llvm / llvm/llvm-project

[clang-check][syntax] Crash in shrinkToFitList: `(std::next(It) == Trees.end() || std::next(It)->first == Range.end()) && "no child with the specified range"'`

Open
#207,676 0 comments 0 reactions 0 assignees View on GitHub
clang-tools-extra clang:tooling crash generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

This input is generated by a fuzzer.
Likely related to https://github.com/llvm/llvm-project/issues/207595

```
#define F(x, y) ((x) + (y))
int foo = F(3, (int[]){1,2});

```

```
clang-check --tokens-dump example.cpp -- -xc++ -std=c++23
```

```
clang-check: /home/ubuntu2404/llvm-project-196067/clang/lib/Tooling/Syntax/BuildTree.cpp:586: void clang::syntax::TreeBuilder::Forest::assignRole(llvm::ArrayRef, clang::syntax::NodeRole): Assertion `(std::next(It) == Trees.end() || std::next(It)->first == Range.end()) && "no child with the specified range"' failed.
#0 0x000055d5e7e301f1 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x96d1f1)
#1 0x000055d5e7e2cdac llvm::sys::RunSignalHandlers() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x969dac)
#2 0x000055d5e7e2cf0c SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007342a9245330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x00007342a929eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#5 0x00007342a929eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#6 0x00007342a929eb2c pthread_kill ./nptl/pthread_kill.c:89:10
#7 0x00007342a924527e raise ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007342a92288ff abort ./stdlib/abort.c:81:7
#9 0x00007342a922881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x00007342a923b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#11 0x000055d5e81c4e34 clang::syntax::TreeBuilder::markChildToken(clang::SourceLocation, clang::syntax::NodeRole) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xd01e34)
#12 0x000055d5e81c9050 (anonymous namespace)::BuildTreeVisitor::WalkUpFromParenExpr(clang::ParenExpr*) BuildTree.cpp:0:0
#13 0x000055d5e81d94b8 clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) (.constprop.0) BuildTree.cpp:0:0
#14 0x000055d5e81dc50c clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseParenExpr(clang::ParenExpr*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) BuildTree.cpp:0:0
#15 0x000055d5e81d79be clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) (.constprop.0) BuildTree.cpp:0:0
#16 0x000055d5e81d3856 clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::dataTraverseNode(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) BuildTree.cpp:0:0
#17 0x000055d5e81d79be clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) (.constprop.0) BuildTree.cpp:0:0
#18 0x000055d5e81dc50c clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseParenExpr(clang::ParenExpr*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) BuildTree.cpp:0:0
#19 0x000055d5e81d79be clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) (.constprop.0) BuildTree.cpp:0:0
#20 0x000055d5e81dca2d clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseObjCBoxedExpr(clang::ObjCBoxedExpr*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) BuildTree.cpp:0:0
#21 0x000055d5e81d79be clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl, llvm::PointerIntPairInfo>>>*) (.constprop.0) BuildTree.cpp:0:0
#22 0x000055d5e81e7dfb clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseVarDecl(clang::VarDecl*) BuildTree.cpp:0:0
#23 0x000055d5e81cfaea clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseDeclContextHelper(clang::DeclContext*) BuildTree.cpp:0:0
#24 0x000055d5e81e883b clang::RecursiveASTVisitor<(anonymous namespace)::BuildTreeVisitor>::TraverseTranslationUnitDecl(clang::TranslationUnitDecl*) BuildTree.cpp:0:0
#25 0x000055d5e81cf439 clang::syntax::buildSyntaxTree(clang::syntax::Arena&, clang::syntax::TokenBufferTokenManager&, clang::ASTContext&) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xd0c439)
#26 0x000055d5e78c34af (anonymous namespace)::DumpSyntaxTree::CreateASTConsumer(clang::CompilerInstance&, llvm::StringRef)::Consumer::HandleTranslationUnit(clang::ASTContext&) ClangCheck.cpp:0:0
#27 0x000055d5e96f9f9c clang::ParseAST(clang::Sema&, bool, bool) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x2236f9c)
#28 0x000055d5e7e87271 clang::FrontendAction::Execute() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x9c4271)
#29 0x000055d5e7ed3308 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xa10308)
#30 0x000055d5e81afcb7 clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr, clang::FileManager*, std::shared_ptr, clang::DiagnosticConsumer*) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xceccb7)
#31 0x000055d5e81a9b2a clang::tooling::ToolInvocation::runInvocation(char const*, clang::driver::Compilation*, std::shared_ptr, std::shared_ptr) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xce6b2a)
#32 0x000055d5e81ac1e2 clang::tooling::ToolInvocation::run() (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xce91e2)
#33 0x000055d5e81ade19 clang::tooling::ClangTool::run(clang::tooling::ToolAction*) (/home/ubuntu2404/build-196067-assert/bin/clang-check+0xceae19)
#34 0x000055d5e7848405 main (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x385405)
#35 0x00007342a922a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#36 0x00007342a922a28b call_init ./csu/../csu/libc-start.c:128:20
#37 0x00007342a922a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#38 0x000055d5e78c2045 _start (/home/ubuntu2404/build-196067-assert/bin/clang-check+0x3ff045)
Aborted (core dumped)
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the crash with clang-check --tokens-dump on the supplied example.cpp using -xc++ -std=c++23. Start in clang/lib/Tooling/Syntax/BuildTree.cpp around Forest::assignRole, markChildToken, and ParenExpr traversal, then trace how the macro and compound literal produce the invalid range. Done means the command no longer hits the assertion and a regression test covers this input.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.