llvm / llvm/llvm-project

[BUG] ICE in clang::CodeGen::CodeGenFunction::EmitAsmStmt(clang::AsmStmt const&)

Open
#204,741 0 comments 0 reactions 0 assignees View on GitHub
crash generated by fuzzer inline-asm
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

## Bug Report: ICE in clang::CodeGen::CodeGenFunction::EmitAsmStmt(clang::AsmStmt const&)

Clang crashes when compiling the following C code.

**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend

This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).

## Reduced Test Case

> Minimized from the original fuzzer-generated input using `creduce`.

```sh
clang -O0 test.c -o /dev/null
```

```c
typedef struct {
} myjmp_buf;
typedef struct {
myjmp_buf regs;
} my_stack;
void switch_to_stack (my_stack *stack){
asm volatile (
"movq %0, %%r11; movq $20216, %%rcx\n"
"lfence\n"
"syscall;\n"
"\n"
: "+r" (stack->regs)
);
}
```

## Crash Output

```
/root/outputs/experiments-on-metamut/surfuzz,gcc,3/BDiklssbvzuL_surfuzz_29.c:12:24: error: output size should not be zero
12 | : "+r" (stack->regs)
| ^
Failure value returned from cantFail wrapped call
inline asm with one output cannot return struct
UNREACHABLE executed at /root/compilers/llvm-project-release/llvm/include/llvm/Support/Error.h:779!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name BDiklssbvzuL_surfuzz_29.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/BDiklssbvzuL_surfuzz_29-8b8506.o -x c /root/outputs/experiments-on-metamut/surfuzz,gcc,3/BDiklssbvzuL_surfuzz_29.c
1\. parser at end of file
2\. /root/outputs/experiments-on-metamut/surfuzz,gcc,3/BDiklssbvzuL_surfuzz_29.c:6:6: LLVM IR generation of declaration 'switch_to_stack'
3\. /root/outputs/experiments-on-metamut/surfuzz,gcc,3/BDiklssbvzuL_surfuzz_29.c:6:6: Generating code for declaration 'switch_to_stack'
#0 0x00005569478f82d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x00005569478f4caf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x00005569478f4dfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f3c482d6520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007f3c4832aa7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007f3c4832aa7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007f3c4832aa7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007f3c482d6476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007f3c482bc7f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x0000556947836b5e (/root/objects/llvm-project-release.obj/bin/clang-22+0x4434b5e)
#10 0x0000556947162088 llvm::InlineAsm::InlineAsm(llvm::FunctionType*, std::__cxx11::basic_string, std::allocator > const&, std::__cxx11::basic_string, std::allocator > const&, bool, bool, llvm::InlineAsm::AsmDialect, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x3d60088)
#11 0x0000556947162459 llvm::ConstantUniqueMap::getOrCreate(llvm::PointerType*, llvm::InlineAsmKeyType) (/root/objects/llvm-project-release.obj/bin/clang-22+0x3d60459)
#12 0x00005569471631eb llvm::InlineAsm::get(llvm::FunctionType*, llvm::StringRef, llvm::StringRef, bool, bool, llvm::InlineAsm::AsmDialect, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x3d611eb)
#13 0x0000556947dfd5fc clang::CodeGen::CodeGenFunction::EmitAsmStmt(clang::AsmStmt const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x49fb5fc)
#14 0x0000556947e0978b clang::CodeGen::CodeGenFunction::EmitCompoundStmtWithoutScope(clang::CompoundStmt const&, bool, clang::CodeGen::AggValueSlot) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a0778b)
#15 0x0000556947e719e3 clang::CodeGen::CodeGenFunction::EmitFunctionBody(clang::Stmt const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a6f9e3)
#16 0x0000556947e86e84 clang::CodeGen::CodeGenFunction::GenerateCode(clang::GlobalDecl, llvm::Function*, clang::CodeGen::CGFunctionInfo const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a84e84)
#17 0x0000556947eeaf0d clang::CodeGen::CodeGenModule::EmitGlobalFunctionDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae8f0d)
#18 0x0000556947ee5ef5 clang::CodeGen::CodeGenModule::EmitGlobalDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae3ef5)
#19 0x0000556947ee6b83 clang::CodeGen::CodeGenModule::EmitGlobal(clang::GlobalDecl) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae4b83)
#20 0x0000556947ef0807 clang::CodeGen::CodeGenModule::EmitTopLevelDecl(clang::Decl*) (.part.0) CodeGenModule.cpp:0:0
#21 0x000055694826cd71 (anonymous namespace)::CodeGeneratorImpl::HandleTopLevelDecl(clang::DeclGroupRef) ModuleBuilder.cpp:0:0
#22 0x000055694825dcc1 clang::BackendConsumer::HandleTopLevelDecl(clang::DeclGroupRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4e5bcc1)
#23 0x000055694a109874 clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d07874)
#24 0x0000556948581987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#25 0x00005569485090e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#26 0x000055694867e95e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#27 0x0000556944389657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#28 0x000055694437e694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#29 0x0000556944383907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#30 0x00005569442410ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#31 0x00007f3c482bdd90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#32 0x00007f3c482bde40 call_init ./csu/../csu/libc-start.c:128:20
#33 0x00007f3c482bde40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#34 0x000055694437dcb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/BDiklssbvzuL_surfuzz_29-c933c0.c
clang: note: diagnostic msg: /tmp/BDiklssbvzuL_surfuzz_29-c933c0.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```

## Preprocessed Source & Run Script

**Preprocessed source** (`/tmp/BDiklssbvzuL_surfuzz_29-c933c0.c`):

```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,gcc,3/BDiklssbvzuL_surfuzz_29.c"
typedef struct {
} myjmp_buf;
typedef struct {
myjmp_buf regs;
} my_stack;
void switch_to_stack (my_stack *stack){
asm volatile (
"movq %0, %%r11; movq $20216, %%rcx\n"
"lfence\n"
"syscall;\n"
"\n"
: "+r" (stack->regs)
);
}

```

**Run script** (`/tmp/BDiklssbvzuL_surfuzz_29-c933c0.sh`):

```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,gcc,3/BDiklssbvzuL_surfuzz_29.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "BDiklssbvzuL_surfuzz_29.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/BDiklssbvzuL_surfuzz_29-8b8506.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,gcc,3/BDiklssbvzuL_surfuzz_29.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "BDiklssbvzuL_surfuzz_29.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "BDiklssbvzuL_surfuzz_29-c933c0.c"

```

* found via a fuzzer

[BDiklssbvzuL_surfuzz_29-c933c0.c](https://github.com/user-attachments/files/29127577/BDiklssbvzuL_surfuzz_29-c933c0.c)
[BDiklssbvzuL_surfuzz_29-c933c0.sh](https://github.com/user-attachments/files/29127578/BDiklssbvzuL_surfuzz_29-c933c0.sh)

Contributor guide

Open the contributing guide

Research direction

Start by running the provided clang -O0 command with the reduced C source and inspect CodeGenFunction::EmitAsmStmt, the stack-trace entry point named in the report. Compare the inline-assembly handling of the zero-sized struct operand and add a regression test based on the reproducer. Done means clang reports the invalid input without aborting or reaching the LLVM assertion.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.