self-hosted backend fails to compile zigimg (compiler segfault) #31837

emidoots commented 2026年04月13日 05:17:59 +02:00

Zig Version

0.16.0-dev.3142+5ccfeb926

Steps to Reproduce and Observed Behavior

First reduction of issue

The self-hosted x86_64 backend crashes on @bitCast of a packed struct containing a void (zero-bit) field. Removing the void field, using a release build, or targeting aarch64 all work fine.

repro.zig:

const S = packed struct { _: void = {}, a: u8 = 0 };
export fn f(x: u8) u8 { return @bitCast(S{ .a = x }); }

Debug on x86_64 fails:

% zig build-obj -ODebug -target x86_64-linux-gnu repro.zig
zsh: segmentation fault zig build-obj -ODebug -target x86_64-linux-gnu repro.zig

ReleaseSafe is fine:

zig build-obj -OReleaseSafe -target x86_64-linux-gnu repro.zig

Second reduction of issue

Another interesting minimal repro, with no @bitCast:

const S = packed struct { _: void = {}, a: u5 = 0 };
fn inner(x: u8) u5 {
 const s = S{ .a = @truncate(x) };
 return s.a;
}
export fn f(x: u8) u8 { return inner(x); }

Expected Behavior

No compiler segfault

### Zig Version 0.16.0-dev.3142+5ccfeb926 ### Steps to Reproduce and Observed Behavior ## First reduction of issue The self-hosted x86_64 backend crashes on `@bitCast` of a `packed struct` containing a void (zero-bit) field. Removing the void field, using a release build, or targeting aarch64 all work fine. `repro.zig`: ``` const S = packed struct { _: void = {}, a: u8 = 0 }; export fn f(x: u8) u8 { return @bitCast(S{ .a = x }); } ``` Debug on x86_64 fails: ``` % zig build-obj -ODebug -target x86_64-linux-gnu repro.zig zsh: segmentation fault zig build-obj -ODebug -target x86_64-linux-gnu repro.zig ``` ReleaseSafe is fine: ``` zig build-obj -OReleaseSafe -target x86_64-linux-gnu repro.zig ``` ## Second reduction of issue Another interesting minimal repro, with no `@bitCast`: ``` const S = packed struct { _: void = {}, a: u5 = 0 }; fn inner(x: u8) u5 { const s = S{ .a = @truncate(x) }; return s.a; } export fn f(x: u8) u8 { return inner(x); } ``` ### Expected Behavior No compiler segfault

andrewrk commented 2026年04月13日 05:41:51 +02:00

Crashes in Legalize:

Compiler crash context:
Generating function 'test.f'
thread 1463881 panic: reached unreachable code
/home/andy/dev/zig/lib/std/debug.zig:421:14: 0x65f54b9 in assert (std.zig)
 if (!ok) unreachable; // assertion failure
 ^
/home/andy/dev/zig/src/Zcu/PerThread.zig:4197:15: 0x7ce5631 in intValue_u64 (main.zig)
 assert(unsigned_bits >= std.math.log2(x) + 1);
 ^
/home/andy/dev/zig/src/Zcu/PerThread.zig:4171:63: 0x7ce5ac8 in intValue__anon_572846 (main.zig)
 if (std.math.cast(u64, x)) |casted| return pt.intValue_u64(ty, casted);
 ^
/home/andy/dev/zig/src/Air/Legalize.zig:2511:76: 0xab603c7 in packedAggregateInitBlockPayload (main.zig)
 const field_bit_size_ref: Air.Inst.Ref = .fromValue(try pt.intValue(shift_ty, field_ty.bitSize(zcu)));
 ^
/home/andy/dev/zig/src/Air/Legalize.zig:865:117: 0xab196ae in legalizeBody (main.zig)
 else => continue :inst l.replaceInst(inst, .block, try l.packedAggregateInitBlockPayload(inst)),
 ^
/home/andy/dev/zig/src/Air/Legalize.zig:288:23: 0xab05385 in legalize (main.zig)
 try l.legalizeBody(main_extra.end, main_extra.data.body_len);
 ^
/home/andy/dev/zig/src/Zcu/PerThread.zig:4561:25: 0x97ac44e in runCodegenInner (main.zig)
 try air.legalize(pt, features);
 ^
/home/andy/dev/zig/src/Zcu/PerThread.zig:4497:43: 0x97ab055 in runCodegen (main.zig)
 const codegen_result = runCodegenInner(pt, func_index, air);
 ^
/home/andy/dev/zig/src/Zcu.zig:5374:29: 0x97aad60 in workerCodegenOwnedAir (main.zig)
 return pt.runCodegen(func_index, &air);
 ^
/home/andy/dev/zig/lib/std/Io.zig:2337:13: 0x97aa9af in start (std.zig)
 result_casted.* = @call(.auto, function, args_casted.*);
 ^
/home/andy/dev/zig/lib/std/Io/Threaded.zig:741:20: 0x67656fe in start (std.zig)
 future.func(future.contextPointer(), future.resultPointer());
 ^
/home/andy/dev/zig/lib/std/Io/Threaded.zig:1797:29: 0x6761573 in worker (std.zig)
 runnable.startFn(runnable, &thread, t);
 ^
/home/andy/dev/zig/lib/std/Thread.zig:422:13: 0x6761125 in callFn__anon_27065 (std.zig)
 @call(.auto, f, args);
 ^
/home/andy/dev/zig/lib/std/Thread.zig:752:30: 0x6760f19 in entryFn (std.zig)
 return callFn(f, args_ptr.*);
 ^

