[BUG] ICE in clang::Sema::CheckFieldDecl
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
## Bug Report: ICE in clang::Sema::CheckFieldDecl(clang::DeclarationName, clang::QualType, clang::TypeSourceInfo*, clang::RecordDecl*, clang::SourceLocation, bool, clang::Expr*, clang::InClassInitStyle, clang::SourceLocation, clang::AccessSpecifier, clang::NamedDecl*, clang::Declarator*)
Clang crashes when compiling the following C code.
**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend
This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).
## Reduced Test Case
> Minimized from the original fuzzer-generated input using `creduce`.
```sh
clang -O0 test.c -o /dev/null
```
```c
struct {
#include
```
## Crash Output
```
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:7:9: error: unknown type name 'pair'
7 | typedef pair Pii;
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:7:13: error: expected identifier or '('
7 | typedef pair Pii;
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:8:19: error: call to undeclared library function 'acos' with type 'double (double)'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
8 | const double pi \= acos(-1.0);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:8:19: note: include the header or explicitly provide a declaration for 'acos'
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:8:19: error: initializer element is not a compile-time constant
8 | const double pi \= acos(-1.0);
| ^\~\~\~\~\~\~\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:9:17: error: use of undeclared identifier 'INT_MAX'
9 | const int INF \= INT_MAX;
| ^\~\~\~\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:13:5: error: type name requires a specifier or qualifier
13 | P(double _x=0.0, double _y=0.0):x(_x),y(_y) {}
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:13:37: error: call to undeclared function 'x'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
13 | P(double _x=0.0, double _y=0.0):x(_x),y(_y) {}
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:13:39: error: use of undeclared identifier '_x'
13 | P(double _x=0.0, double _y=0.0):x(_x),y(_y) {}
| ^\~
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:13:45: error: a parameter list without types is only allowed in a function definition
13 | P(double _x=0.0, double _y=0.0):x(_x),y(_y) {}
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:13:43: error: duplicate member 'y'
13 | P(double _x=0.0, double _y=0.0):x(_x),y(_y) {}
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:12:15: note: previous declaration is here
12 | double x, y;
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:13:48: error: expected ';' at end of declaration list
13 | P(double _x=0.0, double _y=0.0):x(_x),y(_y) {}
| ^
| ;
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:20:3: error: expected ';' after struct
20 | }}
| ^
| ;
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:22:1: error: type name requires a specifier or qualifier
22 | g(s *p){return (void *)p->x();}
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:22:3: error: unknown type name 's'
22 | g(s *p){return (void *)p->x();}
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:22:8: error: expected ';' at end of declaration list
22 | g(s *p){return (void *)p->x();}
| ^
| ;
In file included from /root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:25:
In file included from /usr/include/stdlib.h:32:
In file included from /root/objects/llvm-project-release.obj/lib/clang/22/include/stddef.h:103:
/root/objects/llvm-project-release.obj/lib/clang/22/include/__stddef_wchar_t.h:24:1: error: type name does not allow storage class to be specified
24 | typedef __WCHAR_TYPE__ wchar_t;
| ^
In file included from /root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:25:
In file included from /usr/include/stdlib.h:56:
In file included from /usr/include/x86_64-linux-gnu/bits/floatn.h:119:
/usr/include/x86_64-linux-gnu/bits/floatn-common.h:214:1: error: type name does not allow storage class to be specified
214 | typedef float _Float32;
| ^
/usr/include/x86_64-linux-gnu/bits/floatn-common.h:251:1: error: type name does not allow storage class to be specified
251 | typedef double _Float64;
| ^
/usr/include/x86_64-linux-gnu/bits/floatn-common.h:268:1: error: type name does not allow storage class to be specified
268 | typedef double _Float32x;
| ^
fatal error: too many errors emitted, stopping now [-ferror-limit=]
clang-22: /root/compilers/llvm-project-release/llvm/include/llvm/Support/Casting.h:572: decltype(auto) llvm::cast(From*) [with To \= clang::FunctionDecl; From \= clang::Decl]: Assertion \`isa(Val) && "cast() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name fGaaBxLYmnoi_surfuzz_28.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/fGaaBxLYmnoi_surfuzz_28-7b6205.o -x c /root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c
1\. /usr/include/stdlib.h:594:42: current parser token ';'
2\. /root/outputs/experiments-on-metamut/surfuzz,gcc,4/fGaaBxLYmnoi_surfuzz_28.c:21:1: parsing struct/union body 'w'
