Skip to content

[ICE]: aarch64-unknown-linux-gnu segfault in llvm #164584

Open
Open
[ICE]: aarch64-unknown-linux-gnu segfault in llvm#164584
Assignees
nikic
Labels
A-LLVMArea: Code generation parts specific to LLVM. Both correctness bugs and optimization-related issues.C-bugCategory: This is a bug.I-crashIssue: The compiler crashes (SIGSEGV, SIGABRT, etc). Use I-ICE instead when the compiler panics.I-llvm-errorImpact: An error from LLVM is directly exposed by valid codeI-prioritizeIssue needs a team member to assess the impact. Will be replaced by P-{low,medium,high,critical}T-compilerRelevant to the compiler team, which will review and decide on the PR/issue.llvm-fixed-upstreamIssue expected to be fixed by the next major LLVM upgrade, or backported fixesregression-from-stable-to-stablePerformance or correctness regression from one stable version to another.

Description

@Firestar99
Firestar99
opened on Oct 19, 2026

Code

  1. On an aarch64-unknown-linux-gnu system with similar features, run:
cargo new bla
cd bla
cargo add candle-core
RUSTFLAGS=-Ctarget-cpu=native cargo b --release
  1. observe rustc segfault

Both -Ctarget-cpu=native and --release are required, the device is an Nvidia DGX Spark. I was not able to bisect which target feature causes it, candle-core uses quite a few #[cfg(target_feature = ...)], including all as
RUSTFLAGS=-Ctarget-feature=+fp16,+neon,+bf16,+dotprod cargo b --release works just fine.