Also crashes in 0.15.1.

Other example crashes in x86 codegen (appears to be an independent issue):

Compiler crash context:
Generating function 'test.inner'
thread 1464143 panic: reached unreachable code
/home/andy/dev/zig/lib/std/debug.zig:421:14: 0x65f54b9 in assert (std.zig)
 if (!ok) unreachable; // assertion failure
 ^
/home/andy/dev/zig/lib/std/math.zig:1123:11: 0x691d290 in isPowerOfTwo__anon_89409 (std.zig)
 assert(int > 0);
 ^
/home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:174084:34: 0x8637c17 in allocRegOrMemAdvanced (main.zig)
 if (std.math.isPowerOfTwo(abi_size) and abi_size <= @as(u32, max_abi_size: switch (ty.zigTypeTag(zcu)) {
 ^
/home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:174069:38: 0x86383ba in allocRegOrMem (main.zig)
 return self.allocRegOrMemAdvanced(self.typeOfIndex(inst), inst, reg_ok);
 ^
/home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:179461:51: 0x994564d in airBitCast (main.zig)
 const dst_mcv = try self.allocRegOrMem(inst, true);
 ^
/home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:67357:42: 0x99a2882 in genBody (main.zig)
 .bitcast => try cg.airBitCast(inst),
 ^
/home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:176544:21: 0x994a856 in lowerBlock (main.zig)
 try self.genBody(body);
 ^
/home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:67361:34: 0x99a2a5c in genBody (main.zig)
 try cg.lowerBlock(inst, block.body);
 ^
/home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:2271:19: 0x98f381f in genMainBody (main.zig)
 try cg.genBody(main_body[air_arg_count..]);
 ^
/home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:2067:29: 0x98d89c1 in gen (main.zig)
 try self.genMainBody(zir, func_zir_inst, comptime_args, air_arg_count);
 ^
/home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:985:17: 0x98d0284 in generate (main.zig)
 function.gen(&file.zir.?, func_zir.inst, func.comptime_args, call_info.air_arg_count) catch |err| switch (err) {
 ^
/home/andy/dev/zig/src/codegen.zig:163:45: 0x97db899 in generateFunction (main.zig)
 const mir = try CodeGen.generate(lf, pt, src_loc, func_index, air, liveness);
 ^
/home/andy/dev/zig/src/Zcu/PerThread.zig:4621:36: 0x97ad419 in runCodegenInner (main.zig)
 return codegen.generateFunction(lf, pt, zcu.navSrcLoc(nav), func_index, air, &liveness) catch |err| switch (err) {
 ^
/home/andy/dev/zig/src/Zcu/PerThread.zig:4497:43: 0x97ab055 in runCodegen (main.zig)
 const codegen_result = runCodegenInner(pt, func_index, air);
 ^
/home/andy/dev/zig/src/Zcu.zig:5374:29: 0x97aad60 in workerCodegenOwnedAir (main.zig)
 return pt.runCodegen(func_index, &air);
 ^
/home/andy/dev/zig/lib/std/Io.zig:2337:13: 0x97aa9af in start (std.zig)
 result_casted.* = @call(.auto, function, args_casted.*);
 ^
/home/andy/dev/zig/lib/std/Io/Threaded.zig:741:20: 0x67656fe in start (std.zig)
 future.func(future.contextPointer(), future.resultPointer());
 ^
/home/andy/dev/zig/lib/std/Io/Threaded.zig:1797:29: 0x6761573 in worker (std.zig)
 runnable.startFn(runnable, &thread, t);
 ^
/home/andy/dev/zig/lib/std/Thread.zig:422:13: 0x6761125 in callFn__anon_27065 (std.zig)
 @call(.auto, f, args);
 ^
/home/andy/dev/zig/lib/std/Thread.zig:752:30: 0x6760f19 in entryFn (std.zig)
 return callFn(f, args_ptr.*);
 ^

