%
  • Total instructions: -0.4%

Last Lines Before Crash

BOLT-INFO: Shrink wrapping moved 131 spills inserting load/stores and 0 spills inserting push/pops
BOLT-INFO: Shrink wrapping reduced 1819858098 store executions (0.5% total instructions executed, 5.7% store instructions)
BOLT-INFO: Shrink wrapping failed at reducing 0 store executions (0.0% total instructions executed, 0.0% store instructions)
BOLT-INFO: Allocation combiner: 164 empty spaces coalesced (dyn count: 3010144563).

Stack Trace

 #0 0x0000574bc875a95f (/bin/llvm-bolt+0x1fca95f)
 #1 0x0000574bc875886b (/bin/llvm-bolt+0x1fc886b)
 #2 0x0000574bc875b020 (/bin/llvm-bolt+0x1fcb020)
 #3 0x00007dae4c8458d0 (/lib/x86_64-linux-gnu/libc.so.6+0x458d0)
 #4 0x0000574bc8e37bc0 (/bin/llvm-bolt+0x26a7bc0)
 #5 0x0000574bc8e46772 (/bin/llvm-bolt+0x26b6772)
 #6 0x0000574bc8e4757b (/bin/llvm-bolt+0x26b757b)
 #7 0x0000574bc8e46e0f (/bin/llvm-bolt+0x26b6e0f)
 #8 0x0000574bc8e4567a (/bin/llvm-bolt+0x26b567a)
 #9 0x0000574bc87d0558 (/bin/llvm-bolt+0x2040558)
#10 0x0000574bc87c7619 (/bin/llvm-bolt+0x2037619)
#11 0x0000574bc6fc2d0e (/bin/llvm-bolt+0x832d0e)
#12 0x00007dae4c82a578 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#13 0x00007dae4c82a63b call_init ./csu/../csu/libc-start.c:128:20
#14 0x00007dae4c82a63b __libc_start_main ./csu/../csu/libc-start.c:347:5
#15 0x0000574bc6fc1075 (/bin/llvm-bolt+0x831075)

Stack dump:
0. Program arguments: /bin/llvm-bolt python.prebolt -o python.bolt -data=python.fdata -update-debug-sections -skip-funcs=_PyEval_EvalFrameDefault,sre_ucs1_match/1,sre_ucs2_match/1,sre_ucs4_match/1 -reorder-blocks=ext-tsp -reorder-functions=cdsort -split-functions -icf=1 -inline-all -split-eh -reorder-functions-use-hot-size -peepholes=none -jump-tables=aggressive -inline-ap -indirect-call-promotion=all -dyno-stats -use-gnu-stack -frame-opt=hot

Segmentation fault (core dumped)
make[1]: *** [Makefile:1065: profile-bolt-stamp] Error 139

Additional Context

• Profile data successfully merged from 113 files
• All optimization passes completed successfully before the crash
• The crash appears to occur during or immediately after frame optimization pass
• Error messages show Russian locale: Ошибка 139 (Error 139)

Possible Workaround

The issue may be related to -frame-opt=hot flag. Testing without this flag or with alternative frame optimization settings may help.

Related Issues

• [BOLT] llvm-bolt crashes during Python 3.13.1 build with addDebugFilenameToUnit segmentation fault #121213 - Similar crash with Python 3.13.1 build
• BOLT crashes with --update-debug-sections on DWARF v5 when optimizing libpython.so #67966 - BOLT crashes with --update-debug-sections on DWARF v5
• bolt segfault on python aarch64 build #106935 - Segfault on Python aarch64 build

This appears to be a recurring issue when optimizing CPython binaries with BOLT and frame optimization enabled.

[llvmbot]

@llvm/issue-subscribers-bolt

Author: Shamil (ashm-dev)

### Environment - **BOLT version**: Ubuntu LLVM version 20.1.2 (Optimized build) - **BOLT revision**: `<unknown>` - **Target**: x86_64 - **OS**: Linux (Ubuntu) - **Binary**: CPython (main branch)

Issue Description

llvm-bolt crashes with a segmentation fault during the final optimization phase when building an optimized Python binary. The crash occurs immediately after the allocation combiner pass completes successfully.

Steps to Reproduce

1. Build CPython with PGO and BOLT optimization enabled (--enable-optimizations --enable-bolt)
2. Collect profile data by running Python test suite (9,675 tests executed)
3. Merge profile data files using merge-fdata
4. Run llvm-bolt with the following command:

llvm-bolt python.prebolt -o python.bolt \
  -data=python.fdata \
  -update-debug-sections \
  -skip-funcs=_PyEval_EvalFrameDefault,sre_ucs1_match/1,sre_ucs2_match/1,sre_ucs4_match/1 \
  -reorder-blocks=ext-tsp \
  -reorder-functions=cdsort \
  -split-functions \
  -icf=1 \
  -inline-all \
  -split-eh \
  -reorder-functions-use-hot-size \
  -peepholes=none \
  -jump-tables=aggressive \
  -inline-ap \
  -indirect-call-promotion=all \
  -dyno-stats \
  -use-gnu-stack \
  -frame-opt=hot

Expected Behavior

BOLT should complete optimization and produce python.bolt binary successfully.

Actual Behavior

Process crashes with segmentation fault (exit code 139). The crash occurs immediately after the allocation combiner reports completion.

Optimization Results Before Crash

BOLT successfully completed all optimization passes with impressive results:

• Profile coverage: 5927 out of 9939 functions (59.6%) optimized
• ICF: Folded 322 functions, saved 29.44 KB
• Inlining: 2,095,463 calls inlined at 67 call sites
• Code splitting: 2,039,151 hot bytes separated from 1,831,964 cold bytes
• Shrink wrapping: Reduced 1,819,858,098 store executions (5.7% of stores)
• Performance improvements:
  • Taken forward branches: -82.2%
  • Indirect calls: -22.1%
  • Taken branches: -44.1%
  • Total instructions: -0.4%

Last Lines Before Crash

BOLT-INFO: Shrink wrapping moved 131 spills inserting load/stores and 0 spills inserting push/pops
BOLT-INFO: Shrink wrapping reduced 1819858098 store executions (0.5% total instructions executed, 5.7% store instructions)
BOLT-INFO: Shrink wrapping failed at reducing 0 store executions (0.0% total instructions executed, 0.0% store instructions)
BOLT-INFO: Allocation combiner: 164 empty spaces coalesced (dyn count: 3010144563).

Stack Trace

 #<!-- -->0 0x0000574bc875a95f (/bin/llvm-bolt+0x1fca95f)
 #<!-- -->1 0x0000574bc875886b (/bin/llvm-bolt+0x1fc886b)
 #<!-- -->2 0x0000574bc875b020 (/bin/llvm-bolt+0x1fcb020)
 #<!-- -->3 0x00007dae4c8458d0 (/lib/x86_64-linux-gnu/libc.so.6+0x458d0)
 #<!-- -->4 0x0000574bc8e37bc0 (/bin/llvm-bolt+0x26a7bc0)
 #<!-- -->5 0x0000574bc8e46772 (/bin/llvm-bolt+0x26b6772)
 #<!-- -->6 0x0000574bc8e4757b (/bin/llvm-bolt+0x26b757b)
 #<!-- -->7 0x0000574bc8e46e0f (/bin/llvm-bolt+0x26b6e0f)
 #<!-- -->8 0x0000574bc8e4567a (/bin/llvm-bolt+0x26b567a)
 #<!-- -->9 0x0000574bc87d0558 (/bin/llvm-bolt+0x2040558)
#<!-- -->10 0x0000574bc87c7619 (/bin/llvm-bolt+0x2037619)
#<!-- -->11 0x0000574bc6fc2d0e (/bin/llvm-bolt+0x832d0e)
#<!-- -->12 0x00007dae4c82a578 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#<!-- -->13 0x00007dae4c82a63b call_init ./csu/../csu/libc-start.c:128:20
#<!-- -->14 0x00007dae4c82a63b __libc_start_main ./csu/../csu/libc-start.c:347:5
#<!-- -->15 0x0000574bc6fc1075 (/bin/llvm-bolt+0x831075)

Stack dump:
0. Program arguments: /bin/llvm-bolt python.prebolt -o python.bolt -data=python.fdata -update-debug-sections -skip-funcs=_PyEval_EvalFrameDefault,sre_ucs1_match/1,sre_ucs2_match/1,sre_ucs4_match/1 -reorder-blocks=ext-tsp -reorder-functions=cdsort -split-functions -icf=1 -inline-all -split-eh -reorder-functions-use-hot-size -peepholes=none -jump-tables=aggressive -inline-ap -indirect-call-promotion=all -dyno-stats -use-gnu-stack -frame-opt=hot

Segmentation fault (core dumped)
make[1]: *** [Makefile:1065: profile-bolt-stamp] Error 139

Additional Context

• Profile data successfully merged from 113 files
• All optimization passes completed successfully before the crash
• The crash appears to occur during or immediately after frame optimization pass
• Error messages show Russian locale: Ошибка 139 (Error 139)

Possible Workaround

The issue may be related to -frame-opt=hot flag. Testing without this flag or with alternative frame optimization settings may help.

Related Issues

• #121213 - Similar crash with Python 3.13.1 build
• #67966 - BOLT crashes with --update-debug-sections on DWARF v5
• #106935 - Segfault on Python aarch64 build

This appears to be a recurring issue when optimizing CPython binaries with BOLT and frame optimization enabled.