llvm / llvm/llvm-project

[clang] crash with "type should never be variably-modified"

Open
#205,484 3 comments 0 reactions 0 assignees View on GitHub
clang:frontend confirmed crash generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Reproducer:
https://godbolt.org/z/4oKoezEG6
```cpp
struct S {
void foo(int n, auto... v[n] {};
};
```

Bacltrace:
```console
type should never be variably-modified
UNREACHABLE executed at /root/llvm-project/llvm/tools/clang/lib/AST/ASTContext.cpp:4346!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics
1. :2:34: current parser token ';'
2. :1:1: parsing struct/union/class body 'S'
#0 0x000000000435d468 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x435d468)
#1 0x000000000435a3a4 llvm::sys::RunSignalHandlers() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x435a3a4)
#2 0x000000000435a9c4 llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x435a9c4)
#3 0x0000000004297e28 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
#4 0x00007c5cd6445330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#5 0x00007c5cd649eb2c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c)
#6 0x00007c5cd644527e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#7 0x00007c5cd64288ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#8 0x00000000042a21ca (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x42a21ca)
#9 0x0000000007c20bb2 clang::ASTContext::getVariableArrayDecayedType(clang::QualType) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7c20bb2)
#10 0x0000000007c24b76 clang::ASTContext::getCanonicalParamType(clang::QualType) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7c24b76)
#11 0x0000000007c2bea6 clang::ASTContext::getFunctionTypeInternal(clang::QualType, llvm::ArrayRef, clang::FunctionProtoType::ExtProtoInfo const&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7c2bea6)
#12 0x00000000078e49df GetFullTypeForDeclarator((anonymous namespace)::TypeProcessingState&, clang::QualType, clang::TypeSourceInfo*) SemaType.cpp:0:0
#13 0x00000000078e9124 clang::Sema::GetTypeForDeclarator(clang::Declarator&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x78e9124)
#14 0x000000000705d654 clang::Sema::HandleDeclarator(clang::Scope*, clang::Declarator&, llvm::MutableArrayRef) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x705d654)
#15 0x0000000007104e1f clang::Sema::ActOnCXXMemberDeclarator(clang::Scope*, clang::AccessSpecifier, clang::Declarator&, llvm::MutableArrayRef, clang::Expr*, clang::VirtSpecifiers const&, clang::InClassInitStyle) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7104e1f)
#16 0x0000000006cc33be clang::Parser::ParseCXXClassMemberDeclaration(clang::AccessSpecifier, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::ParsingDeclRAIIObject*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6cc33be)
#17 0x0000000006cc4aff clang::Parser::ParseCXXClassMemberDeclarationWithPragmas(clang::AccessSpecifier&, clang::ParsedAttributes&, clang::TypeSpecifierType, clang::Decl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6cc4aff)
#18 0x0000000006cc67df clang::Parser::ParseCXXMemberSpecification(clang::SourceLocation, clang::SourceLocation, clang::ParsedAttributes&, unsigned int, clang::Decl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6cc67df)
#19 0x0000000006cc917b clang::Parser::ParseClassSpecifier(clang::tok::TokenKind, clang::SourceLocation, clang::DeclSpec&, clang::Parser::ParsedTemplateInfo&, clang::AccessSpecifier, bool, clang::Parser::DeclSpecContext, clang::ParsedAttributes&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6cc917b)
#20 0x0000000006c9cacc clang::Parser::ParseDeclarationSpecifiers(clang::DeclSpec&, clang::Parser::ParsedTemplateInfo&, clang::AccessSpecifier, clang::Parser::DeclSpecContext, clang::LateParsedAttrList*, clang::ImplicitTypenameContext) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c9cacc)
#21 0x0000000006c57527 clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c57527)
#22 0x0000000006c57faf clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c57faf)
#23 0x0000000006c5fa61 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c5fa61)
#24 0x0000000006c60975 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c60975)
#25 0x0000000006c60d60 clang::Parser::ParseFirstTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c60d60)
#26 0x0000000006c41823 clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c41823)
#27 0x0000000004e583d8 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4e583d8)
#28 0x0000000005193a38 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x5193a38)
#29 0x000000000510f0fd clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x510f0fd)
#30 0x0000000005292a3d clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x5292a3d)
#31 0x0000000000dccf5c cc1_main(llvm::ArrayRef, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xdccf5c)
#32 0x0000000000dc3c3a ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#33 0x0000000000dc3dbd int llvm::function_ref&)>::callback_fn&)>(long, llvm::SmallVectorImpl&) driver.cpp:0:0
#34 0x0000000004ecbbc9 void llvm::function_ref::callback_fn>, std::__cxx11::basic_string, std::allocator>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#35 0x0000000004298264 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4298264)
#36 0x0000000004ecc216 clang::driver::CC1Command::Execute(llvm::ArrayRef>, std::__cxx11::basic_string, std::allocator>*, bool*) const (.part.0) Job.cpp:0:0
#37 0x0000000004e883c2 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4e883c2)
#38 0x0000000004e8936e clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4e8936e)
#39 0x0000000004e90ab5 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4e90ab5)
#40 0x0000000000dc94d2 clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xdc94d2)
#41 0x0000000000cc900a main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xcc900a)
#42 0x00007c5cd642a1ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#43 0x00007c5cd642a28b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#44 0x0000000000dc35e5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xdc35e5)
clang++: error: clang frontend command failed due to signal (use -v to see invocation)
Compiler returned: 134
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Godbolt example, then inspect clang::ASTContext::getVariableArrayDecayedType in llvm/tools/clang/lib/AST/ASTContext.cpp and the declarator handling in SemaType.cpp. The fix should prevent this valid-looking input from reaching the unreachable assertion and include regression coverage for the reproducer.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.