llvm / llvm/llvm-project

Clang Crash (SIGSEGV) in CodeGen with __attribute__((preserve_access_index)) on structure access

Open
#165,462 2 comments 0 reactions 0 assignees View on GitHub
clang:codegen confirmed crash generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

## Compiler Explorer: https://godbolt.org/z/jjnhK9fe8

- clang start crashing on 12.0.0
- generated by fuzzer

## Console
```console
PLEASE submit a bug report to https://bugs.llvm.org/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-12.0.0/bin/clang -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-10.3.0 -fcolor-diagnostics -fno-crash-diagnostics
1. parser at end of file
2. :14:6: LLVM IR generation of declaration 'func'
3. :14:6: Generating code for declaration 'func'
#0 0x00005e4ee7b3abd1 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x318fbd1)
#1 0x00005e4ee7b38994 llvm::sys::RunSignalHandlers() (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x318d994)
#2 0x00005e4ee7b38c31 llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x318dc31)
#3 0x00005e4ee7aa1748 CrashRecoverySignalHandler(int) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x30f6748)
#4 0x0000755b44442520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#5 0x00005e4ee7ee0626 clang::CodeGen::CodeGenModule::getNaturalTypeAlignment(clang::QualType, clang::CodeGen::LValueBaseInfo*, clang::CodeGen::TBAAAccessInfo*, bool) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x3535626)
#6 0x00005e4ee81402a4 clang::CodeGen::CodeGenFunction::EmitPointerWithAlignment(clang::Expr const*, clang::CodeGen::LValueBaseInfo*, clang::CodeGen::TBAAAccessInfo*) (.localalias) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x37952a4)
#7 0x00005e4ee8142c90 clang::CodeGen::CodeGenFunction::EmitArraySubscriptExpr(clang::ArraySubscriptExpr const*, bool) (.localalias) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x3797c90)
#8 0x00005e4ee813de3c clang::CodeGen::CodeGenFunction::EmitLValue(clang::Expr const*) (.localalias) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x3792e3c)
#9 0x00005e4ee81432c7 clang::CodeGen::CodeGenFunction::EmitCheckedLValue(clang::Expr const*, clang::CodeGen::CodeGenFunction::TypeCheckKind) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x37982c7)
#10 0x00005e4ee81895b9 (anonymous namespace)::ScalarExprEmitter::VisitBinAssign(clang::BinaryOperator const*) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x37de5b9)
#11 0x00005e4ee8184134 (anonymous namespace)::ScalarExprEmitter::Visit(clang::Expr*) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x37d9134)
#12 0x00005e4ee8184bb7 clang::CodeGen::CodeGenFunction::EmitScalarExpr(clang::Expr const*, bool) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x37d9bb7)
#13 0x00005e4ee812d557 clang::CodeGen::CodeGenFunction::EmitAnyExpr(clang::Expr const*, clang::CodeGen::AggValueSlot, bool) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x3782557)
#14 0x00005e4ee813e0fe clang::CodeGen::CodeGenFunction::EmitIgnoredExpr(clang::Expr const*) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x37930fe)
#15 0x00005e4ee7e6f872 clang::CodeGen::CodeGenFunction::EmitStmt(clang::Stmt const*, llvm::ArrayRef) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x34c4872)
#16 0x00005e4ee7e6fea2 clang::CodeGen::CodeGenFunction::EmitCompoundStmtWithoutScope(clang::CompoundStmt const&, bool, clang::CodeGen::AggValueSlot) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x34c4ea2)
#17 0x00005e4ee7ec639a clang::CodeGen::CodeGenFunction::EmitFunctionBody(clang::Stmt const*) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x351b39a)
#18 0x00005e4ee7ed19fe clang::CodeGen::CodeGenFunction::GenerateCode(clang::GlobalDecl, llvm::Function*, clang::CodeGen::CGFunctionInfo const&) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x35269fe)
#19 0x00005e4ee7f20517 clang::CodeGen::CodeGenModule::EmitGlobalFunctionDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x3575517)
#20 0x00005e4ee7f1df35 clang::CodeGen::CodeGenModule::EmitGlobalDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x3572f35)
#21 0x00005e4ee7f1e403 clang::CodeGen::CodeGenModule::EmitGlobal(clang::GlobalDecl) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x3573403)
#22 0x00005e4ee7f242e9 clang::CodeGen::CodeGenModule::EmitTopLevelDecl(clang::Decl*) (.part.0) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x35792e9)
#23 0x00005e4ee8b24ee1 (anonymous namespace)::CodeGeneratorImpl::HandleTopLevelDecl(clang::DeclGroupRef) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x4179ee1)
#24 0x00005e4ee8b18afd clang::BackendConsumer::HandleTopLevelDecl(clang::DeclGroupRef) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x416dafd)
#25 0x00005e4ee9a6d2d4 clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x50c22d4)
#26 0x00005e4ee8b22626 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x4177626)
#27 0x00005e4ee847cab1 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x3ad1ab1)
#28 0x00005e4ee8419ebb clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x3a6eebb)
#29 0x00005e4ee854e940 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x3ba3940)
#30 0x00005e4ee59315f1 cc1_main(llvm::ArrayRef, char const*, void*) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0xf865f1)
#31 0x00005e4ee592ebbb ExecuteCC1Tool(llvm::SmallVectorImpl&) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0xf83bbb)
#32 0x00005e4ee82c0299 void llvm::function_ref::callback_fn >, std::__cxx11::basic_string, std::allocator >*, bool*) const::'lambda'()>(long) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x3915299)
#33 0x00005e4ee7aa1847 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x30f6847)
#34 0x00005e4ee82c0d96 clang::driver::CC1Command::Execute(llvm::ArrayRef >, std::__cxx11::basic_string, std::allocator >*, bool*) const (.part.0) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x3915d96)
#35 0x00005e4ee829522c clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&) const (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x38ea22c)
#36 0x00005e4ee8295c49 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl >&) const (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x38eac49)
#37 0x00005e4ee82a1381 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl >&) (/opt/compiler-explorer/clang-12.0.0/bin/clang+0x38f6381)
#38 0x00005e4ee587141a main (/opt/compiler-explorer/clang-12.0.0/bin/clang+0xec641a)
#39 0x0000755b44429d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#40 0x0000755b44429e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#41 0x00005e4ee592e74e _start (/opt/compiler-explorer/clang-12.0.0/bin/clang+0xf8374e)
clang-12: error: clang frontend command failed with exit code 139 (use -v to see invocation)
Compiler returned: 139
```

## Code
```c
struct T {
int a;
int b;
struct U {
int c;
struct V {
int d;
int e[4];
int f;
} v;
} u;
} __attribute__((preserve_access_index));

void func(struct T {
int a;
int b;
struct U {
int c;
struct V {
int d;
int e[4];
int f;
} v;
} u;
} __attribute__((preserve_access_index)) *t) {
t->u.v.e[3] = 0xa1;
t->u.c = t->a + t->b;
}
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the crash with the Compiler Explorer link using Clang 12.0.0 and the C source in the issue. Start with the CodeGen stack entries getNaturalTypeAlignment and EmitArraySubscriptExpr, then trace the preserve_access_index handling for the nested structure access. Done means the reproducer no longer causes SIGSEGV and the behavior is covered by an appropriate regression check.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.