llvm / llvm/llvm-project

[clang-check][syntax] Crash in TraverseCXXOperatorCallExpr: Assertion `getOperatorNodeKind(*S) == syntax::NodeKind::PostfixUnaryOperatorExpression' ` ailed.

Open
#207,666 0 comments 0 reactions 0 assignees View on GitHub
clang-tools-extra clang:tooling crash generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

This input is generated by a fuzzer.
Seems to be valid?
```cxx
struct Loc {
int operator()(const char *f = "") const;
};

void g() {
Loc()();
}
```

```
clang-check --tokens-dump example.cpp -- -xc++ -std=c++23
```

```
clang-check: /home/ubuntu2404/llvm-project-196067/clang/lib/Tooling/Syntax/BuildTree.cpp:1253: bool {anonymous}::BuildTreeVisitor::TraverseCXXOperatorCallExpr(clang::CXXOperatorCallExpr*): Assertion `getOperatorNodeKind(*S) == syntax::NodeKind::PostfixUnaryOperatorExpression' failed.
#0 0x00006213f783a1f1 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x96d1f1)
#1 0x00006213f7836dac llvm::sys::RunSignalHandlers() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x969dac)
#2 0x00006213f7836f0c SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x0000707b8ae45330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x0000707b8ae9eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#5 0x0000707b8ae9eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#6 0x0000707b8ae9eb2c pthread_kill ./nptl/pthread_kill.c:89:10
#7 0x0000707b8ae4527e raise ./signal/../sysdeps/posix/raise.c:27:6
#8 0x0000707b8ae288ff abort ./stdlib/abort.c:81:7
#9 0x0000707b8ae2881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x0000707b8ae3b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#11 0x00006213f7be0944 clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::dataTraverseNode(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) BuildTree.cpp:0:0
#12 0x00006213f7be19be clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) (.constprop.0) BuildTree.cpp:0:0
#13 0x00006213f7be3bfc clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseCompoundStmt(clang::CompoundStmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) BuildTree.cpp:0:0
#14 0x00006213f7be19be clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) (.constprop.0) BuildTree.cpp:0:0
#15 0x00006213f7bec740 clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseFunctionHelper(clang::FunctionDecl*) BuildTree.cpp:0:0
#16 0x00006213f7bd8ddc clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseDecl(clang::Decl*) BuildTree.cpp:0:0
#17 0x00006213f7bd9aea clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseDeclContextHelper(clang::DeclContext*) BuildTree.cpp:0:0
#18 0x00006213f7bf283b clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseTranslationUnitDecl(clang::TranslationUnitDecl*) BuildTree.cpp:0:0
#19 0x00006213f7bd9439 clang::syntax::buildSyntaxTree(clang::syntax::Arena&, clang::syntax::TokenBufferTokenManager&, clang::ASTContext&) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xd0c439)
#20 0x00006213f72cd4af (anonymous namespace)::DumpSyntaxTree::CreateASTConsumer(clang::CompilerInstance&, llvm::StringRef)::Consumer::HandleTranslationUnit(clang::ASTContext&) ClangCheck.cpp:0:0
#21 0x00006213f9103f9c clang::ParseAST(clang::Sema&, bool, bool) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x2236f9c)
#22 0x00006213f7891271 clang::FrontendAction::Execute() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x9c4271)
#23 0x00006213f78dd308 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xa10308)
#24 0x00006213f7bb9cb7 clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr, clang::FileManager*, std::shared_ptr, clang::DiagnosticConsumer*) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xceccb7)
#25 0x00006213f7bb3b2a clang::tooling::ToolInvocation::runInvocation(char const*, clang::driver::Compilation*, std::shared_ptr, std::shared_ptr) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xce6b2a)
#26 0x00006213f7bb61e2 clang::tooling::ToolInvocation::run() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xce91e2)
#27 0x00006213f7bb7e19 clang::tooling::ClangTool::run(clang::tooling::ToolAction*) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xceae19)
#28 0x00006213f7252405 main (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x385405)
#29 0x0000707b8ae2a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#30 0x0000707b8ae2a28b call_init ./csu/../csu/libc-start.c:128:20
#31 0x0000707b8ae2a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#32 0x00006213f72cc045 _start (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x3ff045)
Aborted (core dumped)
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the crash with clang-check using the C++23 input and --tokens-dump options shown in the issue. Then inspect clang/lib/Tooling/Syntax/BuildTree.cpp around TraverseCXXOperatorCallExpr at line 1253, focusing on the failing operator-node assertion. Done means the input is processed without an assertion failure and the regression is covered by an appropriate test.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.