llvm / llvm/llvm-project

[Clang] Assertion NumElts > 0 failed in FixedVectorType::get due to integer overflow with large vector sizes

Open
#192,431 1 comment 0 reactions 0 assignees View on GitHub
backend:X86 crash-on-valid llvm:vectorcombine
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

## Description
A crash occurs in Clang 22 (trunk) when processing a vector with an extremely large size (0x80000001). The primary failure is an assertion trigger in llvm::FixedVectorType::get, followed by a secondary AddressSanitizer: stack-use-after-return crash during the compiler's diagnostic/crash reporting phase.

## Reproduction
Create a file named `repro.cpp`:
```c
#define SIZE 0x80000001

typedef int hugevec __attribute__((__vector_size__ (SIZE * sizeof(int))));

hugevec arr;

int main() {
return arr[1]; // Access index to cause overflow in size calculation
}
```
## Compilation Command
```bash
clang++ -x c++ repro.cpp
```

## The main stack trace
```
clang-22: /workspace/install/llvm/src/llvm-project/llvm/lib/IR/Type.cpp:804: static llvm::FixedVectorType* llvm::FixedVectorType::get(llvm::Type*, unsigned int): Assertion `NumElts > 0 && "#Elements of a VectorType must be greater than 0"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
SUMMARY: AddressSanitizer: stack-use-after-return (/workspace/install/llvm/build_21.1.4/bin/clang-22+0x109ce723) (BuildId: 50dec8884838af90171108e9955bb32c8275f748) in bool llvm::DenseMapBase, std::allocator >, llvm::DenseMapInfo, llvm::detail::DenseMapPair, std::allocator > > >, llvm::StringRef, std::__cxx11::basic_string, std::allocator >, llvm::DenseMapInfo, llvm::detail::DenseMapPair, std::allocator > > >::LookupBucketFor(llvm::StringRef const&, llvm::detail::DenseMapPair, std::allocator > >*&)
Shadow bytes around the buggy address:
0x7f34cbb1ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7f34cbb20000: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7f34cbb20080: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7f34cbb20100: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7f34cbb20180: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
=>0x7f34cbb20200: f5 f5 f5 f5 f5 f5[f5]f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7f34cbb20280: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7f34cbb20300: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7f34cbb20380: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 00 00 00 00
0x7f34cbb20400: f1 f1 f1 f1 f8 f2 f2 f2 f8 f8 f2 f2 00 00 f2 f2
0x7f34cbb20480: 00 00 f2 f2 00 00 f2 f2 00 00 f2 f2 f8 f8 f2 f2
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
```

## The clang version:
```
clang version 22.0.0git
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /workspace/install/llvm/build_21.1.4/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Candidate multilib: .;@m64
Selected multilib: .;@m64
```

## The report link:
[stack-use-after-return.zip](https://github.com/user-attachments/files/26781636/stack-use-after-return.zip)

Contributor guide

Open the contributing guide

Research direction

Start with repro.cpp and run clang++ -x c++ repro.cpp to reproduce the assertion at llvm/lib/IR/Type.cpp:804. Trace the integer-overflow path that reaches llvm::FixedVectorType::get and check the diagnostic/crash-reporting path associated with the reported stack-use-after-return. Done means the reproducer no longer triggers the assertion or sanitizer failure and receives an appropriate compiler diagnostic.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.