Using an end iterator of an empty CFG block boiled down to dereferencing a garbage pointer.
This was fun to debug because the actual segfault occurs once in ~20 runs on the original code (on my system; on top of that, each run took several minutes). On the newly added test it crashes even more rarely, roughly once in 500 runs.
CFG uses llvm::BumpVector for storing the list of elements. Its iterators are typedefs for raw pointers, so there's no way to check the correctness of the iterator by injecting assertions into it.
[12:26:29] <@NoQ> I'm about to commit a fix for a flaky crash that's reproducible once in ~1000 compilations. Can we make for-loops in lit?
[12:27:12] <@jdoerfert> @NoQ: @jdenny: has an extension to do that (I think)
[12:36:40] <@NoQ> @jdoerfert: Thanks!
[12:36:59] <@jdoerfert> @NoQ: so, I doubt we have on in-tree
[12:37:21] <@NoQ> Mm, ok. I guess i could copy-paste the run-line :)
[12:37:36] <@lebedev.ri> i remember seeing previous fixes with such idea, but i don't recall how they achieved that
[12:37:37] <@jdoerfert> that is one way, yes ;)
[12:38:16] <@jdoerfert> #include <>; #include<>; #include<>; ... exponential growth!