llvm / llvm/llvm-project

[clang] C++ ext_vector_type + builtin_masked_load triggers getExtVectorType assertion

Open
#202,130 2 comments 0 reactions 0 assignees View on GitHub
clang:frontend confirmed crash generated by fuzzer regression:22
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

This input is generated by a fuzzer.

```c++
using v8i = int [[clang::ext_vector_type(8)]];
using v8b = bool [[clang::ext_vector_type(8)]];

template
static void load(v8b mask, V value, const T *ptr) {
(void)__builtin_masked_load(mask, ptr, value);
}

void f(v8b mask, v8i value, int *ptr) {
load(mask, value, &ptr);
}
```

https://godbolt.org/z/z79b3jcrf
This crash seems to be introduced since clang.22.1.0 .
This input is generated by a fuzzer.
Looks like https://github.com/llvm/llvm-project/issues/130470, but that one is triggered in C language, this one is in C++.

It cannot be triggered on the plain version, only on assert version can be triggered.

stacktrace:
```
clang++: /root/llvm-project/clang/lib/AST/ASTContext.cpp:4638: clang::QualType clang::ASTContext::getExtVectorType(clang::QualType, unsigned int) const: Assertion `vecType->isBuiltinType() || vecType->isDependentType() || (vecType->isBitIntType() && llvm::isPowerOf2_32(vecType->castAs()->getNumBits()))' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-assertions-22.1.0/bin/clang++ -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-15.2.0 -fcolor-diagnostics -fno-crash-diagnostics
1. parser at end of file
2. :5:15: instantiating function definition 'load'
#0 0x0000000004281028 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x4281028)
#1 0x000000000427e464 llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x427e464)
#2 0x00000000041c0d58 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
#3 0x000077e6bd045330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x000077e6bd09eb2c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c)
#5 0x000077e6bd04527e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#6 0x000077e6bd0288ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#7 0x000077e6bd02881b (/lib/x86_64-linux-gnu/libc.so.6+0x2881b)
#8 0x000077e6bd03b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#9 0x00000000078e5b22 clang::ASTContext::getExtVectorType(clang::QualType, unsigned int) const (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x78e5b22)
#10 0x0000000006c239a5 clang::Sema::CheckBuiltinFunctionCall(clang::FunctionDecl*, unsigned int, clang::CallExpr*) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x6c239a5)
#11 0x0000000006f2cbb1 clang::Sema::BuildResolvedCallExpr(clang::Expr*, clang::NamedDecl*, clang::SourceLocation, llvm::ArrayRef, clang::SourceLocation, clang::Expr*, bool, clang::CallExpr::ADLCallKind) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x6f2cbb1)
#12 0x0000000006f2795a clang::Sema::BuildCallExpr(clang::Scope*, clang::Expr*, clang::SourceLocation, llvm::MutableArrayRef, clang::SourceLocation, clang::Expr*, bool, bool) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x6f2795a)
#13 0x0000000006f2d8bc clang::Sema::ActOnCallExpr(clang::Scope*, clang::Expr*, clang::SourceLocation, llvm::MutableArrayRef, clang::SourceLocation, clang::Expr*) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x6f2d8bc)
#14 0x000000000750f663 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformCallExpr(clang::CallExpr*) SemaTemplateInstantiate.cpp:0:0
#15 0x00000000074ec4a8 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformExpr(clang::Expr*) SemaTemplateInstantiate.cpp:0:0
#16 0x00000000074fd7c2 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformCStyleCastExpr(clang::CStyleCastExpr*) SemaTemplateInstantiate.cpp:0:0
#17 0x00000000074ec4bc clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformExpr(clang::Expr*) SemaTemplateInstantiate.cpp:0:0
#18 0x0000000007529617 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformStmt(clang::Stmt*, clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::StmtDiscardKind) SemaTemplateInstantiate.cpp:0:0
#19 0x0000000007529cc5 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformCompoundStmt(clang::CompoundStmt*, bool) SemaTemplateInstantiate.cpp:0:0
#20 0x0000000007532e44 clang::Sema::SubstStmt(clang::Stmt*, clang::MultiLevelTemplateArgumentList const&) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x7532e44)
#21 0x00000000075cee10 clang::Sema::InstantiateFunctionDefinition(clang::SourceLocation, clang::FunctionDecl*, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x75cee10)
#22 0x00000000075cc9d6 clang::Sema::PerformPendingInstantiations(bool, bool) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x75cc9d6)
#23 0x0000000006b4bf52 clang::Sema::ActOnEndOfTranslationUnitFragment(clang::TUFragmentKind) (.part.0) Sema.cpp:0:0
#24 0x0000000006b4c2d2 clang::Sema::ActOnEndOfTranslationUnit() (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x6b4c2d2)
#25 0x00000000069b70d5 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x69b70d5)
#26 0x000000000699808a clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x699808a)
#27 0x0000000004be6888 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x4be6888)
#28 0x0000000004edfeb5 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x4edfeb5)
#29 0x0000000004e5fc8e clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x4e5fc8e)
#30 0x0000000004fda60d clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x4fda60d)
#31 0x0000000000dcffde cc1_main(llvm::ArrayRef, char const*, void*) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0xdcffde)
#32 0x0000000000dc69ca ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#33 0x0000000000dc6b4d int llvm::function_ref&)>::callback_fn&)>(long, llvm::SmallVectorImpl&) driver.cpp:0:0
#34 0x0000000004c59bf9 void llvm::function_ref::callback_fn>, std::__cxx11::basic_string, std::allocator>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#35 0x00000000041c11f4 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x41c11f4)
#36 0x0000000004c5a20f clang::driver::CC1Command::Execute(llvm::ArrayRef>, std::__cxx11::basic_string, std::allocator>*, bool*) const (.part.0) Job.cpp:0:0
#37 0x0000000004c1aba2 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x4c1aba2)
#38 0x0000000004c1bb4e clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x4c1bb4e)
#39 0x0000000004c22fa5 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0x4c22fa5)
#40 0x0000000000dcc371 clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0xdcc371)
#41 0x0000000000c89a84 main (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0xc89a84)
#42 0x000077e6bd02a1ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#43 0x000077e6bd02a28b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#44 0x0000000000dc6465 _start (/opt/compiler-explorer/clang-assertions-22.1.0/bin/clang+++0xdc6465)
clang++: error: clang frontend command failed with exit code 134 (use -v to see invocation)
Compiler returned: 134
```

Contributor guide

Open the contributing guide

Research direction

Start by compiling the supplied C++ reproducer with an assertion-enabled Clang, then inspect clang/lib/AST/ASTContext.cpp around getExtVectorType and the Sema::CheckBuiltinFunctionCall path shown in the stack trace. Done means the reproducer no longer triggers the assertion and a regression test covers this template-instantiation case.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.