Failed assertion in writeSectionData after LLVM commit faa931b717c02d57f0814caa9133219040e6a85b

[nathanchance]

I am seeing an assertion failure when building the Linux kernel for arm64 after llvm/llvm-project@faa931b (cc @MaskRay).

# bad: [408fe1d369df926eecd6c15ce939d38652b4b58d] [NFC][run-clang-tidy] Add minor type hints (#151873)
# good: [ee67f78776d0af64bc27cabcca62883f7a698467] Fix error caused by reference to local binding (#151789)
git bisect start '408fe1d369df926eecd6c15ce939d38652b4b58d' 'ee67f78776d0af64bc27cabcca62883f7a698467'
# good: [d696f8104e422f807d64b4d5d24c6e7bc22d429f] [clang-format][NFC] Maximize usage of isOneOf() in TokenAnnotator (#151658)
git bisect good d696f8104e422f807d64b4d5d24c6e7bc22d429f
# bad: [49b5a1fa71d5af2b463c327e17017c754eb50801] [AMDGPU] fmuladd.f32.ll - clean up prefixes and regenerate checks (#151832)
git bisect bad 49b5a1fa71d5af2b463c327e17017c754eb50801
# bad: [d18511e10a0d737c13a7a017ef3d0655911fc22d] [AMDGPU] v_cvt_scalef32_sr_pk16_* gfx1250 instructions (#151810)
git bisect bad d18511e10a0d737c13a7a017ef3d0655911fc22d
# good: [bb3cd6221b207e13a430d8cd438e1d4212b80aa4] [libc][math] Refactor atanhf16 implementation to header-only in src/__support/math folder. (#151779)
git bisect good bb3cd6221b207e13a430d8cd438e1d4212b80aa4
# good: [5f8338749aa2fab742960b013809e1e0a8fbcfdd] [libc] fix build errors caused by atanhf16. (#151838)
git bisect good 5f8338749aa2fab742960b013809e1e0a8fbcfdd
# bad: [faa931b717c02d57f0814caa9133219040e6a85b] MCFragment: Store the number of variable-size tail fixups as uint8_t
git bisect bad faa931b717c02d57f0814caa9133219040e6a85b
# good: [21f1f9558df3830ffa637def364e3c0cb0dbb3c0] [IR2Vec][llvm-ir2vec] Changing clEnumValN to cl::SubCommand (#151384)
git bisect good 21f1f9558df3830ffa637def364e3c0cb0dbb3c0
# first bad commit: [faa931b717c02d57f0814caa9133219040e6a85b] MCFragment: Store the number of variable-size tail fixups as uint8_t

$ make -skj"$(nproc)" ARCH=arm64 LLVM=1 clean defconfig hardening.config arch/arm64/kernel/entry.o
clang-22: llvm/lib/MC/MCAssembler.cpp:615: void llvm::MCAssembler::writeSectionData(raw_ostream &, const MCSection *) const: Assertion `getContext().hadError() || OS.tell() - Start == getSectionAddressSize(*Sec)' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: clang-22 -cc1as ... -o arch/arm64/kernel/entry.o /tmp/entry-a9cd06.s
 #0 0x0000558e597ff3c8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (clang-22+0x5c3e3c8)
 #1 0x0000558e597fcb05 llvm::sys::RunSignalHandlers() (clang-22+0x5c3bb05)
 #2 0x0000558e59800171 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x00007f3d5923e540 (/usr/lib/libc.so.6+0x3e540)
 #4 0x00007f3d5929894c (/usr/lib/libc.so.6+0x9894c)
 #5 0x00007f3d5923e410 raise (/usr/lib/libc.so.6+0x3e410)
 #6 0x00007f3d5922557a abort (/usr/lib/libc.so.6+0x2557a)
 #7 0x00007f3d592254e3 __assert_perror_fail (/usr/lib/libc.so.6+0x254e3)
 #8 0x0000558e5954a595 llvm::MCAssembler::writeSectionData(llvm::raw_ostream&, llvm::MCSection const*) const (clang-22+0x5989595)
 #9 0x0000558e5952fbfc (anonymous namespace)::ELFWriter::writeObject() ELFObjectWriter.cpp:0:0
#10 0x0000558e5952f458 llvm::ELFObjectWriter::writeObject() (clang-22+0x596e458)
#11 0x0000558e5954b928 llvm::MCAssembler::Finish() (clang-22+0x598a928)
#12 0x0000558e5956c556 llvm::MCELFStreamer::finishImpl() (clang-22+0x59ab556)
#13 0x0000558e595d1f57 (anonymous namespace)::AsmParser::Run(bool, bool) AsmParser.cpp:0:0
#14 0x0000558e577229a6 cc1as_main(llvm::ArrayRef<char const*>, char const*, void*) (clang-22+0x3b619a6)
#15 0x0000558e57717c04 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#16 0x0000558e57716bec clang_main(int, char**, llvm::ToolContext const&) (clang-22+0x3b55bec)
#17 0x0000558e57727b87 main (clang-22+0x3b66b87)
#18 0x00007f3d59227675 (/usr/lib/libc.so.6+0x27675)
#19 0x00007f3d59227729 __libc_start_main (/usr/lib/libc.so.6+0x27729)
#20 0x0000558e577155e5 _start (clang-22+0x3b545e5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang integrated assembler command failed due to signal (use -v to see invocation)

