[Clang] Assertion NumElts > 0 failed in FixedVectorType::get due to integer overflow with large vector sizes
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
## Description
A crash occurs in Clang 22 (trunk) when processing a vector with an extremely large size (0x80000001). The primary failure is an assertion trigger in llvm::FixedVectorType::get, followed by a secondary AddressSanitizer: stack-use-after-return crash during the compiler's diagnostic/crash reporting phase.
## Reproduction
Create a file named `repro.cpp`:
```c
#define SIZE 0x80000001
typedef int hugevec __attribute__((__vector_size__ (SIZE * sizeof(int))));
hugevec arr;
int main() {
return arr[1]; // Access index to cause overflow in size calculation
}
```
## Compilation Command
```bash
clang++ -x c++ repro.cpp
```
## The main stack trace
```
clang-22: /workspace/install/llvm/src/llvm-project/llvm/lib/IR/Type.cpp:804: static llvm::FixedVectorType* llvm::FixedVectorType::get(llvm::Type*, unsigned int): Assertion `NumElts > 0 && "#Elements of a VectorType must be greater than 0"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
SUMMARY: AddressSanitizer: stack-use-after-return (/workspace/install/llvm/build_21.1.4/bin/clang-22+0x109ce723) (BuildId: 50dec8884838af90171108e9955bb32c8275f748) in bool llvm::DenseMapBase, std::allocator >, llvm::DenseMapInfo, llvm::detail::DenseMapPair, std::allocator > > >, llvm::StringRef, std::__cxx11::basic_string, std::allocator >, llvm::DenseMapInfo, llvm::detail::DenseMapPair, std::allocator > > >::LookupBucketFor(llvm::StringRef const&, llvm::detail::DenseMapPair, std::allocator > >*&)
Shadow bytes around the buggy address:
0x7f34cbb1ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7f34cbb20000: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7f34cbb20080: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7f34cbb20100: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7f34cbb20180: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
=>0x7f34cbb20200: f5 f5 f5 f5 f5 f5[f5]f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7f34cbb20280: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7f34cbb20300: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7f34cbb20380: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 00 00 00 00
0x7f34cbb20400: f1 f1 f1 f1 f8 f2 f2 f2 f8 f8 f2 f2 00 00 f2 f2
0x7f34cbb20480: 00 00 f2 f2 00 00 f2 f2 00 00 f2 f2 f8 f8 f2 f2
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
```
## The clang version:
```
clang version 22.0.0git
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /workspace/install/llvm/build_21.1.4/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Candidate multilib: .;@m64
Selected multilib: .;@m64
```
## The report link:
[stack-use-after-return.zip](https://github.com/user-attachments/files/26781636/stack-use-after-return.zip)
Contributor guide
Research direction
Start with repro.cpp and run clang++ -x c++ repro.cpp to reproduce the assertion at llvm/lib/IR/Type.cpp:804. Trace the integer-overflow path that reaches llvm::FixedVectorType::get and check the diagnostic/crash-reporting path associated with the reported stack-use-after-return. Done means the reproducer no longer triggers the assertion or sanitizer failure and receives an appropriate compiler diagnostic.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100