llvm / llvm/llvm-project

clang trunk: assertion "getType() == Other.getType()" in TypeLoc::initializeFullCopy during parsing of malformed nested unary/alignof/sizeof in array subscript

Open
#173,886 1 comment 0 reactions 0 assignees View on GitHub
clang:frontend crash generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

## Compiler Explorer: https://godbolt.org/z/j3Eq7Yqsb

- clang start crashing on `Trunk`
- generated by fuzzer

## Console
```console
clang: /root/llvm-project/llvm/tools/clang/include/clang/AST/TypeLoc.h:218: void clang::TypeLoc::initializeFullCopy(clang::TypeLoc): Assertion `getType() == Other.getType()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics
1. :9:75: current parser token '&='
2. :3:12: parsing function body 'main'
3. :3:12: in compound statement ('{}')
4. :5:29: in compound statement ('{}')
#0 0x0000000004301458 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4301458)
#1 0x00000000042fe884 llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x42fe884)
#2 0x0000000004243628 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
#3 0x0000770458e42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x0000770458e969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
#5 0x0000770458e42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
#6 0x0000770458e287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
#7 0x0000770458e2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
#8 0x0000770458e39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#9 0x000000000769deb3 (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x769deb3)
#10 0x000000000769d2e2 clang::TypeLocVisitor<(anonymous namespace)::TypeSpecLocFiller, void>::Visit(clang::UnqualTypeLoc) SemaType.cpp:0:0
#11 0x00000000076a4433 GetFullTypeForDeclarator((anonymous namespace)::TypeProcessingState&, clang::QualType, clang::TypeSourceInfo*) SemaType.cpp:0:0
#12 0x00000000076a52ef clang::Sema::GetTypeForDeclarator(clang::Declarator&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x76a52ef)
#13 0x00000000076a562e clang::Sema::ActOnTypeName(clang::Declarator&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x76a562e)
#14 0x0000000006ab8dc5 clang::Parser::ParseParenExpression(clang::ParenParseOption&, bool, clang::ParenExprKind, clang::TypoCorrectionTypeBehavior, clang::OpaquePtr&, clang::SourceLocation&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6ab8dc5)
#15 0x0000000006ab971e clang::Parser::ParseExprAfterUnaryExprOrTypeTrait(clang::Token const&, bool&, clang::OpaquePtr&, clang::SourceRange&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6ab971e)
#16 0x0000000006ab9b51 clang::Parser::ParseUnaryExprOrTypeTraitExpression() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6ab9b51)
#17 0x0000000006aadda2 clang::Parser::ParseCastExpression(clang::CastParseKind, bool, bool&, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6aadda2)
#18 0x0000000006aae211 clang::Parser::ParseCastExpression(clang::CastParseKind, bool, bool&, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6aae211)
#19 0x0000000006aafd37 clang::Parser::ParseCastExpression(clang::CastParseKind, bool, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6aafd37)
#20 0x0000000006ab9380 clang::Parser::ParseExprAfterUnaryExprOrTypeTrait(clang::Token const&, bool&, clang::OpaquePtr&, clang::SourceRange&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6ab9380)
#21 0x0000000006ab9b51 clang::Parser::ParseUnaryExprOrTypeTraitExpression() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6ab9b51)
#22 0x0000000006aadda2 clang::Parser::ParseCastExpression(clang::CastParseKind, bool, bool&, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6aadda2)
#23 0x0000000006aae211 clang::Parser::ParseCastExpression(clang::CastParseKind, bool, bool&, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6aae211)
#24 0x0000000006aafd37 clang::Parser::ParseCastExpression(clang::CastParseKind, bool, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6aafd37)
#25 0x0000000006ab9380 clang::Parser::ParseExprAfterUnaryExprOrTypeTrait(clang::Token const&, bool&, clang::OpaquePtr&, clang::SourceRange&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6ab9380)
#26 0x0000000006ab9b51 clang::Parser::ParseUnaryExprOrTypeTraitExpression() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6ab9b51)
#27 0x0000000006aadda2 clang::Parser::ParseCastExpression(clang::CastParseKind, bool, bool&, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6aadda2)
#28 0x0000000006aafd37 clang::Parser::ParseCastExpression(clang::CastParseKind, bool, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6aafd37)
#29 0x0000000006ab0e06 clang::Parser::ParseRHSOfBinaryExpression(clang::ActionResult, clang::prec::Level) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6ab0e06)
#30 0x0000000006ab43a9 clang::Parser::ParseExpression(clang::TypoCorrectionTypeBehavior) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6ab43a9)
#31 0x0000000006ab4b43 clang::Parser::ParsePostfixExpressionSuffix(clang::ActionResult) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6ab4b43)
#32 0x0000000006aadada clang::Parser::ParseCastExpression(clang::CastParseKind, bool, bool&, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6aadada)
#33 0x0000000006aafd37 clang::Parser::ParseCastExpression(clang::CastParseKind, bool, clang::TypoCorrectionTypeBehavior, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6aafd37)
#34 0x0000000006aafdc9 clang::Parser::ParseAssignmentExpression(clang::TypoCorrectionTypeBehavior) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6aafdc9)
#35 0x0000000006ab43a9 clang::Parser::ParseExpression(clang::TypoCorrectionTypeBehavior) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6ab43a9)
#36 0x0000000006b2e1f6 clang::Parser::ParseParenExprOrCondition(clang::ActionResult*, clang::Sema::ConditionResult&, clang::SourceLocation, clang::Sema::ConditionKind, clang::SourceLocation&, clang::SourceLocation&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b2e1f6)
