[clang-check][syntax] Crash in TraverseCXXOperatorCallExpr: Assertion `getOperatorNodeKind(*S) == syntax::NodeKind::PostfixUnaryOperatorExpression' ` ailed.
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
This input is generated by a fuzzer.
Seems to be valid?
```cxx
struct Loc {
int operator()(const char *f = "") const;
};
void g() {
Loc()();
}
```
```
clang-check --tokens-dump example.cpp -- -xc++ -std=c++23
```
```
clang-check: /home/ubuntu2404/llvm-project-196067/clang/lib/Tooling/Syntax/BuildTree.cpp:1253: bool {anonymous}::BuildTreeVisitor::TraverseCXXOperatorCallExpr(clang::CXXOperatorCallExpr*): Assertion `getOperatorNodeKind(*S) == syntax::NodeKind::PostfixUnaryOperatorExpression' failed.
#0 0x00006213f783a1f1 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x96d1f1)
#1 0x00006213f7836dac llvm::sys::RunSignalHandlers() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x969dac)
#2 0x00006213f7836f0c SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x0000707b8ae45330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x0000707b8ae9eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#5 0x0000707b8ae9eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#6 0x0000707b8ae9eb2c pthread_kill ./nptl/pthread_kill.c:89:10
#7 0x0000707b8ae4527e raise ./signal/../sysdeps/posix/raise.c:27:6
#8 0x0000707b8ae288ff abort ./stdlib/abort.c:81:7
#9 0x0000707b8ae2881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x0000707b8ae3b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#11 0x00006213f7be0944 clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::dataTraverseNode(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) BuildTree.cpp:0:0
#12 0x00006213f7be19be clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) (.constprop.0) BuildTree.cpp:0:0
#13 0x00006213f7be3bfc clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseCompoundStmt(clang::CompoundStmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) BuildTree.cpp:0:0
#14 0x00006213f7be19be clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) (.constprop.0) BuildTree.cpp:0:0
#15 0x00006213f7bec740 clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseFunctionHelper(clang::FunctionDecl*) BuildTree.cpp:0:0
#16 0x00006213f7bd8ddc clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseDecl(clang::Decl*) BuildTree.cpp:0:0
#17 0x00006213f7bd9aea clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseDeclContextHelper(clang::DeclContext*) BuildTree.cpp:0:0
#18 0x00006213f7bf283b clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseTranslationUnitDecl(clang::TranslationUnitDecl*) BuildTree.cpp:0:0
#19 0x00006213f7bd9439 clang::syntax::buildSyntaxTree(clang::syntax::Arena&, clang::syntax::TokenBufferTokenManager&, clang::ASTContext&) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xd0c439)
#20 0x00006213f72cd4af (anonymous namespace)::DumpSyntaxTree::CreateASTConsumer(clang::CompilerInstance&, llvm::StringRef)::Consumer::HandleTranslationUnit(clang::ASTContext&) ClangCheck.cpp:0:0
#21 0x00006213f9103f9c clang::ParseAST(clang::Sema&, bool, bool) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x2236f9c)
#22 0x00006213f7891271 clang::FrontendAction::Execute() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x9c4271)
#23 0x00006213f78dd308 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xa10308)
#24 0x00006213f7bb9cb7 clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr, clang::FileManager*, std::shared_ptr, clang::DiagnosticConsumer*) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xceccb7)
#25 0x00006213f7bb3b2a clang::tooling::ToolInvocation::runInvocation(char const*, clang::driver::Compilation*, std::shared_ptr, std::shared_ptr) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xce6b2a)
#26 0x00006213f7bb61e2 clang::tooling::ToolInvocation::run() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xce91e2)
#27 0x00006213f7bb7e19 clang::tooling::ClangTool::run(clang::tooling::ToolAction*) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xceae19)
#28 0x00006213f7252405 main (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x385405)
#29 0x0000707b8ae2a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#30 0x0000707b8ae2a28b call_init ./csu/../csu/libc-start.c:128:20
#31 0x0000707b8ae2a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#32 0x00006213f72cc045 _start (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x3ff045)
Aborted (core dumped)
```
Contributor guide
Research direction
Reproduce the crash with clang-check using the C++23 input and --tokens-dump options shown in the issue. Then inspect clang/lib/Tooling/Syntax/BuildTree.cpp around TraverseCXXOperatorCallExpr at line 1253, focusing on the failing operator-node assertion. Done means the input is processed without an assertion failure and the regression is covered by an appropriate test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100