[BUG] ICE in clang::Sema::CheckFunctionDeclaration(clang::Scope*, clang::FunctionDecl*, clang::LookupResult&, bool, bool)
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
## Bug Report: ICE in clang::Sema::CheckFunctionDeclaration(clang::Scope*, clang::FunctionDecl*, clang::LookupResult&, bool, bool)
Clang crashes when compiling the following C code.
**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend
This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).
## Reduced Test Case
> Minimized from the original fuzzer-generated input using `creduce`.
```sh
clang -O0 test.c -o /dev/null
```
```c
#pragma redefine_extname a b
static a(;
a(;
```
## Crash Output
```
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/namdNyqVRRam_surfuzz_23.c:4:12: error: initializer element is not a compile-time constant
4 | int name \= fake();
| ^\~\~\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/namdNyqVRRam_surfuzz_23.c:5:30: warning: expected identifier in '#pragma redefine_extname' - ignored [-Wignored-pragmas]
5 | #pragma redefine_extname bar __PRAGMA_REDEFINE_EXTNAME
| ^
:38:35: note: expanded from macro '__PRAGMA_REDEFINE_EXTNAME'
38 | #define __PRAGMA_REDEFINE_EXTNAME 1
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/namdNyqVRRam_surfuzz_23.c:9:7: warning: #pragma redefine_extname is applicable to external C declarations only; not applied to variable 'foo' [-Wpragmas]
9 | int foo \= 0;
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/namdNyqVRRam_surfuzz_23.c:14:12: warning: #pragma redefine_extname is applicable to external C declarations only; not applied to function 'foo_static' [-Wpragmas]
14 | static int foo_static(void) { return 1; }
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/namdNyqVRRam_surfuzz_23.c:13:37: warning: attribute declaration must precede definition [-Wignored-attributes]
13 | #pragma redefine_extname foo_static bar_static
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/namdNyqVRRam_surfuzz_23.c:14:12: note: previous definition is here
14 | static int foo_static(void) { return 1; }
| ^
clang-22: /root/compilers/llvm-project-release/clang/include/clang/AST/Decl.h:5357: void clang::Redeclarable::setPreviousDecl(decl_type*) [with decl_type \= clang::FunctionDecl]: Assertion \`!isa(static_cast(this)) || cast(static_cast(this))->isLinkageValid()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name namdNyqVRRam_surfuzz_23.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/namdNyqVRRam_surfuzz_23-fd6f2c.o -x c /root/outputs/experiments-on-metamut/surfuzz,gcc,4/namdNyqVRRam_surfuzz_23.c
1\. /root/outputs/experiments-on-metamut/surfuzz,gcc,4/namdNyqVRRam_surfuzz_23.c:16:29: current parser token '{'
#0 0x0000562123c342d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x0000562123c30caf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x0000562123c30dfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007fd74b82c520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007fd74b880a7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007fd74b880a7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007fd74b880a7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007fd74b82c476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007fd74b8127f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007fd74b81271b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007fd74b823e96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x000056212744abfe clang::Redeclarable::setPreviousDecl(clang::FunctionDecl*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x7d0cbfe)
#12 0x00005621275d0489 clang::FunctionDecl::setPreviousDeclaration(clang::FunctionDecl*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x7e92489)
#13 0x000056212683706e clang::Sema::CheckFunctionDeclaration(clang::Scope*, clang::FunctionDecl*, clang::LookupResult&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x70f906e)
#14 0x000056212683cb1a clang::Sema::ActOnFunctionDeclarator(clang::Scope*, clang::Declarator&, clang::DeclContext*, clang::TypeSourceInfo*, clang::LookupResult&, llvm::MutableArrayRef, bool&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x70feb1a)
#15 0x000056212683f93e clang::Sema::HandleDeclarator(clang::Scope*, clang::Declarator&, llvm::MutableArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x710193e)