`$ rustc --print target-features` 

Features supported by rustc for this target:
    aes                                    - Enable AES support.
    bf16                                   - Enable BFloat16 Extension.
    bti                                    - Enable Branch Target Identification.
    crc                                    - Enable Armv8.0-A CRC-32 checksum instructions.
    crt-static                             - Enables C Run-time Libraries to be statically linked.
    cssc                                   - Enable Common Short Sequence Compression (CSSC) instructions.
    dit                                    - Enable Armv8.4-A Data Independent Timing instructions.
    dotprod                                - Enable dot product support.
    dpb                                    - Enable Armv8.2-A data Cache Clean to Point of Persistence.
    dpb2                                   - Enable Armv8.5-A Cache Clean to Point of Deep Persistence.
    ecv                                    - Enable enhanced counter virtualization extension.
    f32mm                                  - Enable Matrix Multiply FP32 Extension.
    f64mm                                  - Enable Matrix Multiply FP64 Extension.
    faminmax                               - Enable FAMIN and FAMAX instructions.
    fcma                                   - Enable Armv8.3-A Floating-point complex number support.
    fhm                                    - Enable FP16 FML instructions.
    flagm                                  - Enable Armv8.4-A Flag Manipulation instructions.
    flagm2                                 - Enable alternative NZCV format for floating point comparisons.
    fp16                                   - Enable half-precision floating-point data processing.
    fp8                                    - Enable FP8 instructions.
    fp8dot2                                - Enable FP8 2-way dot instructions.
    fp8dot4                                - Enable FP8 4-way dot instructions.
    fp8fma                                 - Enable Armv9.5-A FP8 multiply-add instructions.
    frintts                                - Enable FRInt[32|64][Z|X] instructions that round a floating-point number to an integer (in FP format) forcing it to fit into a 32- or 64-bit int.
    hbc                                    - Enable Armv8.8-A Hinted Conditional Branches Extension.
    i8mm                                   - Enable Matrix Multiply Int8 Extension.
    jsconv                                 - Enable Armv8.3-A JavaScript FP conversion instructions.
    lor                                    - Enable Armv8.1-A Limited Ordering Regions extension.
    lse                                    - Enable Armv8.1-A Large System Extension (LSE) atomic instructions.
    lse128                                 - Enable Armv9.4-A 128-bit Atomic instructions.
    lse2                                   - Enable Armv8.4-A Large System Extension 2 (LSE2) atomicity rules.
    lut                                    - Enable Lookup Table instructions.
    mops                                   - Enable Armv8.8-A memcpy and memset acceleration instructions.
    mte                                    - Enable Memory Tagging Extension.
    neon                                   - Enable Advanced SIMD instructions.
    outline-atomics                        - Enable out of line atomics to support LSE instructions.
    paca                                   - Enable Armv8.3-A Pointer Authentication extension.
    pacg                                   - Enable Armv8.3-A Pointer Authentication extension.
    pan                                    - Enable Armv8.1-A Privileged Access-Never extension.
    pauth-lr                               - Enable Armv9.5-A PAC enhancements.
    pmuv3                                  - Enable Armv8.0-A PMUv3 Performance Monitors extension.
    rand                                   - Enable Random Number generation instructions.
    ras                                    - Enable Armv8.0-A Reliability, Availability and Serviceability Extensions.
    rcpc                                   - Enable support for RCPC extension.
    rcpc2                                  - Enable Armv8.4-A RCPC instructions with Immediate Offsets.
    rcpc3                                  - Enable Armv8.9-A RCPC instructions for A64 and Advanced SIMD and floating-point instruction set.
    rdm                                    - Enable Armv8.1-A Rounding Double Multiply Add/Subtract instructions.
    sb                                     - Enable Armv8.5-A Speculation Barrier.
    sha2                                   - Enable SHA1 and SHA256 support.
    sha3                                   - Enable SHA512 and SHA3 support.
    sm4                                    - Enable SM3 and SM4 support.
    sme                                    - Enable Scalable Matrix Extension (SME).
    sme-b16b16                             - Enable SME2.1 ZA-targeting non-widening BFloat16 instructions.
    sme-f16f16                             - Enable SME non-widening Float16 instructions.
    sme-f64f64                             - Enable Scalable Matrix Extension (SME) F64F64 instructions.
    sme-f8f16                              - Enable Scalable Matrix Extension (SME) F8F16 instructions.
    sme-f8f32                              - Enable Scalable Matrix Extension (SME) F8F32 instructions.
    sme-fa64                               - Enable the full A64 instruction set in streaming SVE mode.
    sme-i16i64                             - Enable Scalable Matrix Extension (SME) I16I64 instructions.
    sme-lutv2                              - Enable Scalable Matrix Extension (SME) LUTv2 instructions.
    sme2                                   - Enable Scalable Matrix Extension 2 (SME2) instructions.
    sme2p1                                 - Enable Scalable Matrix Extension 2.1 instructions.
    spe                                    - Enable Statistical Profiling extension.
    ssbs                                   - Enable Speculative Store Bypass Safe bit.
    ssve-fp8dot2                           - Enable SVE2 FP8 2-way dot product instructions.
    ssve-fp8dot4                           - Enable SVE2 FP8 4-way dot product instructions.
    ssve-fp8fma                            - Enable SVE2 FP8 multiply-add instructions.
    sve                                    - Enable Scalable Vector Extension (SVE) instructions.
    sve-b16b16                             - Enable SVE2 non-widening and SME2 Z-targeting non-widening BFloat16 instructions.
    sve2                                   - Enable Scalable Vector Extension 2 (SVE2) instructions.
    sve2-aes                               - Shorthand for +sve2+sve-aes.
    sve2-bitperm                           - Shorthand for +sve2+sve-bitperm.
    sve2-sha3                              - Shorthand for +sve2+sve-sha3.
    sve2-sm4                               - Shorthand for +sve2+sve-sm4.
    sve2p1                                 - Enable Scalable Vector Extension 2.1 instructions.
    v8.1a                                  - Support ARM v8.1a architecture.
    v8.2a                                  - Support ARM v8.2a architecture.
    v8.3a                                  - Support ARM v8.3a architecture.
    v8.4a                                  - Support ARM v8.4a architecture.
    v8.5a                                  - Support ARM v8.5a architecture.
    v8.6a                                  - Support ARM v8.6a architecture.
    v8.7a                                  - Support ARM v8.7a architecture.
    v8.8a                                  - Support ARM v8.8a architecture.
    v8.9a                                  - Support ARM v8.9a architecture.
    v9.1a                                  - Support ARM v9.1a architecture.
    v9.2a                                  - Support ARM v9.2a architecture.
    v9.3a                                  - Support ARM v9.3a architecture.
    v9.4a                                  - Support ARM v9.4a architecture.
    v9.5a                                  - Support ARM v9.5a architecture.
    v9a                                    - Support ARM v9a architecture.
    vh                                     - Enable Armv8.1-A Virtual Host extension.
    wfxt                                   - Enable Armv8.7-A WFET and WFIT instruction.

