llvm / llvm/llvm-project

[BUG] ICE in clang::ASTContext::getTypeInfo(clang::Type const*) const

Open
#204,779 1 comment 0 reactions 0 assignees View on GitHub
clang:frontend crash-on-invalid generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

## Bug Report: ICE in clang::ASTContext::getTypeInfo(clang::Type const*) const

Clang crashes when compiling the following C code.

**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend

This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).

## Reduced Test Case

> Minimized from the original fuzzer-generated input using `creduce`.

```sh
clang -O0 test.c -o /dev/null
```

```c
enum a register b asm("%edx"
```

## Crash Output

```
clang-22: /root/compilers/llvm-project-release/clang/include/clang/AST/TypeBase.h:953: const clang::ExtQualsTypeCommonBase* clang::QualType::getCommonPtr() const: Assertion \`!isNull() && "Cannot retrieve a NULL type pointer"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name KHKGgLsruaqs_surfuzz_5.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/KHKGgLsruaqs_surfuzz_5-e7f073.o -x c /root/outputs/experiments-on-metamut/surfuzz,gcc,4/KHKGgLsruaqs_surfuzz_5.c
1\. /root/outputs/experiments-on-metamut/surfuzz,gcc,4/KHKGgLsruaqs_surfuzz_5.c:2:29: current parser token ';'
#0 0x0000559f9beb42d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x0000559f9beb0caf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x0000559f9beb0dfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007fb789f9b520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007fb789fefa7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007fb789fefa7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007fb789fefa7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007fb789f9b476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007fb789f817f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007fb789f8171b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007fb789f92e96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x0000559f9c1478ec (/root/objects/llvm-project-release.obj/bin/clang-22+0x47898ec)
#12 0x0000559f9f649b7e clang::ASTContext::getTypeInfoImpl(clang::Type const*) const (/root/objects/llvm-project-release.obj/bin/clang-22+0x7c8bb7e)
#13 0x0000559f9f643f3a clang::ASTContext::getTypeInfo(clang::Type const*) const (/root/objects/llvm-project-release.obj/bin/clang-22+0x7c85f3a)
#14 0x0000559f9f6490d2 clang::ASTContext::getTypeInfoImpl(clang::Type const*) const (/root/objects/llvm-project-release.obj/bin/clang-22+0x7c8b0d2)
#15 0x0000559f9f643f3a clang::ASTContext::getTypeInfo(clang::Type const*) const (/root/objects/llvm-project-release.obj/bin/clang-22+0x7c85f3a)
#16 0x0000559f9ea6235f clang::Sema::CheckAsmLabel(clang::Scope*, clang::Expr*, clang::StorageClass, clang::TypeSourceInfo*, clang::VarDecl*) (.part.0) SemaDecl.cpp:0:0
#17 0x0000559f9eaa6eaf clang::Sema::ActOnVariableDeclarator(clang::Scope*, clang::Declarator&, clang::DeclContext*, clang::TypeSourceInfo*, clang::LookupResult&, llvm::MutableArrayRef, bool&, llvm::ArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x70e8eaf)
#18 0x0000559f9eabfec7 clang::Sema::HandleDeclarator(clang::Scope*, clang::Declarator&, llvm::MutableArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x7101ec7)
#19 0x0000559f9eac07cc clang::Sema::ActOnDeclarator(clang::Scope*, clang::Declarator&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x71027cc)
#20 0x0000559f9e70afaa clang::Parser::ParseDeclarationAfterDeclaratorAndAttributes(clang::Declarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::ForRangeInit*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d4cfaa)
#21 0x0000559f9e722ce3 clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d64ce3)
#22 0x0000559f9e6db7e1 clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1d7e1)
#23 0x0000559f9e6dc00f clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1e00f)
#24 0x0000559f9e6e4896 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d26896)
#25 0x0000559f9e6e5915 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d27915)
#26 0x0000559f9e6c588a clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d0788a)
#27 0x0000559f9cb3d987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#28 0x0000559f9cac50e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#29 0x0000559f9cc3a95e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#30 0x0000559f98945657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#31 0x0000559f9893a694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#32 0x0000559f9893f907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#33 0x0000559f987fd0ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#34 0x00007fb789f82d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#35 0x00007fb789f82e40 call_init ./csu/../csu/libc-start.c:128:20
#36 0x00007fb789f82e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#37 0x0000559f98939cb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/KHKGgLsruaqs_surfuzz_5-a25373.c
clang: note: diagnostic msg: /tmp/KHKGgLsruaqs_surfuzz_5-a25373.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```

## Preprocessed Source & Run Script

**Preprocessed source** (`/tmp/KHKGgLsruaqs_surfuzz_5-a25373.c`):

```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/KHKGgLsruaqs_surfuzz_5.c"
typedef enum foo E;
register E eval asm ("%edx");
struct {
E eval;
} s;
p()
{
s.eval = e0;
}
f()
{
switch (s.eval)
{
case e0:
p();
}
}
main()
{
s.eval = e1;
f();
exit(0);
}i386-*-*-*.test/c-c++-common/gcc-c-common.gcc-c.switch.test.c: Disable debug information.struct {
int eval;
} s;
p()
{
s.eval = 2;
}
f()
{
switch (s.eval)
{
case e0:
p();
}
}
main()
{
s.eval = e1;
f();
exit(0);
}

```

**Run script** (`/tmp/KHKGgLsruaqs_surfuzz_5-a25373.sh`):

```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/KHKGgLsruaqs_surfuzz_5.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "KHKGgLsruaqs_surfuzz_5.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/KHKGgLsruaqs_surfuzz_5-e7f073.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/KHKGgLsruaqs_surfuzz_5.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "KHKGgLsruaqs_surfuzz_5.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "KHKGgLsruaqs_surfuzz_5-a25373.c"

```

* found via a fuzzer

[KHKGgLsruaqs_surfuzz_5-a25373.c](https://github.com/user-attachments/files/29129402/KHKGgLsruaqs_surfuzz_5-a25373.c)
[KHKGgLsruaqs_surfuzz_5-a25373.sh](https://github.com/user-attachments/files/29129401/KHKGgLsruaqs_surfuzz_5-a25373.sh)

Contributor guide

Open the contributing guide

Research direction

Reproduce the crash with the reduced C source and the clang command shown. Start at clang::Sema::CheckAsmLabel in SemaDecl.cpp, then trace the calls into clang::ASTContext::getTypeInfo and QualType::getCommonPtr in TypeBase.h. Done means the reproducer no longer hits the assertion and regression coverage protects the behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.