[BUG] ICE in Evaluate(clang::APValue&, (anonymous namespace)::EvalInfo&, clang::Expr const*)
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
## Bug Report: ICE in Evaluate(clang::APValue&, (anonymous namespace)::EvalInfo&, clang::Expr const*)
Clang crashes when compiling the following C code.
**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend
This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).
## Reduced Test Case
> Minimized from the original fuzzer-generated input using `creduce`.
```sh
clang -O0 test.c -o /dev/null
```
```c
a = __atomic_always_lock_free(0, 0)
```
## Crash Output
```
clang-22: /root/compilers/llvm-project-release/llvm/include/llvm/Support/Alignment.h:69: llvm::Align::Align(uint64_t): Assertion \`Value > 0 && "Value must not be 0"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name lGmJWrkFaQkE_surfuzz_28.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/lGmJWrkFaQkE_surfuzz_28-b7c172.o -x c /root/outputs/experiments-on-metamut/surfuzz,gcc,2/lGmJWrkFaQkE_surfuzz_28.c
1\. /root/outputs/experiments-on-metamut/surfuzz,gcc,2/lGmJWrkFaQkE_surfuzz_28.c:28:3: current parser token 'if'
2\. /root/outputs/experiments-on-metamut/surfuzz,gcc,2/lGmJWrkFaQkE_surfuzz_28.c:5:1: parsing function body 'main'
3\. /root/outputs/experiments-on-metamut/surfuzz,gcc,2/lGmJWrkFaQkE_surfuzz_28.c:5:1: in compound statement ('{}')
#0 0x000055c03af982d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x000055c03af94caf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x000055c03af94dfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f4ea0ee9520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007f4ea0f3da7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007f4ea0f3da7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007f4ea0f3da7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007f4ea0ee9476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007f4ea0ecf7f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007f4ea0ecf71b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007f4ea0ee0e96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x000055c037a92766 (/root/objects/llvm-project-release.obj/bin/clang-22+0xff0766)
#12 0x000055c03eb05ed3 (anonymous namespace)::IntExprEvaluator::VisitBuiltinCallExpr(clang::CallExpr const*, unsigned int) ExprConstant.cpp:0:0
#13 0x000055c03eb177e0 Evaluate(clang::APValue&, (anonymous namespace)::EvalInfo&, clang::Expr const*) ExprConstant.cpp:0:0
#14 0x000055c03eb181b1 EvaluateAsRValue((anonymous namespace)::EvalInfo&, clang::Expr const*, clang::APValue&) ExprConstant.cpp:0:0
#15 0x000055c03eb20377 clang::Expr::EvaluateAsRValue(clang::Expr::EvalResult&, clang::ASTContext const&, bool) const (/root/objects/llvm-project-release.obj/bin/clang-22+0x807e377)
#16 0x000055c03d9e6244 TryGetExprRange(clang::ASTContext&, clang::Expr const*, unsigned int, bool, bool) SemaChecking.cpp:0:0
#17 0x000055c03da2fd6d clang::Sema::CheckImplicitConversion(clang::Expr*, clang::QualType, clang::SourceLocation, bool*, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6f8dd6d)
#18 0x000055c03da332a9 AnalyzeImplicitConversions(clang::Sema&, clang::Expr*, clang::SourceLocation, bool) (.constprop.0) SemaChecking.cpp:0:0
#19 0x000055c03da3461a AnalyzeImplicitConversions(clang::Sema&, clang::Expr*, clang::SourceLocation, bool) (.constprop.0) SemaChecking.cpp:0:0
#20 0x000055c03da3546d clang::Sema::CheckCompletedExpr(clang::Expr*, clang::SourceLocation, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6f9346d)
#21 0x000055c03ddde20e clang::Sema::ActOnFinishFullExpr(clang::Expr*, clang::SourceLocation, bool, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x733c20e)
#22 0x000055c03e10ff0f clang::Sema::ActOnExprStmt(clang::ActionResult, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x766df0f)
#23 0x000055c03d8bfb84 clang::Parser::ParseExprStatement(clang::Parser::ParsedStmtContext) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e1db84)
#24 0x000055c03d8b8d80 clang::Parser::ParseStatementOrDeclarationAfterAttributes(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::ParsedAttributes&, clang::ParsedAttributes&, clang::LabelDecl*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e16d80)
#25 0x000055c03d8b9703 clang::Parser::ParseStatementOrDeclaration(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::LabelDecl*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e17703)
#26 0x000055c03d8c0361 clang::Parser::ParseCompoundStatementBody(bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e1e361)
#27 0x000055c03d8c0b3f clang::Parser::ParseFunctionStatementBody(clang::Decl*, clang::Parser::ParseScope&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e1eb3f)
#28 0x000055c03d7c4cab clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::LateParsedAttrList*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d22cab)
#29 0x000055c03d80742d clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d6542d)
#30 0x000055c03d7bf7e1 clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1d7e1)
#31 0x000055c03d7c000f clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1e00f)
#32 0x000055c03d7c8896 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d26896)
#33 0x000055c03d7c9915 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d27915)
#34 0x000055c03d7a988a clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d0788a)
#35 0x000055c03bc21987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#36 0x000055c03bba90e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#37 0x000055c03bd1e95e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#38 0x000055c037a29657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#39 0x000055c037a1e694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#40 0x000055c037a23907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#41 0x000055c0378e10ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#42 0x00007f4ea0ed0d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#43 0x00007f4ea0ed0e40 call_init ./csu/../csu/libc-start.c:128:20
#44 0x00007f4ea0ed0e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#45 0x000055c037a1dcb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/lGmJWrkFaQkE_surfuzz_28-1d3a35.c
clang: note: diagnostic msg: /tmp/lGmJWrkFaQkE_surfuzz_28-1d3a35.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```
## Preprocessed Source & Run Script
The preprocessed source is too large to inline. Please find it attached as `lGmJWrkFaQkE_surfuzz_28-1d3a35.c` and `lGmJWrkFaQkE_surfuzz_28-1d3a35.sh`.
* found via a fuzzer
[lGmJWrkFaQkE_surfuzz_28-1d3a35.c](https://github.com/user-attachments/files/29127755/lGmJWrkFaQkE_surfuzz_28-1d3a35.c)
[lGmJWrkFaQkE_surfuzz_28-1d3a35.sh](https://github.com/user-attachments/files/29127754/lGmJWrkFaQkE_surfuzz_28-1d3a35.sh)
Contributor guide
Research direction
Start by reproducing the crash with clang -O0 test.c -o /dev/null and the reduced C input. Then inspect ExprConstant.cpp, especially IntExprEvaluator::VisitBuiltinCallExpr and Evaluate, along with the SemaChecking.cpp callers shown in the stack. Done means the input no longer aborts on the alignment assertion and regression coverage prevents the ICE.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100