cvise --not-c spits out:

.macro altinstruction_entry  
 .word .
 .word .
 .hword enable  
 .endm
.macro alternative_if_not 
 .set .Lasm_alt_mode, 0
 .pushsection ""
 altinstruction_entry 
 .popsection
661:
.endm
.macro alternative_if 
 .set .Lasm_alt_mode, 1
 .pushsection ""
 altinstruction_entry  
661:
.endm
.macro alternative_else
662:
 .if 0
 .else
 .previous
 .endif
.endm
.macro alternative_endif
 .org .  
 .org . - (662b-661b) + 64
 .if .Lasm_alt_mode==0
 .previous
 .endif
.endm
.macro alternative_else_nop_endif
alternative_else
 nops 662 / 4
alternative_endif
.endm
 .macro msr_s 
 .inst(0)
 .endm
 .macro disable_step_tsk flgs tmp
 tbz \flgs, 1, f
 mrs \tmp, mdscr_el1
 bic \tmp, \tmp, 1 
 msr mdscr_el1, \tmp
 isb
.endm
 .macro nops num
 .rept \num
 nop
 .endr
 .endm
 .macro adr_l dst 
 adrp \dst, sym
 add \dst, \dst, :lo12:sym
 .endm
 .macro get_this_cpu_offset dst
alternative_if_not 
 mrs \dst, tpidr_el1
alternative_else
 mrs \dst, tpidr_el2
alternative_endif
 .endm
 .macro adr_this_cpu dst sym tmp
 adrp \tmp, sym
 add \dst, \tmp, :lo12:sym
 get_this_cpu_offset \tmp
 add \dst, \dst, \tmp
 .endm
 .macro ldr_this_cpu dst sym tmp
 adr_l \dst 
 get_this_cpu_offset \tmp
 ldr \dst, alternative_cb_end
 .endm
 .macro __ptrauth_keys_install_kernel_nosync tsk tmp1 tmp2 tmp3
 mov \tmp1, 0
 add \tmp1, tsk, \tmp1
 ldp \tmp2, \tmp3, [\tmp1]
 msr_s 
 .endm
 .macro kernel_ventry el 
 .align 7
.if \el  
 .if 4
 msr tpidrro_el0, xzr
 mov x30, xzr
 .endif
.endif
 add sp, sp, x0
 sub x0, sp, x0
 tbnz x0, 0, f
 sub x0, sp, x0
 sub sp, sp, x0
 b label
msr tpidr_el0, x0
 sub x0, sp, x0
 msr tpidrro_el0, x0
 adr_this_cpu sp, , x0
 mrs x0, tpidr_el0
 sub x0, sp, x0
 tst x0, 1
 sub sp, sp, x0
 mrs x0, tpidrro_el0
 b label
.org . 
 .endm
 .macro check_mte_async_tcf tmp ti_flags thread_sctlr
 .arch_extension lse
alternative_if_not 
 b f
alternative_else_nop_endif
 tbz \thread_sctlr, 0, 0
 tbz \tmp, 0, f
 mov \tmp, 0
 add \ti_flags, tsk, 0
 stset \tmp, [\ti_flags]
.endm
 .macro kernel_entry el 
 stp x0, x1, [sp ]
 stp x2, x3, [sp  ]
 stp x4, x5, [sp  ]
 stp x6, x7, [sp  ]
 stp x8, x9, [sp  ]
 stp x10, x11, [sp  ]
 stp x12, x13, [sp  ]
 stp x14, x15, [sp  ]
 stp x16, x17, [sp ]
 stp x18, x19, [sp  ]
 stp x20, x21, [sp  ]
 stp x22, x23, [sp  ]
 stp x24, x25, [sp  ]
 stp x26, x27, [sp  ]
 stp x28, x29, [sp  ]
 .if \el  
 ldr_this_cpu tsk, , x20
 msr sp_el0, tsk
 ldr x19, [tsk]
 disable_step_tsk x19 x20
 ldr x0, [tsk]
 check_mte_async_tcf x22 x23 x0
alternative_if 
 tbz x0, 1, f
 __ptrauth_keys_install_kernel_nosync , x20 x22 x23
 b sctlr_el1
 orr x0, x0, 1 
 msr sctlr_el1, x0
alternative_else_nop_endif
 alternative_if 
alternative_else_nop_endif
alternative_if 
alternative_else_nop_endif
.endif
 mrs x22, elr_el1
 mrs x23, spsr_el1
 stp lr, x21, [sp]
 stp xzr, xzr, [sp]
 .if 0
 .else
 mov x0, 2
 .endif
 str x0, [sp]
 add x29, sp, 6
alternative_if_not 
 b __swpan_entry_elel
alternative_else_nop_endif
 stp x22, x23, [sp]
 .endm
 .balign   4194304
 .balign   4194304
  .balign 4  
 tsk .req x28
 .pushsection "ax"
 .align 1
 .balign 4 ; kernel_ventry   4 
 kernel_ventry   4 
 kernel_ventry   4 
 kernel_ventry   4 
 kernel_ventry   4 
 kernel_ventry   4 
 kernel_ventry   4 
 kernel_ventry   2 
 kernel_ventry   2 
 kernel_ventry   2 
 kernel_ventry 0    ; .balign 4  
 kernel_entry 6
 .pushsection __bug_table; .align 2; .pushsection progbits,1; .popsection .align 2; .popsection  .macro entry_handler e ht regsize 
 .balign 4 ; kernel_entry  \regsize
 mov x0, sp
 b label
 .endm
 entry_handler , , 4 
  entry_handler , , 4 
  entry_handler , , 4 
  entry_handler , h 4 
  entry_handler , , 2 
  entry_handler , , 2 

which does not crash with either GNU as or clang before this change.

$ aarch64-linux-gcc -c -o /dev/null entry.s

$ llvm-good/bin/clang --target=aarch64-linux-gnu -c -o /dev/null entry.s

$ llvm-bad/bin/clang --target=aarch64-linux-gnu -c -o /dev/null entry.s
clang: llvm/lib/MC/MCAssembler.cpp:615: void llvm::MCAssembler::writeSectionData(raw_ostream &, const MCSection *) const: Assertion `getContext().hadError() || OS.tell() - Start == getSectionAddressSize(*Sec)' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: llvm-bad/bin/clang --target=aarch64-linux-gnu -c -o /dev/null entry.s
 #0 0x000055dbda8933c8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (clang+0x5c3e3c8)
 #1 0x000055dbda890b05 llvm::sys::RunSignalHandlers() (clang+0x5c3bb05)
 #2 0x000055dbda811e16 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007f3d9b63e540 (/usr/lib/libc.so.6+0x3e540)
 #4 0x00007f3d9b69894c (/usr/lib/libc.so.6+0x9894c)
 #5 0x00007f3d9b63e410 raise (/usr/lib/libc.so.6+0x3e410)
 #6 0x00007f3d9b62557a abort (/usr/lib/libc.so.6+0x2557a)
 #7 0x00007f3d9b6254e3 __assert_perror_fail (/usr/lib/libc.so.6+0x254e3)
 #8 0x000055dbda5de595 llvm::MCAssembler::writeSectionData(llvm::raw_ostream&, llvm::MCSection const*) const (clang+0x5989595)
 #9 0x000055dbda5c3bfc (anonymous namespace)::ELFWriter::writeObject() ELFObjectWriter.cpp:0:0
#10 0x000055dbda5c3458 llvm::ELFObjectWriter::writeObject() (clang+0x596e458)
#11 0x000055dbda5df928 llvm::MCAssembler::Finish() (clang+0x598a928)
#12 0x000055dbda600556 llvm::MCELFStreamer::finishImpl() (clang+0x59ab556)
#13 0x000055dbda665f57 (anonymous namespace)::AsmParser::Run(bool, bool) AsmParser.cpp:0:0
#14 0x000055dbd87b69a6 cc1as_main(llvm::ArrayRef<char const*>, char const*, void*) (clang+0x3b619a6)
#15 0x000055dbd87abc04 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#16 0x000055dbdb33b209 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::$_0>(long) Job.cpp:0:0
#17 0x000055dbda811afe llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (clang+0x5bbcafe)
#18 0x000055dbdb33aa43 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (clang+0x66e5a43)
#19 0x000055dbdb2fbf9c clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (clang+0x66a6f9c)
#20 0x000055dbdb2fc1b7 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (clang+0x66a71b7)
#21 0x000055dbdb3188c8 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (clang+0x66c38c8)
#22 0x000055dbd87ab387 clang_main(int, char**, llvm::ToolContext const&) (clang+0x3b56387)
#23 0x000055dbd87bbb87 main (clang+0x3b66b87)
#24 0x00007f3d9b627675 (/usr/lib/libc.so.6+0x27675)
#25 0x00007f3d9b627729 __libc_start_main (/usr/lib/libc.so.6+0x27729)
#26 0x000055dbd87a95e5 _start (clang+0x3b545e5)
clang: error: clang integrated assembler command failed with exit code 134 (use -v to see invocation)

[MaskRay]

Thanks for the reduced assembly file. This is very useful!

The test is sensitive to exact fragment offsets.
llvm-mc -filetype=obj -triple=aarch64 a.s cannot reproduce.
clang -cc1as has a redundant initSection (an extra FT_Align),
triggering the issue.

I think the root cause is f1aa6050bd90f8ec4273da55d362e23905ad3a81 , which changed fragment fixed-size part content (https://maskray.me/blog/2025-07-27-llvm-integrated-assembler-engineering-better-fragments#fragment-content-in-trailing-data)

% /tmp/Debug/bin/clang "-cc1as" "-triple" "aarch64" "-filetype" "obj" "-main-file-name" "a.s" "-o" "a.o" "a.s"
clang: /home/ray/llvm/llvm/lib/MC/MCAssembler.cpp:615: void llvm::MCAssembler::writeSectionData(raw_ostream &, const MCSection *) const: Assertion `getContext().hadError() || OS.tell() - Start == getSectionAddressSize(*Sec)' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: /tmp/Debug/bin/clang -cc1as -triple aarch64 -filetype obj -main-file-name a.s -o a.o a.s
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0  libLLVMSupport.so.22.0git 0x00007cf91eb753cd llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) + 61
fish: Job 1, '/tmp/Debug/bin/clang "-cc1as" "…' terminated by signal SIGABRT (Abort)

I am testing a revert.

[MaskRay]

Reverted the commit llvm/llvm-project@a2fef66 ("MCFragment: Use trailing data for fixed-size part") as a workaround.

However, this is not the root cause, either. The underlying issue is that MCAssembler::layout fails to fully converge with complex assembler expressions, leading to the assertion failure.

clang: /home/ray/llvm/llvm/lib/MC/MCAssembler.cpp:615: void llvm::MCAssembler::writeSectionData(raw_ostream &, const MCSection *) const: Assertion `getContext().hadError() || OS.tell() - Start == getSectionAddressSize(*Sec)' failed.

"MCFragment: Use trailing data for fixed-size part" created some 0-size Data fragments, which probably triggered the edge case.

---

The issue cannot be reliably replicated. The specific test case would
not replicate if any of the following condition was not satisfied:

• .org was not re-evaluated. Fixed by this commit.
• clang -cc1as has a redundant initSections call, leading to a
  redundant initial FT_Align fragment. llvm-mc -filetype=obj, lacking
  the redundant initSections, doesn't replicate.
• llvm/llvm-project@faa931b decreased sizeof(MCFragment).
• llvm/llvm-project@f1aa605 added more fragments

[nathanchance]

Thanks, I cannot reproduce this at llvm/llvm-project@70af09e, which contains both llvm/llvm-project@df71243 and llvm/llvm-project@e8fc808. It seems like this had runtime consequences as well, so it seems like the assertion is a good one :)