[Clang] ASan: use-after-poison in clang::Sema during implicit conversion operator handling
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
## Description
A use-after-poison error was triggered within the Clang compiler (version 22.0.0git) when processing a C++ source file involving an implicit conversion operator that returns a reference to a std::shared_ptr's managed object.
## Reproduction
Create a file named `repro.cpp`:
```c
#include
#include
class A {
public:
std::shared_ptr s;
// Conversion operator returning reference to local object (s), which is shared pointer wrapped.
const std::string& operator const std::string&() const {
return *s; // Dereference the shared_ptr
}
};
```
## Compilation Command
```bash
clang++ -x c++ repro.cpp
```
## The main stack trace
```
SUMMARY: AddressSanitizer: use-after-poison ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 in memcpy
Shadow bytes around the buggy address:
0x5310003f7780: 00 00 00 00 00 00 00 00 00 00 f7 00 00 f7 00 00
0x5310003f7800: 00 f7 00 00 f7 00 00 00 f7 f7 00 00 00 00 00 00
0x5310003f7880: f7 00 00 00 00 f7 00 00 00 00 f7 f7 00 00 00 00
0x5310003f7900: 00 00 f7 00 00 00 f7 f7 00 00 00 00 00 00 f7 f7
0x5310003f7980: 00 00 00 00 00 00 f7 f7 00 00 00 00 00 00 f7 00
=>0x5310003f7a00: 00 00 00 00 00[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x5310003f7a80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x5310003f7b00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x5310003f7b80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x5310003f7c00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x5310003f7c80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
```
## The clang version:
```
clang version 22.0.0git
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /workspace/install/llvm/build_21.1.4/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Candidate multilib: .;@m64
Selected multilib: .;@m64
```
## The report link:
[use-after-poison.zip](https://github.com/user-attachments/files/26654490/use-after-poison.zip)
Contributor guide
Research direction
Start with the attached repro.cpp and compile it with clang++ under AddressSanitizer, then trace the failure into Clang's Sema handling of implicit conversion operators using the reported stack trace. Done means the reproducer no longer reports a use-after-poison failure while preserving the expected diagnostic or compilation behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100