llvm / llvm/llvm-project

[clang-check][Syntax] Crash in `TreeBuilder::getRange: assertion (BeginChildren == Trees.end() || BeginChildren->first == FirstToken) && "fold crosses boundaries of existing subtrees` fails when dumping tokens for malformed C code

Open
#207,567 0 comments 0 reactions 0 assignees View on GitHub
clang-tools-extra crash generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

``` c
foo(bar)
char foo = {};};

```
use

```
clang-check \
--tokens-dump \
example.c \
-- -xc -std=c11
```

stacktrace
```
clang-check: /home/ubuntu2404/llvm-project-196067/clang/lib/Tooling/Syntax/BuildTree.cpp:632: void clang::syntax::TreeBuilder::Forest::foldChildren(const clang::syntax::TokenBuffer&, llvm::ArrayRef, clang::syntax::Tree*): Assertion `(BeginChildren == Trees.end() || BeginChildren->first == FirstToken) && "fold crosses boundaries of existing subtrees"' failed.
#0 0x000064e13d96f1f1 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x96d1f1)
#1 0x000064e13d96bdac llvm::sys::RunSignalHandlers() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x969dac)
#2 0x000064e13d96bf0c SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x0000777cbbe45330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x0000777cbbe9eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#5 0x0000777cbbe9eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#6 0x0000777cbbe9eb2c pthread_kill ./nptl/pthread_kill.c:89:10
#7 0x0000777cbbe4527e raise ./signal/../sysdeps/posix/raise.c:27:6
#8 0x0000777cbbe288ff abort ./stdlib/abort.c:81:7
#9 0x0000777cbbe2881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x0000777cbbe3b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#11 0x000064e13dd06ecb clang::syntax::TreeBuilder::foldNode(llvm::ArrayRef, clang::syntax::Tree*, llvm::PointerUnion) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xd04ecb)
#12 0x000064e13dd26693 clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseEmptyDecl(clang::EmptyDecl*) BuildTree.cpp:0:0
#13 0x000064e13dd0eaea clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseDeclContextHelper(clang::DeclContext*) BuildTree.cpp:0:0
#14 0x000064e13dd2783b clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseTranslationUnitDecl(clang::TranslationUnitDecl*) BuildTree.cpp:0:0
#15 0x000064e13dd0e439 clang::syntax::buildSyntaxTree(clang::syntax::Arena&, clang::syntax::TokenBufferTokenManager&, clang::ASTContext&) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xd0c439)
#16 0x000064e13d4024af (anonymous namespace)::DumpSyntaxTree::CreateASTConsumer(clang::CompilerInstance&, llvm::StringRef)::Consumer::HandleTranslationUnit(clang::ASTContext&) ClangCheck.cpp:0:0
#17 0x000064e13f238f9c clang::ParseAST(clang::Sema&, bool, bool) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x2236f9c)
#18 0x000064e13d9c6271 clang::FrontendAction::Execute() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x9c4271)
#19 0x000064e13da12308 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xa10308)
#20 0x000064e13dceecb7 clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr, clang::FileManager*, std::shared_ptr, clang::DiagnosticConsumer*) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xceccb7)
#21 0x000064e13dce8b2a clang::tooling::ToolInvocation::runInvocation(char const*, clang::driver::Compilation*, std::shared_ptr, std::shared_ptr) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xce6b2a)
#22 0x000064e13dceb1e2 clang::tooling::ToolInvocation::run() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xce91e2)
#23 0x000064e13dcece19 clang::tooling::ClangTool::run(clang::tooling::ToolAction*) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xceae19)
#24 0x000064e13d387405 main (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x385405)
#25 0x0000777cbbe2a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#26 0x0000777cbbe2a28b call_init ./csu/../csu/libc-start.c:128:20
#27 0x0000777cbbe2a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#28 0x000064e13d401045 _start (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x3ff045)
Aborted (core dumped)
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the crash with clang-check --tokens-dump on the provided example.c using -xc -std=c11. Read clang/lib/Tooling/Syntax/BuildTree.cpp around TreeBuilder::Forest::foldChildren and foldNode, then add coverage for the malformed input and confirm token dumping no longer hits the assertion.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.