#16 0x0000562126840643 clang::Sema::ActOnStartOfFunctionDef(clang::Scope*, clang::Declarator&, llvm::MutableArrayRef, clang::SkipBodyInfo*, clang::Sema::FnBodyKind) (/root/objects/llvm-project-release.obj/bin/clang-22+0x7102643)
#17 0x00005621264603f9 clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::LateParsedAttrList*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d223f9)
#18 0x00005621264a342d clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d6542d)
#19 0x000056212645b7e1 clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1d7e1)
#20 0x000056212645c00f clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1e00f)
#21 0x0000562126464896 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d26896)
#22 0x0000562126465915 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d27915)
#23 0x000056212644588a clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d0788a)
#24 0x00005621248bd987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#25 0x00005621248450e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#26 0x00005621249ba95e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#27 0x00005621206c5657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#28 0x00005621206ba694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#29 0x00005621206bf907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#30 0x000056212057d0ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#31 0x00007fd74b813d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#32 0x00007fd74b813e40 call_init ./csu/../csu/libc-start.c:128:20
#33 0x00007fd74b813e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#34 0x00005621206b9cb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/namdNyqVRRam_surfuzz_23-6f6777.c
clang: note: diagnostic msg: /tmp/namdNyqVRRam_surfuzz_23-6f6777.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```
## Preprocessed Source & Run Script
**Preprocessed source** (`/tmp/namdNyqVRRam_surfuzz_23-6f6777.c`):
```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/namdNyqVRRam_surfuzz_23.c"
#pragma redefine_extname fake real
#pragma redefine_extname name alias
extern int fake(void);
int name = fake();
#pragma redefine_extname bar __PRAGMA_REDEFINE_EXTNAME
int fish(void) { return fake() + __PRAGMA_REDEFINE_EXTNAME + name; }
#pragma redefine_extname foo bar
int f(void) {
int foo = 0;
return foo;
}
extern int foo(void) { return 1; }
#pragma redefine_extname foo_static bar_static
static int foo_static(void) { return 1; }
int baz(void) { return foo_static(); }
extern int foo_static(void) { return 100; }
static int bar_static(void) { return 2; }
#pragma redefine_extname_static bar_static foo_static
extern int bar_static(void) { return 20; }
#pragma redefine_extname memset __builtin_memset #pragma redefine_extname (1);
extern void *memset(void *, int, size_t);
#pragma redefine_extname memcmp __builtin_memcmp
extern int memcmp(const void *, const void *, size_t);
#pragma redefine_extname memcpy __builtin_memcpy
extern void *memcpy(void *, const void *, size_t);
#pragma redefine_extname memcpy __GI_memcpy
void *test_memcpy(void *dst, const void *src, size_t n) { return memcpy(dst, src, n); }
```
**Run script** (`/tmp/namdNyqVRRam_surfuzz_23-6f6777.sh`):
```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/namdNyqVRRam_surfuzz_23.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "namdNyqVRRam_surfuzz_23.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/namdNyqVRRam_surfuzz_23-fd6f2c.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/namdNyqVRRam_surfuzz_23.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "namdNyqVRRam_surfuzz_23.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "namdNyqVRRam_surfuzz_23-6f6777.c"
```
* found via a fuzzer
[namdNyqVRRam_surfuzz_23-6f6777.c](https://github.com/user-attachments/files/29128096/namdNyqVRRam_surfuzz_23-6f6777.c)
[namdNyqVRRam_surfuzz_23-6f6777.sh](https://github.com/user-attachments/files/29128097/namdNyqVRRam_surfuzz_23-6f6777.sh)
Contributor guide
Research direction
Start with the reduced C test case and reproduce the assertion using `clang -O0 test.c -o /dev/null`. Trace `clang::Sema::CheckFunctionDeclaration` through `clang::FunctionDecl::setPreviousDeclaration` and the assertion in `clang/AST/Decl.h`; done means the input no longer crashes and a regression test covers it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100