Meta

Both stable and nightly behave the same.

rustc +stable --version --verbose:

rustc 1.99.1 (58cf8f9c3 2026-10-13)
binary: rustc
commit-hash: 58cf8f9c35b355199727627d07ae34a4e2846d67
commit-date: 2026-10-13
host: aarch64-unknown-linux-gnu
release: 1.99.1
LLVM version: 23.1.1

rustc +nightly --version --verbose:

rustc 1.101.0-nightly (b6eeb93c9 2026-10-18)
binary: rustc
commit-hash: b6eeb93c992027a03e1fd120b6652546396b142c
commit-date: 2026-10-18
host: aarch64-unknown-linux-gnu
release: 1.101.0-nightly
LLVM version: 23.1.4

Error output

segfaults don't produce nice ICEs.

coredumpctl debug <pid> gave me:

Backtrace 

Stack trace of thread 116616:
#0  0x0000fdc82c24cb80 _ZN4llvm17VPDerivedIVRecipe7executeERNS_16VPTransformStateE (libLLVM.so.23.1-rust-1.99.1-stable + 0x66ecb80)
#1  0x0000fdc82b0ba368 _ZN4llvm12VPBasicBlock7executeEPNS_16VPTransformStateE (libLLVM.so.23.1-rust-1.99.1-stable + 0x555a368)
#2  0x0000fdc82b0b9094 _ZN4llvm5VPlan7executeEPNS_16VPTransformStateE (libLLVM.so.23.1-rust-1.99.1-stable + 0x5559094)
#3  0x0000fdc82b0e32dc _ZN4llvm24LoopVectorizationPlanner11executePlanENS_12ElementCountEjRNS_5VPlanERNS_19InnerLoopVectorizerEPNS_13DominatorTreeENS0_25EpilogueVectorizationKindE (libLLVM.so.23.1-rust-1.99.1-stable + 0x55832dc)
#4  0x0000fdc82b1956dc _ZN4llvm17LoopVectorizePass11processLoopEPNS_4LoopE (libLLVM.so.23.1-rust-1.99.1-stable + 0x56356dc)
#5  0x0000fdc82b19130c _ZN4llvm17LoopVectorizePass7runImplERNS_8FunctionE (libLLVM.so.23.1-rust-1.99.1-stable + 0x563130c)
#6  0x0000fdc82b190ee0 _ZN4llvm17LoopVectorizePass3runERNS_8FunctionERNS_15AnalysisManagerIS1_JEEE (libLLVM.so.23.1-rust-1.99.1-stable + 0x5630ee0)
#7  0x0000fdc82a11afc0 _ZN4llvm11PassManagerINS_8FunctionENS_15AnalysisManagerIS1_JEEEJEE3runERS1_RS3_ (libLLVM.so.23.1-rust-1.99.1-stable + 0x45bafc0)
#8  0x0000fdc82a74d25c _ZN4llvm27ModuleToFunctionPassAdaptor3runERNS_6ModuleERNS_15AnalysisManagerIS1_JEEE (libLLVM.so.23.1-rust-1.99.1-stable + 0x4bed25c)
#9  0x0000fdc82a73e1e4 _ZN4llvm11PassManagerINS_6ModuleENS_15AnalysisManagerIS1_JEEEJEE3runERS1_RS3_ (libLLVM.so.23.1-rust-1.99.1-stable + 0x4bde1e4)
#10 0x0000fdc830ad5438 LLVMRustOptimize (librustc_driver-d2ac115384bfcfd9.so + 0x2735438)
#11 0x0000fdc830aca4ec _RNvNtNtCs8jOmYEpbHlH_18rustc_codegen_llvm4back5write13llvm_optimize (librustc_driver-d2ac115384bfcfd9.so + 0x272a4ec)
#12 0x0000fdc830ac9f88 _RNvNtNtCs8jOmYEpbHlH_18rustc_codegen_llvm4back3lto16run_pass_manager (librustc_driver-d2ac115384bfcfd9.so + 0x2729f88)
#13 0x0000fdc830e6a5b0 _RNvXs1_Cs8jOmYEpbHlH_18rustc_codegen_llvmNtB5_18LlvmCodegenBackendNtNtNtCsh3xcGZtatTE_17rustc_codegen_ssa6traits5write19WriteBackendMethods25optimize_and_codegen_thin (librustc_driver-d2ac115384bfcfd9.so + 0x2aca5b0)
#14 0x0000fdc830e68880 _RINvNtNtCs9g4b2IXPNZ3_3std3sys9backtrace28___rust_begin_short_backtraceNCINvNtNtCsh3xcGZtatTE_17rustc_codegen_ssa4back5write19spawn_thin_lto_workNtCs8jOmYEpbHlH_18rustc_codegen_llvm18LlvmCodegenBackendE0uEB2l_ (librustc_driver-d2ac115384bfcfd9.so + 0x2ac8880)
#15 0x0000fdc830e67240 _RNSNvYNCINvNtNtCs9g4b2IXPNZ3_3std6thread9lifecycle15spawn_uncheckedNCINvNtNtCsh3xcGZtatTE_17rustc_codegen_ssa4back5write19spawn_thin_lto_workNtCs8jOmYEpbHlH_18rustc_codegen_llvm18LlvmCodegenBackendE0uEs_0INtNtNtCsaWcbhsS8OaW_4core3ops8function6FnOnceuE9call_once6vtableB2h_ (librustc_driver-d2ac115384bfcfd9.so + 0x2ac7240)
#16 0x0000fdc8328896a4 _RNvNvMs0_NtNtNtCs9g4b2IXPNZ3_3std3sys6thread4unixNtB7_6Thread3new12thread_start (librustc_driver-d2ac115384bfcfd9.so + 0x44e96a4)
#17 0x0000fdc82e1f2d80 start_thread (libc.so.6 + 0x92d80)
#18 0x0000fdc82e26225c thread_start (libc.so.6 + 0x10225c)