Other example also crashes in 0.15.1.

Crashes in Legalize: ``` Compiler crash context: Generating function 'test.f' thread 1463881 panic: reached unreachable code /home/andy/dev/zig/lib/std/debug.zig:421:14: 0x65f54b9 in assert (std.zig) if (!ok) unreachable; // assertion failure ^ /home/andy/dev/zig/src/Zcu/PerThread.zig:4197:15: 0x7ce5631 in intValue_u64 (main.zig) assert(unsigned_bits >= std.math.log2(x) + 1); ^ /home/andy/dev/zig/src/Zcu/PerThread.zig:4171:63: 0x7ce5ac8 in intValue__anon_572846 (main.zig) if (std.math.cast(u64, x)) |casted| return pt.intValue_u64(ty, casted); ^ /home/andy/dev/zig/src/Air/Legalize.zig:2511:76: 0xab603c7 in packedAggregateInitBlockPayload (main.zig) const field_bit_size_ref: Air.Inst.Ref = .fromValue(try pt.intValue(shift_ty, field_ty.bitSize(zcu))); ^ /home/andy/dev/zig/src/Air/Legalize.zig:865:117: 0xab196ae in legalizeBody (main.zig) else => continue :inst l.replaceInst(inst, .block, try l.packedAggregateInitBlockPayload(inst)), ^ /home/andy/dev/zig/src/Air/Legalize.zig:288:23: 0xab05385 in legalize (main.zig) try l.legalizeBody(main_extra.end, main_extra.data.body_len); ^ /home/andy/dev/zig/src/Zcu/PerThread.zig:4561:25: 0x97ac44e in runCodegenInner (main.zig) try air.legalize(pt, features); ^ /home/andy/dev/zig/src/Zcu/PerThread.zig:4497:43: 0x97ab055 in runCodegen (main.zig) const codegen_result = runCodegenInner(pt, func_index, air); ^ /home/andy/dev/zig/src/Zcu.zig:5374:29: 0x97aad60 in workerCodegenOwnedAir (main.zig) return pt.runCodegen(func_index, &air); ^ /home/andy/dev/zig/lib/std/Io.zig:2337:13: 0x97aa9af in start (std.zig) result_casted.* = @call(.auto, function, args_casted.*); ^ /home/andy/dev/zig/lib/std/Io/Threaded.zig:741:20: 0x67656fe in start (std.zig) future.func(future.contextPointer(), future.resultPointer()); ^ /home/andy/dev/zig/lib/std/Io/Threaded.zig:1797:29: 0x6761573 in worker (std.zig) runnable.startFn(runnable, &thread, t); ^ /home/andy/dev/zig/lib/std/Thread.zig:422:13: 0x6761125 in callFn__anon_27065 (std.zig) @call(.auto, f, args); ^ /home/andy/dev/zig/lib/std/Thread.zig:752:30: 0x6760f19 in entryFn (std.zig) return callFn(f, args_ptr.*); ^ ``` Also crashes in 0.15.1. Other example crashes in x86 codegen (appears to be an independent issue): ``` Compiler crash context: Generating function 'test.inner' thread 1464143 panic: reached unreachable code /home/andy/dev/zig/lib/std/debug.zig:421:14: 0x65f54b9 in assert (std.zig) if (!ok) unreachable; // assertion failure ^ /home/andy/dev/zig/lib/std/math.zig:1123:11: 0x691d290 in isPowerOfTwo__anon_89409 (std.zig) assert(int > 0); ^ /home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:174084:34: 0x8637c17 in allocRegOrMemAdvanced (main.zig) if (std.math.isPowerOfTwo(abi_size) and abi_size <= @as(u32, max_abi_size: switch (ty.zigTypeTag(zcu)) { ^ /home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:174069:38: 0x86383ba in allocRegOrMem (main.zig) return self.allocRegOrMemAdvanced(self.typeOfIndex(inst), inst, reg_ok); ^ /home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:179461:51: 0x994564d in airBitCast (main.zig) const dst_mcv = try self.allocRegOrMem(inst, true); ^ /home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:67357:42: 0x99a2882 in genBody (main.zig) .bitcast => try cg.airBitCast(inst), ^ /home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:176544:21: 0x994a856 in lowerBlock (main.zig) try self.genBody(body); ^ /home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:67361:34: 0x99a2a5c in genBody (main.zig) try cg.lowerBlock(inst, block.body); ^ /home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:2271:19: 0x98f381f in genMainBody (main.zig) try cg.genBody(main_body[air_arg_count..]); ^ /home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:2067:29: 0x98d89c1 in gen (main.zig) try self.genMainBody(zir, func_zir_inst, comptime_args, air_arg_count); ^ /home/andy/dev/zig/src/codegen/x86_64/CodeGen.zig:985:17: 0x98d0284 in generate (main.zig) function.gen(&file.zir.?, func_zir.inst, func.comptime_args, call_info.air_arg_count) catch |err| switch (err) { ^ /home/andy/dev/zig/src/codegen.zig:163:45: 0x97db899 in generateFunction (main.zig) const mir = try CodeGen.generate(lf, pt, src_loc, func_index, air, liveness); ^ /home/andy/dev/zig/src/Zcu/PerThread.zig:4621:36: 0x97ad419 in runCodegenInner (main.zig) return codegen.generateFunction(lf, pt, zcu.navSrcLoc(nav), func_index, air, &liveness) catch |err| switch (err) { ^ /home/andy/dev/zig/src/Zcu/PerThread.zig:4497:43: 0x97ab055 in runCodegen (main.zig) const codegen_result = runCodegenInner(pt, func_index, air); ^ /home/andy/dev/zig/src/Zcu.zig:5374:29: 0x97aad60 in workerCodegenOwnedAir (main.zig) return pt.runCodegen(func_index, &air); ^ /home/andy/dev/zig/lib/std/Io.zig:2337:13: 0x97aa9af in start (std.zig) result_casted.* = @call(.auto, function, args_casted.*); ^ /home/andy/dev/zig/lib/std/Io/Threaded.zig:741:20: 0x67656fe in start (std.zig) future.func(future.contextPointer(), future.resultPointer()); ^ /home/andy/dev/zig/lib/std/Io/Threaded.zig:1797:29: 0x6761573 in worker (std.zig) runnable.startFn(runnable, &thread, t); ^ /home/andy/dev/zig/lib/std/Thread.zig:422:13: 0x6761125 in callFn__anon_27065 (std.zig) @call(.auto, f, args); ^ /home/andy/dev/zig/lib/std/Thread.zig:752:30: 0x6760f19 in entryFn (std.zig) return callFn(f, args_ptr.*); ^ ``` Other example also crashes in 0.15.1.

mlugg commented 2026年04月13日 13:21:06 +02:00

Removing x86_64 backend labels because the second crash looks like it's caused by a Sema OPV bug.

Removing x86_64 backend labels because the second crash looks like it's caused by a Sema OPV bug.