llvm / llvm/llvm-project

[Clang] OOM crash in InitListExpr::resizeInits when using large designated initializer index in struct array

Open
#205,472 6 comments 0 reactions 0 assignees View on GitHub
clang:frontend crash
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Description:
Hi LLVM team,

I encountered an Out-Of-Memory (OOM) error in Clang (trunk) when compiling a static array of structs with very large designated initializer indices (e.g., [0x80000000]).

According to the crash backtrace, it appears that clang::InitListExpr::resizeInits attempts to allocate a massive ASTVector to accommodate the indices up to 0x80000000, which immediately exhausts available memory.

Thank you once again for your hard work and for maintaining this incredible project!

Steps to Reproduce:
Source Code (crash.c):

```c
struct Point { int x, y; };
void trigger_bug(void) {
static struct Point pts[] = {
[0x80000000] = { .x = 10, .y = 20 },
[0x80000001] = { .x = 30, .y = 40 }
};
}
```

Compiler Version:
x86-64 clang (trunk)

Command Line:

`clang -c crash.c`

(Note: Easily reproducible on Compiler Explorer using the trunk version).

Actual Behavior:
Clang terminates with an out of memory LLVM ERROR during AST construction.

```
LLVM ERROR: out of memory
Allocation failed
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-trunk/bin/clang ...
1. :6:6: current parser token ';'
2. :2:24: parsing function body 'trigger_bug'
3. :2:24: in compound statement ('{}')

...
#11 0x0000000003bd7e80 llvm::allocate_buffer(unsigned long, unsigned long)
#12 0x0000000000f3a3ed llvm::BumpPtrAllocatorImpl<...>::AllocateSlow(unsigned long, unsigned long, llvm::Align)
#13 0x0000000007534d2f clang::ASTVector::grow(clang::ASTContext const&, unsigned long)
#14 0x0000000007534dbc clang::InitListExpr::resizeInits(clang::ASTContext const&, unsigned int)
...
```

Expected Behavior:
Instead of crashing and exhausting system memory, Clang should gracefully reject the code. If the requested array size via the designated initializer exceeds target or compiler limits, it should emit a clear diagnostic error (such as "array is too large" or "initializer list is too large").

Contributor guide

Open the contributing guide

Research direction

Start with the crash.c reproducer and the `clang -c crash.c` command, then inspect `clang::InitListExpr::resizeInits` and the ASTVector growth shown in the backtrace. Done means the large designated initializer is rejected with a clear diagnostic instead of exhausting memory; rerun the command to verify the behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.