Stack trace of thread 116548:
#0  0x0000fdc82e1fcc68 __syscall_cancel_arch (libc.so.6 + 0x9cc68)
#1  0x0000fdc82e1eecb4 __internal_syscall_cancel (libc.so.6 + 0x8ecb4)
#2  0x0000fdc82e1ef224 __GI___futex_abstimed_wait_cancelable64 (libc.so.6 + 0x8f224)
#3  0x0000fdc82e1f4974 __pthread_clockjoin_ex (libc.so.6 + 0x94974)
#4  0x0000fdc83109bf64 _RNvCsfZHZgrmtAYr_17rustc_driver_impl12run_compiler (librustc_driver-d2ac115384bfcfd9.so + 0x2cfbf64)
#5  0x0000fdc830b3b080 _RNvCsfZHZgrmtAYr_17rustc_driver_impl4main (librustc_driver-d2ac115384bfcfd9.so + 0x279b080)
#6  0x0000c57f6c2263f8 _RINvNtNtCs9g4b2IXPNZ3_3std3sys9backtrace28___rust_begin_short_backtraceFENtNtB6_7process8ExitCodeB19_ECsiH8ZqLrS5m2_10rustc_main (rustc + 0x363f8)
#7  0x0000c57f6c2263e0 _RNCINvNtCs9g4b2IXPNZ3_3std2rt10lang_startNtNtB6_7process8ExitCodeE0CsiH8ZqLrS5m2_10rustc_main (rustc + 0x363e0)
#8  0x0000fdc832880064 _RNvNtCs9g4b2IXPNZ3_3std2rt19lang_start_internal (librustc_driver-d2ac115384bfcfd9.so + 0x44e0064)
#9  0x0000c57f6c22d1a0 main (rustc + 0x3d1a0)
#10 0x0000fdc82e186574 __libc_start_call_main (libc.so.6 + 0x26574)
#11 0x0000fdc82e186658 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x26658)
#12 0x0000c57f6c22d094 $x (rustc + 0x3d094)
#13 0x0000c57f6c22d094 $x (rustc + 0x3d094)
ELF object binary architecture: AARCH64

Activity

  1. Firestar99
    added
    I-ICEIssue: The compiler panicked, giving an Internal Compilation Error (ICE) ❄️
    T-compilerRelevant to the compiler team, which will review and decide on the PR/issue.
    C-bugCategory: This is a bug.
    on Oct 19, 2026
  2. rustbot
    added
    needs-triageThis issue may need triage. Remove when done. See docs forge.rust-lang.org/release/issue-triaging
    on Oct 19, 2026
  3. maxdexh
    added
    I-crashIssue: The compiler crashes (SIGSEGV, SIGABRT, etc). Use I-ICE instead when the compiler panics.
    A-LLVMArea: Code generation parts specific to LLVM. Both correctness bugs and optimization-related issues.
    I-llvm-errorImpact: An error from LLVM is directly exposed by valid code
    and removed
    I-ICEIssue: The compiler panicked, giving an Internal Compilation Error (ICE) ❄️
    needs-triageThis issue may need triage. Remove when done. See docs forge.rust-lang.org/release/issue-triaging
    on Oct 19, 2026

