llvm / llvm/llvm-project

[clang-check][Syntax] Crash in TreeBuilder::getRange: `Range.isValid()` fails when dumping tokens

Open
#207,576 0 comments 0 reactions 0 assignees View on GitHub
clang-tools-extra crash-on-invalid generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

This input is generated by a fuzzer.
```c
#include __FILE__
a (

```
```
clang-check --tokens-dump example.cpp -- -xc++ -std=c++23
```

```
clang-check: /home/ubuntu2404/llvm-project-196067/clang/lib/Tooling/Syntax/BuildTree.cpp:455: llvm::ArrayRef clang::syntax::TreeBuilder::getRange(clang::SourceRange) const: Assertion `Range.isValid()' failed.
#0 0x00005c3a989a01f1 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x96d1f1)
#1 0x00005c3a9899cdac llvm::sys::RunSignalHandlers() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x969dac)
#2 0x00005c3a9899cf0c SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f10d6445330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x00007f10d649eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#5 0x00007f10d649eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#6 0x00007f10d649eb2c pthread_kill ./nptl/pthread_kill.c:89:10
#7 0x00007f10d644527e raise ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007f10d64288ff abort ./stdlib/abort.c:81:7
#9 0x00007f10d642881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x00007f10d643b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#11 0x00005c3a98d38aa7 (anonymous namespace)::BuildTreeVisitor::WalkUpFromExpr(clang::Expr*) BuildTree.cpp:0:0
#12 0x00005c3a98d494d0 clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) (.constprop.0) BuildTree.cpp:0:0
#13 0x00005c3a98d4ca2d clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseObjCBoxedExpr(clang::ObjCBoxedExpr*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) BuildTree.cpp:0:0
#14 0x00005c3a98d479be clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) (.constprop.0) BuildTree.cpp:0:0
#15 0x00005c3a98d57dfb clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseVarDecl(clang::VarDecl*) BuildTree.cpp:0:0
#16 0x00005c3a98d3faea clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseDeclContextHelper(clang::DeclContext*) BuildTree.cpp:0:0
#17 0x00005c3a98d5883b clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseTranslationUnitDecl(clang::TranslationUnitDecl*) BuildTree.cpp:0:0
#18 0x00005c3a98d3f439 clang::syntax::buildSyntaxTree(clang::syntax::Arena&, clang::syntax::TokenBufferTokenManager&, clang::ASTContext&) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xd0c439)
#19 0x00005c3a984334af (anonymous namespace)::DumpSyntaxTree::CreateASTConsumer(clang::CompilerInstance&, llvm::StringRef)::Consumer::HandleTranslationUnit(clang::ASTContext&) ClangCheck.cpp:0:0
#20 0x00005c3a9a269f9c clang::ParseAST(clang::Sema&, bool, bool) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x2236f9c)
#21 0x00005c3a989f7271 clang::FrontendAction::Execute() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x9c4271)
#22 0x00005c3a98a43308 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xa10308)
#23 0x00005c3a98d1fcb7 clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr, clang::FileManager*, std::shared_ptr, clang::DiagnosticConsumer*) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xceccb7)
#24 0x00005c3a98d19b2a clang::tooling::ToolInvocation::runInvocation(char const*, clang::driver::Compilation*, std::shared_ptr, std::shared_ptr) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xce6b2a)
#25 0x00005c3a98d1c1e2 clang::tooling::ToolInvocation::run() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xce91e2)
#26 0x00005c3a98d1de19 clang::tooling::ClangTool::run(clang::tooling::ToolAction*) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xceae19)
#27 0x00005c3a983b8405 main (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x385405)
#28 0x00007f10d642a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#29 0x00007f10d642a28b call_init ./csu/../csu/libc-start.c:128:20
#30 0x00007f10d642a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#31 0x00005c3a98432045 _start (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x3ff045)
Aborted (core dumped)
```

Contributor guide

Open the contributing guide

Research direction

Start in clang/lib/Tooling/Syntax/BuildTree.cpp at TreeBuilder::getRange, especially the assertion at line 455 and the BuildTreeVisitor path shown in the stack trace. Reproduce the failure with the provided input and clang-check command. Done means this input no longer aborts on the invalid SourceRange while dumping tokens.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.