LLVM: Why do I get segfaults when building calls?

Question

I'm using LLVM's C API. I think I must be using LLVMBuildCall wrong because most of the calls I make to it segfault. I'm posting a minimal example where this happens below. But I have other examples where I'm using much more complicated LLVMBuildCall calls and it doesn't segfault.

The code is a little long but most of it is boilerplate; maybe go down to the comment // Here's the function type we'll use. It's the call LLVMBuildCall(builder, f, params, PARAM_COUNT, "call") that segfaults. Here's the code:

#include <stdio.h>

#include <llvm-c/Analysis.h>
#include <llvm-c/Core.h>
#include <llvm-c/Target.h>
#include <llvm-c/TargetMachine.h>

int
main() {
    // a lot of setup...
    LLVMInitializeNativeTarget();
    LLVMInitializeNativeAsmPrinter();
    char* triple = LLVMGetDefaultTargetTriple();
    char* error;
    LLVMTargetRef target_ref;
    if (LLVMGetTargetFromTriple(triple, &target_ref, &error)) {
        printf("Error: %s\n", error);
        return 1;
    }
    LLVMTargetMachineRef tm_ref = LLVMCreateTargetMachine(
      target_ref,
      triple,
      "",
      "",
      LLVMCodeGenLevelDefault,
      LLVMRelocStatic,
      LLVMCodeModelJITDefault);
    LLVMDisposeMessage(triple);

    LLVMContextRef context = LLVMContextCreate();
    LLVMModuleRef module = LLVMModuleCreateWithNameInContext("module_name", context);
    LLVMBuilderRef builder = LLVMCreateBuilderInContext(context);

    LLVMTypeRef i64t = LLVMInt64TypeInContext(context);

    const int PARAM_COUNT = 1;

    LLVMTypeRef param_types[PARAM_COUNT] = {
      i64t,
    };

    // Here's the function type we'll use
    LLVMTypeRef func_type = LLVMFunctionType(i64t, param_types, PARAM_COUNT, 0);

    // start building it
    LLVMValueRef func = LLVMAddFunction(module, "func1", func_type);
    LLVMBasicBlockRef entry = LLVMAppendBasicBlockInContext(context, func, "entry");
    LLVMPositionBuilderAtEnd(builder, entry);

    LLVMValueRef c = LLVMConstInt(i64t, 0, 0);

    // If I try to call, I get a seg fault
    LLVMValueRef f = LLVMBuildBitCast(builder, c, func_type, "cast");
    LLVMValueRef params[PARAM_COUNT];
    for (int i = 0; i < PARAM_COUNT; i++) {
        params[i] = LLVMGetParam(f, i);
    }
    LLVMValueRef call = LLVMBuildCall(builder, f, params, PARAM_COUNT, "call");
    LLVMBuildRet(builder, call);

    // but if I comment the above and uncomment this, it works fine
    // LLVMBuildRet(builder, c);

    LLVMVerifyModule(module, LLVMAbortProcessAction, &error);
    LLVMDisposeMessage(error);
}

And how I run it:

$ llvm-config --version
8.0.0
$ clang++ trash.cpp `llvm-config --cflags --ldflags` `llvm-config --libs` `llvm-config --system-libs`
$ ./a.out 
Segmentation fault: 11

FWIW, when I run valgrind's memcheck, I get this (with extra stuff snipped out):

==58974== Invalid read of size 8
==58974==    at 0x10084DA72: llvm::Use* llvm::copy<llvm::ArrayRef<llvm::Value*>&, llvm::Use*>(llvm::ArrayRef<llvm::Value*>&, llvm::Use*) (in ./a.out)
==58974==    by 0x10084D9E2: llvm::CallInst::init(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::ArrayRef<llvm::OperandBundleDefT<llvm::Value*> >, llvm::Twine const&) (in ./a.out)
==58974==    by 0x100814CCA: llvm::CallInst::Create(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::ArrayRef<llvm::OperandBundleDefT<llvm::Value*> >, llvm::Twine const&, llvm::Instruction*) (in ./a.out)
==58974==    by 0x1008137FD: llvm::IRBuilder<llvm::ConstantFolder, llvm::IRBuilderDefaultInserter>::CreateCall(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::Twine const&, llvm::MDNode*) (in ./a.out)
==58974==    by 0x1008137B9: LLVMBuildCall (in ./a.out)
==58974==    by 0x10000281A: main (trash.cpp:62)
==58974==  Address 0x0 is not stack'd, malloc'd or (recently) free'd

So I guess something is accessing a null pointer.

One more bit of information: one out of every 20 runs or so, this doesn't segfault. So I inserted code to find the LLVMTypeKind of the variable call, and it's a different LLVMTypeKind from the return type of f. I don't think it should be.

Answer 1

Turns out that rather than using LLVMBuildBitCast, I should instead use LLVMConstIntToPtr. The thing that comes out of LLVMBuildBitCast looks like a function pointer but is corrupted in some way.