  4. maxdexh commented on Oct 19, 2026

    @maxdexh
    maxdexh
    on Oct 19, 2026
    Member

    Thanks! segfault is in LLVM code

  5. maxdexh
    added
    regression-from-stable-to-stablePerformance or correctness regression from one stable version to another.
    on Oct 19, 2026
  6. rustbot
    added
    I-prioritizeIssue needs a team member to assess the impact. Will be replaced by P-{low,medium,high,critical}
    on Oct 19, 2026

  7. nikic commented on Oct 19, 2026

    @nikic
    nikic
    on Oct 19, 2026
    Contributor

    I can repro with -Ctarget-cpu=gb10.

  8. Firestar99 commented on Oct 19, 2026

    @Firestar99
    Firestar99
    on Oct 19, 2026
    Author

    I don't know if this is actually a stable-to-stable regression or if this never worked in the first place. Previously, I'd either run --release or -Ctarget-cpu=native, not both combined.

  9. eddyb commented on Oct 19, 2026

    @eddyb
    eddyb
    on Oct 19, 2026
    Contributor

    Interestingly, the Nvidia DGX Spark seems to report as cortex-x925 not gb10:

    $ rustc --print target-cpus | rg native
    native          - Select the CPU of the current host (currently cortex-x925).
$ rustc -vV
rustc 1.101.0-nightly (b6eeb93c9 2026-10-18)
binary: rustc
commit-hash: b6eeb93c992027a03e1fd120b6652546396b142c
commit-date: 2026-10-18
host: aarch64-unknown-linux-gnu
release: 1.101.0-nightly
LLVM version: 23.1.4

  10. nikic commented on Oct 19, 2026

    @nikic
    nikic
    on Oct 19, 2026
    Contributor

    Reduction:

    ; RUN: opt -S -passes=loop-vectorize < %s
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128-Fn32"
target triple = "aarch64-unknown-linux-gnu"

define float @test(i64 %0) #0 {
.loopexit36:
  br label %1

1:                                                ; preds = %1, %.loopexit36
  %2 = phi ptr [ %7, %1 ], [ null, %.loopexit36 ]
  %3 = phi float [ %8, %1 ], [ 0.000000e+00, %.loopexit36 ]
  %4 = phi i64 [ %5, %1 ], [ 0, %.loopexit36 ]
  %5 = add i64 %4, 1
  %6 = icmp ne ptr %2, null
  tail call void @llvm.assume(i1 %6)
  %7 = getelementptr i8, ptr %2, i64 1
  %8 = fadd float %3, 0.000000e+00
  %9 = icmp eq i64 %4, %0
  br i1 %9, label %10, label %1

10:                                               ; preds = %1
  ret float %8
}

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(inaccessiblemem: write)
declare void @llvm.assume(i1 noundef) #1

attributes #0 = { "target-cpu"="gb10" }
attributes #1 = { nocallback nofree nosync nounwind willreturn memory(inaccessiblemem: write) }

    Issue appears to be fixed on main.

  11. nikic commented on Oct 19, 2026

    @nikic
    nikic
    on Oct 19, 2026
    Contributor

    Looks like it was fixed by llvm/llvm-project#217765.

  12. nikic
    self-assigned this
    on Oct 19, 2026
  13. maxdexh
    added
    llvm-fixed-upstreamIssue expected to be fixed by the next major LLVM upgrade, or backported fixes
    on Oct 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

A-LLVMArea: Code generation parts specific to LLVM. Both correctness bugs and optimization-related issues.C-bugCategory: This is a bug.I-crashIssue: The compiler crashes (SIGSEGV, SIGABRT, etc). Use I-ICE instead when the compiler panics.I-llvm-errorImpact: An error from LLVM is directly exposed by valid codeI-prioritizeIssue needs a team member to assess the impact. Will be replaced by P-{low,medium,high,critical}T-compilerRelevant to the compiler team, which will review and decide on the PR/issue.llvm-fixed-upstreamIssue expected to be fixed by the next major LLVM upgrade, or backported fixesregression-from-stable-to-stablePerformance or correctness regression from one stable version to another.

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions