Re: LLVM JIT: any JIT-compiled query crashes (SIGILL) on a libLLVM 19 + ASAN build

On Mon, Oct 26, 2026 Henson Choi wrote:
> v4, attached, leaves the build systems alone and fixes this where the
> types are read:

Hello Henson,

I've been reviewing the LLVM code recently and it led me to your work,
thank you for digging into this area of the code.

I tested your v4 patches on Debian 13 to match the CI image's
distribution with gcc 14.2, meson, -O2 -ggdb -fsanitize=address
-fno-sanitize-recover=all, cassert, against both trixie's LLVM 19.1.7
and LLVM 21.1.8 from trixie-backports. On x86_64, each row is the jit
regression test plus a heavier query (jit_above_cost = 0,
jit_optimize_above_cost = 0, an aggregate over generate_series(1,
100000)):

LLVM 19.1.7 LLVM 21.1.8
0001 SIGILL SIGSEGV in
llvm::DINode::getFlagString()
0001+0002 ERROR (TypeSizeT ...) ERROR (TypeSizeT ...)
0001+0002+0003 ok, correct result ok, correct result
0001+0002+0004 ok, correct result ok, correct result

So on LLVM 21 the unpatched symptom is a SEGV in the debug-info code
rather than SIGILL, which fits your reading that the invalid IR is what
reaches it.

Both 0003 and 0004 work here. I'd lean towards 0004: it keeps the types
from being wrapped in the first place, and llvmjit_types.c is only ever
compiled by clang. 0002 is worth keeping either way, as a cheap check
that turns a crash in LLVM into an ERROR.

The same crash also shows up on aarch64 (Graviton, LLVM 19 and 21,
SIGILL with both), and both 0003 and 0004 fix it there too.

FWIW I've got a JIT-inlining fix with a pageinspect test [1] that is
the second test in the tree to turn JIT on, and CI's ASAN job crashes
in it for exactly this reason, so I'd be glad to see this go in.

best.

-greg

[1] https://www.postgresql.org/message-id/auSUW7eDMqZfEF80%40floki