#37 0x0000000006b330b6 clang::Parser::ParseIfStatement(clang::SourceLocation*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b330b6)
#38 0x0000000006b30bfd clang::Parser::ParseStatementOrDeclarationAfterAttributes(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::ParsedAttributes&, clang::ParsedAttributes&, clang::LabelDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b30bfd)
#39 0x0000000006b31af6 clang::Parser::ParseStatementOrDeclaration(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::LabelDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b31af6)
#40 0x0000000006b3a43e clang::Parser::ParseCompoundStatementBody(bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b3a43e)
#41 0x0000000006b3abb4 void llvm::function_ref::callback_fn(long) ParseStmt.cpp:0:0
#42 0x000000000850d501 clang::StackExhaustionHandler::runWithSufficientStackSpace(clang::SourceLocation, llvm::function_ref) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x850d501)
#43 0x0000000006b2b615 clang::Parser::ParseCompoundStatement(bool, unsigned int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b2b615)
#44 0x0000000006b30237 clang::Parser::ParseStatementOrDeclarationAfterAttributes(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::ParsedAttributes&, clang::ParsedAttributes&, clang::LabelDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b30237)
#45 0x0000000006b31af6 clang::Parser::ParseStatementOrDeclaration(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::LabelDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b31af6)
#46 0x0000000006b32afb clang::Parser::ParseStatement(clang::SourceLocation*, clang::Parser::ParsedStmtContext, clang::LabelDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b32afb)
#47 0x0000000006b33e3f clang::Parser::ParseForStatement(clang::SourceLocation*, clang::LabelDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b33e3f)
#48 0x0000000006b30c32 clang::Parser::ParseStatementOrDeclarationAfterAttributes(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::ParsedAttributes&, clang::ParsedAttributes&, clang::LabelDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b30c32)
#49 0x0000000006b31af6 clang::Parser::ParseStatementOrDeclaration(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::LabelDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b31af6)
#50 0x0000000006b3a43e clang::Parser::ParseCompoundStatementBody(bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b3a43e)
#51 0x0000000006b3ac8a clang::Parser::ParseFunctionStatementBody(clang::Decl*, clang::Parser::ParseScope&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6b3ac8a)
#52 0x0000000006a40beb clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::LateParsedAttrList*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6a40beb)
#53 0x0000000006a770ad clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6a770ad)
#54 0x0000000006a33d4b clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6a33d4b)
#55 0x0000000006a3453f clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6a3453f)
#56 0x0000000006a3c36a clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6a3c36a)
#57 0x0000000006a3d305 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6a3d305)
#58 0x0000000006a1e38a clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x6a1e38a)
#59 0x0000000004c62788 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4c62788)
#60 0x0000000004f58e05 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4f58e05)
#61 0x0000000004ed909e clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4ed909e)
#62 0x000000000505318d clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x505318d)
#63 0x0000000000de63ec cc1_main(llvm::ArrayRef, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xde63ec)
#64 0x0000000000ddce3a ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#65 0x0000000000ddcfbd int llvm::function_ref&)>::callback_fn&)>(long, llvm::SmallVectorImpl&) driver.cpp:0:0
#66 0x0000000004cd4e59 void llvm::function_ref::callback_fn>, std::__cxx11::basic_string, std::allocator>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#67 0x0000000004243ac4 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4243ac4)
#68 0x0000000004cd546f clang::driver::CC1Command::Execute(llvm::ArrayRef>, std::__cxx11::basic_string, std::allocator>*, bool*) const (.part.0) Job.cpp:0:0
#69 0x0000000004c95f52 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4c95f52)
#70 0x0000000004c96efe clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4c96efe)
#71 0x0000000004c9e355 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4c9e355)
#72 0x0000000000de27e1 clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xde27e1)
#73 0x0000000000c8d114 main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xc8d114)
#74 0x0000770458e29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#75 0x0000770458e29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#76 0x0000000000ddc8d5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xddc8d5)
clang: error: clang frontend command failed with exit code 134 (use -v to see invocation)
Compiler returned: 134
```

## Code
```c
int a[100];
void foo(int);
int main() {
int i;
for (i = 0; i < 100; i++) {
if (a
[__alignof__(sizeof sizeof 0x0UL --) /=
sizeof --sizeof --__alignof__(
_Atomic(void) __attribute__(()) _Atomic double unsigned) &=
--sizeof sizeof -- -- --++ ++&&conn_hndl &=
__extension__(char) __extension__(_Nonnull)(_Nullable) __extension__(
]
)
}
```

Contributor guide

Open the contributing guide

Research direction

Start with the Compiler Explorer reproducer and the assertion in llvm/tools/clang/include/clang/AST/TypeLoc.h:218. Trace the malformed nested unary, alignof, and sizeof path through SemaType.cpp and ParseUnaryExprOrTypeTraitExpression. Done means the reproducer no longer triggers the assertion and regression coverage protects the parsing behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.