llvm / llvm/llvm-project

[Clang] Crash in ASTContext::getConstantMatrixType when instantiating nested matrix_type templates

Open
#202,744 1 comment 0 reactions 0 assignees View on GitHub
clang:frontend confirmed crash generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

This input is generated by a fuzzer.
https://godbolt.org/z/MGrvY5aMh

seems to be introduced since clang11.

Can be observed on the non-assertion version.

use
```
-fenable-matrix
```

source code:
```cxx
template
using matrix_4_4 = X __attribute__((matrix_type(4, 4)));
template
using matrix_5_5 = Y __attribute__((matrix_type(5, 5)));
void CastDoubleMatrixToIntCStyle() {
matrix_5_5> d;
i = (matrix_5_5)d;
}

```

stacktrace:
```
clang++: /root/llvm-project/llvm/tools/clang/lib/AST/ASTContext.cpp:4843: clang::QualType clang::ASTContext::getConstantMatrixType(clang::QualType, unsigned int, unsigned int) const: Assertion `MatrixType::isValidElementType(ElementTy, getLangOpts()) && "need a valid element type"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics -fenable-matrix
1. :7:3: at annotation token
2. :6:36: parsing function body 'CastDoubleMatrixToIntCStyle'
3. :6:36: in compound statement ('{}')
#0 0x000000000437c168 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x437c168)
#1 0x0000000004378fa4 llvm::sys::RunSignalHandlers() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4378fa4)
#2 0x00000000043795c4 llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x43795c4)
#3 0x00000000042b4af8 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
#4 0x00007e9246045330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#5 0x00007e924609eb2c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c)
#6 0x00007e924604527e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#7 0x00007e92460288ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#8 0x00007e924602881b (/lib/x86_64-linux-gnu/libc.so.6+0x2881b)
#9 0x00007e924603b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#10 0x0000000007bea561 clang::ASTContext::getConstantMatrixType(clang::QualType, unsigned int, unsigned int) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7bea561)
#11 0x000000000779efef clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformType(clang::TypeLocBuilder&, clang::TypeLoc) SemaTemplateInstantiate.cpp:0:0
#12 0x00000000077a2ae7 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformType(clang::TypeSourceInfo*) SemaTemplateInstantiate.cpp:0:0
#13 0x00000000077a2beb clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformType(clang::QualType) SemaTemplateInstantiate.cpp:0:0
#14 0x00000000077a3269 clang::Sema::SubstType(clang::QualType, clang::MultiLevelTemplateArgumentList const&, clang::SourceLocation, clang::DeclarationName, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x77a3269)
#15 0x00000000076789b6 clang::Sema::CheckTemplateIdType(clang::ElaboratedTypeKeyword, clang::TemplateName, clang::SourceLocation, clang::TemplateArgumentListInfo&, clang::Scope*, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x76789b6)
#16 0x000000000767b731 clang::Sema::ActOnTemplateIdType(clang::Scope*, clang::ElaboratedTypeKeyword, clang::SourceLocation, clang::CXXScopeSpec&, clang::SourceLocation, clang::OpaquePtr, clang::IdentifierInfo const*, clang::SourceLocation, clang::SourceLocation, llvm::MutableArrayRef, clang::SourceLocation, bool, bool, clang::ImplicitTypenameContext) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x767b731)
#17 0x0000000006d51082 clang::Parser::AnnotateTemplateIdTokenAsType(clang::CXXScopeSpec&, clang::ImplicitTypenameContext, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d51082)
#18 0x0000000006c3c590 clang::Parser::TryAnnotateTypeOrScopeTokenAfterScopeSpec(clang::CXXScopeSpec&, bool, clang::ImplicitTypenameContext) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c3c590)
#19 0x0000000006c3c968 clang::Parser::TryAnnotateName(clang::CorrectionCandidateCallback*, clang::ImplicitTypenameContext) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c3c968)
#20 0x0000000006d3c69d clang::Parser::ParseStatementOrDeclarationAfterAttributes(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::ParsedAttributes&, clang::ParsedAttributes&, clang::LabelDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d3c69d)
#21 0x0000000006d3d749 clang::Parser::ParseStatementOrDeclaration(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::LabelDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d3d749)
#22 0x0000000006d45f6e clang::Parser::ParseCompoundStatementBody(bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d45f6e)
#23 0x0000000006d4678a clang::Parser::ParseFunctionStatementBody(clang::Decl*, clang::Parser::ParseScope&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d4678a)
#24 0x0000000006c4a603 clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::LateParsedAttrList*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c4a603)
#25 0x0000000006c81913 clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c81913)
#26 0x0000000006c3db4b clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c3db4b)
#27 0x0000000006c3e34f clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c3e34f)
#28 0x0000000006c45e11 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c45e11)
#29 0x0000000006c46d45 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c46d45)
#30 0x0000000006c27bfa clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c27bfa)
#31 0x0000000004e6ab58 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4e6ab58)
#32 0x00000000051a1688 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x51a1688)
#33 0x000000000511e8cd clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x511e8cd)
#34 0x00000000052a179d clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x52a179d)
#35 0x0000000000e214ff cc1_main(llvm::ArrayRef, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xe214ff)
#36 0x0000000000e17eba ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#37 0x0000000000e1803d int llvm::function_ref&)>::callback_fn&)>(long, llvm::SmallVectorImpl&) driver.cpp:0:0
#38 0x0000000004edd539 void llvm::function_ref::callback_fn>, std::__cxx11::basic_string, std::allocator>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#39 0x00000000042b4f34 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x42b4f34)
#40 0x0000000004eddb86 clang::driver::CC1Command::Execute(llvm::ArrayRef>, std::__cxx11::basic_string, std::allocator>*, bool*) const (.part.0) Job.cpp:0:0
#41 0x0000000004e9a062 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4e9a062)
#42 0x0000000004e9b00e clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4e9b00e)
#43 0x0000000004ea3215 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4ea3215)
#44 0x0000000000e1d8ec clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xe1d8ec)
#45 0x0000000000cc173a main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xcc173a)
#46 0x00007e924602a1ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#47 0x00007e924602a28b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#48 0x0000000000e17955 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xe17955)
clang++: error: clang frontend command failed due to signal (use -v to see invocation)
Compiler returned: 134
```

Contributor guide

Open the contributing guide

Research direction

Start with ASTContext::getConstantMatrixType in clang/lib/AST/ASTContext.cpp and the template-instantiation path in SemaTemplateInstantiate.cpp. Reproduce the nested matrix_type case with -fenable-matrix using the supplied source, then trace why instantiation passes an invalid element type. Done means the reproducer no longer triggers the assertion or crashes.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.