llvm / llvm/llvm-project

[Clang] ASan: use-after-poison in clang::Sema during implicit conversion operator handling

Open
#191,687 1 comment 0 reactions 0 assignees View on GitHub
clang:frontend compiler-rt:asan crash-on-invalid
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

## Description

A use-after-poison error was triggered within the Clang compiler (version 22.0.0git) when processing a C++ source file involving an implicit conversion operator that returns a reference to a std::shared_ptr's managed object.

## Reproduction
Create a file named `repro.cpp`:
```c
#include
#include

class A {
public:
std::shared_ptr s;

// Conversion operator returning reference to local object (s), which is shared pointer wrapped.
const std::string& operator const std::string&() const {
return *s; // Dereference the shared_ptr
}
};
```
## Compilation Command
```bash
clang++ -x c++ repro.cpp
```

## The main stack trace
```
SUMMARY: AddressSanitizer: use-after-poison ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 in memcpy
Shadow bytes around the buggy address:
0x5310003f7780: 00 00 00 00 00 00 00 00 00 00 f7 00 00 f7 00 00
0x5310003f7800: 00 f7 00 00 f7 00 00 00 f7 f7 00 00 00 00 00 00
0x5310003f7880: f7 00 00 00 00 f7 00 00 00 00 f7 f7 00 00 00 00
0x5310003f7900: 00 00 f7 00 00 00 f7 f7 00 00 00 00 00 00 f7 f7
0x5310003f7980: 00 00 00 00 00 00 f7 f7 00 00 00 00 00 00 f7 00
=>0x5310003f7a00: 00 00 00 00 00[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x5310003f7a80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x5310003f7b00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x5310003f7b80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x5310003f7c00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x5310003f7c80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
```

## The clang version:
```
clang version 22.0.0git
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /workspace/install/llvm/build_21.1.4/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Candidate multilib: .;@m64
Selected multilib: .;@m64
```

## The report link:
[use-after-poison.zip](https://github.com/user-attachments/files/26654490/use-after-poison.zip)

Contributor guide

Open the contributing guide

Research direction

Start with the attached repro.cpp and compile it with clang++ under AddressSanitizer, then trace the failure into Clang's Sema handling of implicit conversion operators using the reported stack trace. Done means the reproducer no longer reports a use-after-poison failure while preserving the expected diagnostic or compilation behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.