#0 0x00005585e18352d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x00005585e1831caf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x00005585e1831dfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f54036ae520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007f5403702a7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007f5403702a7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007f5403702a7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007f54036ae476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007f54036947f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007f540369471b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007f54036a5e96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x00005585e446df7b clang::Sema::AddAllocAlignAttr(clang::Decl*, clang::AttributeCommonInfo const&, clang::Expr*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x712ef7b)
#12 0x00005585e448af08 clang::Sema::ProcessDeclAttributes(clang::Scope*, clang::Decl*, clang::Declarator const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x714bf08)
#13 0x00005585e43f5e1a clang::Sema::CheckFieldDecl(clang::DeclarationName, clang::QualType, clang::TypeSourceInfo*, clang::RecordDecl*, clang::SourceLocation, bool, clang::Expr*, clang::InClassInitStyle, clang::SourceLocation, clang::AccessSpecifier, clang::NamedDecl*, clang::Declarator*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x70b6e1a)
#14 0x00005585e43f6a69 clang::Sema::HandleField(clang::Scope*, clang::RecordDecl*, clang::SourceLocation, clang::Declarator&, clang::Expr*, clang::InClassInitStyle, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x70b7a69)
#15 0x00005585e43f6e75 clang::Sema::ActOnField(clang::Scope*, clang::Decl*, clang::SourceLocation, clang::Declarator&, clang::Expr*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x70b7e75)
#16 0x00005585e408165a clang::Decl* llvm::function_ref::callback_fn(long, clang::ParsingFieldDeclarator&) ParseDecl.cpp:0:0
#17 0x00005585e40a1361 clang::Parser::ParseStructDeclaration(clang::ParsingDeclSpec&, llvm::function_ref, clang::Parser::LateParsedAttrList*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d62361)
#18 0x00005585e40a2253 clang::Parser::ParseStructUnionBody(clang::SourceLocation, clang::TypeSpecifierType, clang::RecordDecl*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d63253)
#19 0x00005585e40c9718 clang::Parser::ParseClassSpecifier(clang::tok::TokenKind, clang::SourceLocation, clang::DeclSpec&, clang::Parser::ParsedTemplateInfo&, clang::AccessSpecifier, bool, clang::Parser::DeclSpecContext, clang::ParsedAttributes&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d8a718)
#20 0x00005585e4095e0b clang::Parser::ParseDeclarationSpecifiers(clang::DeclSpec&, clang::Parser::ParsedTemplateInfo&, clang::AccessSpecifier, clang::Parser::DeclSpecContext, clang::Parser::LateParsedAttrList*, clang::ImplicitTypenameContext) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d56e0b)
#21 0x00005585e405c567 clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1d567)
#22 0x00005585e405d00f clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1e00f)
#23 0x00005585e4065896 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d26896)
#24 0x00005585e4066915 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d27915)
#25 0x00005585e404688a clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d0788a)
#26 0x00005585e24be987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#27 0x00005585e24460e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#28 0x00005585e25bb95e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#29 0x00005585de2c6657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#30 0x00005585de2bb694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#31 0x00005585de2c0907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#32 0x00005585de17e0ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#33 0x00007f5403695d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#34 0x00007f5403695e40 call_init ./csu/../csu/libc-start.c:128:20
#35 0x00007f5403695e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#36 0x00005585de2bacb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/fGaaBxLYmnoi_surfuzz_28-54faf3.c
clang: note: diagnostic msg: /tmp/fGaaBxLYmnoi_surfuzz_28-54faf3.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```
## Preprocessed Source & Run Script
The preprocessed source is too large to inline. Please find it attached as `fGaaBxLYmnoi_surfuzz_28-54faf3.c` and `fGaaBxLYmnoi_surfuzz_28-54faf3.sh`.
* found via a fuzzer
[fGaaBxLYmnoi_surfuzz_28-54faf3.c](https://github.com/user-attachments/files/29128047/fGaaBxLYmnoi_surfuzz_28-54faf3.c)
[fGaaBxLYmnoi_surfuzz_28-54faf3.sh](https://github.com/user-attachments/files/29128046/fGaaBxLYmnoi_surfuzz_28-54faf3.sh)
Contributor guide
Research direction
Reproduce the crash with clang-22 using the supplied test.c and -O0 command, then inspect the CheckFieldDecl and AddAllocAlignAttr stack entries. Compare the diagnostics and assertion behavior while narrowing the malformed struct input; done means the reduced case no longer triggers an ICE or incompatible cast assertion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100