llvm / llvm/llvm-project

[clang-check][syntax] Crash in TreeBuilder::getRange: assertion `Last.isValid( )` fails when dumping syntax

Open
#207,578 0 comments 0 reactions 0 assignees View on GitHub
clang-tools-extra crash-on-invalid generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

This input is generated by a fuzzer.

```c
( foo
```
```
clang-check \
--syntax-tree-dump \
exmaple.c \
-- -xc -std=c11
```

stacktrace:

```
clang-check: /home/ubuntu2404/llvm-project-196067/clang/lib/Tooling/Syntax/BuildTree.cpp:465: llvm::ArrayRef clang::syntax::TreeBuilder::getRange(clang::SourceLocation, clang::SourceLocation) const: Assertion `Last.isValid()' failed.
#0 0x00005b2b20cd31f1 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x96d1f1)
#1 0x00005b2b20ccfdac llvm::sys::RunSignalHandlers() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x969dac)
#2 0x00005b2b20ccff0c SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x000077bf34e45330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x000077bf34e9eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#5 0x000077bf34e9eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#6 0x000077bf34e9eb2c pthread_kill ./nptl/pthread_kill.c:89:10
#7 0x000077bf34e4527e raise ./signal/../sysdeps/posix/raise.c:27:6
#8 0x000077bf34e288ff abort ./stdlib/abort.c:81:7
#9 0x000077bf34e2881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x000077bf34e3b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#11 0x00005b2b21067cfb clang::syntax::TreeBuilder::getRange(clang::SourceLocation, clang::SourceLocation) const (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xd01cfb)
#12 0x00005b2b21073b9f clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseTypeLoc(clang::TypeLoc, bool) (.constprop.0) BuildTree.cpp:0:0
#13 0x00005b2b2108ad25 clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseVarDecl(clang::VarDecl*) BuildTree.cpp:0:0
#14 0x00005b2b21072aea clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseDeclContextHelper(clang::DeclContext*) BuildTree.cpp:0:0
#15 0x00005b2b2108b83b clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseTranslationUnitDecl(clang::TranslationUnitDecl*) BuildTree.cpp:0:0
#16 0x00005b2b21072439 clang::syntax::buildSyntaxTree(clang::syntax::Arena&, clang::syntax::TokenBufferTokenManager&, clang::ASTContext&) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xd0c439)
#17 0x00005b2b207664af (anonymous namespace)::DumpSyntaxTree::CreateASTConsumer(clang::CompilerInstance&, llvm::StringRef)::Consumer::HandleTranslationUnit(clang::ASTContext&) ClangCheck.cpp:0:0
#18 0x00005b2b2259cf9c clang::ParseAST(clang::Sema&, bool, bool) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x2236f9c)
#19 0x00005b2b20d2a271 clang::FrontendAction::Execute() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x9c4271)
#20 0x00005b2b20d76308 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xa10308)
#21 0x00005b2b21052cb7 clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr, clang::FileManager*, std::shared_ptr, clang::DiagnosticConsumer*) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xceccb7)
#22 0x00005b2b2104cb2a clang::tooling::ToolInvocation::runInvocation(char const*, clang::driver::Compilation*, std::shared_ptr, std::shared_ptr) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xce6b2a)
#23 0x00005b2b2104f1e2 clang::tooling::ToolInvocation::run() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xce91e2)
#24 0x00005b2b21050e19 clang::tooling::ClangTool::run(clang::tooling::ToolAction*) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xceae19)
#25 0x00005b2b206eb405 main (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x385405)
#26 0x000077bf34e2a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#27 0x000077bf34e2a28b call_init ./csu/../csu/libc-start.c:128:20
#28 0x000077bf34e2a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#29 0x00005b2b20765045 _start (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x3ff045)
Aborted (core dumped)
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the crash with the provided `( foo` input and clang-check syntax-tree-dump command. Start in clang/lib/Tooling/Syntax/BuildTree.cpp at TreeBuilder::getRange and the assertion on line 465, then trace the caller shown in BuildTree.cpp. Done means this malformed input no longer aborts while dumping its syntax tree.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.