llvm / llvm/llvm-project

[clang] assertion failure at clang::BinaryOperator::BinaryOperator

Open
#209,674 1 comment 0 reactions 0 assignees View on GitHub
clang:frontend crash generated by fuzzer objective-c++
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

The following code:

```objective-c++
@interface B
@property B1 b1;
void testB1(B *b) {
b.b1 += { b_makeInt() };
}
```

Resulted in this output:
```
/tmp/test.mm:2:11: error: unknown type name 'B1'
2 | @property B1 b1;
| ^
/tmp/test.mm:3:6: warning: function definition inside an Objective-C container is deprecated [-Wfunction-def-in-objc-container]
3 | void testB1(B *b) {
| ^
/tmp/test.mm:4:13: error: use of undeclared identifier 'b_makeInt'
4 | b.b1 += { b_makeInt() };
| ^~~~~~~~~
clang++: /home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-project/clang/lib/AST/Expr.cpp:5066: clang::BinaryOperator::BinaryOperator(const clang::ASTContext&, clang::Expr*, clang::Expr*, clang::BinaryOperator::Opcode, clang::QualType, clang::ExprValueKind, clang::ExprObjectKind, clang::SourceLocation, clang::FPOptionsOverride): Assertion `!isCompoundAssignmentOp() && "Use CompoundAssignOperator for compound assignments"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-clang-install/bin/clang++ -S -o /dev/null -O3 -std=c++20 /tmp/test.mm
1. /tmp/test.mm:4:26: current parser token ';'
2. /tmp/test.mm:3:19: parsing function body 'testB1'
3. /tmp/test.mm:3:19: in compound statement ('{}')
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0 clang++ 0x000055b2799dc0f9 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) + 121
1 clang++ 0x000055b2799d8dcc llvm::sys::RunSignalHandlers() + 76
2 clang++ 0x000055b2799d9678 llvm::sys::CleanupOnSignal(unsigned long) + 216
3 clang++ 0x000055b27991bf88
4 libc.so.6 0x00007f8fc0596520
5 libc.so.6 0x00007f8fc05ea9fc pthread_kill + 300
6 libc.so.6 0x00007f8fc0596476 raise + 22
7 libc.so.6 0x00007f8fc057c7f3 abort + 211
8 libc.so.6 0x00007f8fc057c71b
9 libc.so.6 0x00007f8fc058de96
10 clang++ 0x000055b27d537b5b clang::BinaryOperator::BinaryOperator(clang::ASTContext const&, clang::Expr*, clang::Expr*, clang::BinaryOperatorKind, clang::QualType, clang::ExprValueKind, clang::ExprObjectKind, clang::SourceLocation, clang::FPOptionsOverride) + 795
11 clang++ 0x000055b27d5422ee clang::BinaryOperator::Create(clang::ASTContext const&, clang::Expr*, clang::Expr*, clang::BinaryOperatorKind, clang::QualType, clang::ExprValueKind, clang::ExprObjectKind, clang::SourceLocation, clang::FPOptionsOverride) + 126
12 clang++ 0x000055b27caff03a clang::SemaPseudoObject::checkAssignment(clang::Scope*, clang::SourceLocation, clang::BinaryOperatorKind, clang::Expr*, clang::Expr*) + 154
13 clang++ 0x000055b27c726111 clang::Sema::ActOnBinOp(clang::Scope*, clang::SourceLocation, clang::tok::TokenKind, clang::Expr*, clang::Expr*) + 209
14 clang++ 0x000055b27c1eedd4 clang::Parser::ParseRHSOfBinaryExpression(clang::ActionResult, clang::prec::Level) + 772
15 clang++ 0x000055b27c1f1d7d clang::Parser::ParseExpression(clang::TypoCorrectionTypeBehavior) + 13
16 clang++ 0x000055b27c281f81 clang::Parser::ParseExprStatement(clang::Parser::ParsedStmtContext) + 81
17 clang++ 0x000055b27c279b7b clang::Parser::ParseStatementOrDeclarationAfterAttributes(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::ParsedAttributes&, clang::ParsedAttributes&, clang::LabelDecl*) + 5547
18 clang++ 0x000055b27c27a54b clang::Parser::ParseStatementOrDeclaration(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::LabelDecl*) + 363
19 clang++ 0x000055b27c2827f7 clang::Parser::ParseCompoundStatementBody(bool) + 1639
20 clang++ 0x000055b27c28304f clang::Parser::ParseFunctionStatementBody(clang::Decl*, clang::Parser::ParseScope&) + 207
21 clang++ 0x000055b27c17632f clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::LateParsedAttrList*) + 2559
22 clang++ 0x000055b27c1bfeb4 clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) + 5140
23 clang++ 0x000055b27c16f15c clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) + 924
24 clang++ 0x000055b27c16f809 clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) + 665
25 clang++ 0x000055b27c22cba0 clang::Parser::ParseObjCInterfaceDeclList(clang::tok::ObjCKeywordKind, clang::Decl*) + 480
26 clang++ 0x000055b27c22e686 clang::Parser::ParseObjCAtInterfaceDeclaration(clang::SourceLocation, clang::ParsedAttributes&) + 1254
27 clang++ 0x000055b27c22f445 clang::Parser::ParseObjCAtDirectives(clang::ParsedAttributes&, clang::ParsedAttributes&) + 1317
28 clang++ 0x000055b27c17be70 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) + 2720
29 clang++ 0x000055b27c17c7df clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) + 575
30 clang++ 0x000055b27c17cbf4 clang::Parser::ParseFirstTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) + 68
31 clang++ 0x000055b27c1596db clang::ParseAST(clang::Sema&, bool, bool) + 539
32 clang++ 0x000055b27a6d2071 clang::FrontendAction::Execute() + 65
33 clang++ 0x000055b27a65bc65 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) + 1589
34 clang++ 0x000055b27a7adea3 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) + 467
35 clang++ 0x000055b2783b0c96 cc1_main(llvm::ArrayRef, char const*, void*) + 7046
36 clang++ 0x000055b2783a6a2a
37 clang++ 0x000055b2783a6bbf
38 clang++ 0x000055b27a3e335d
39 clang++ 0x000055b27991c3a0 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) + 160
40 clang++ 0x000055b27a3e41b3
41 clang++ 0x000055b27a399987 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const + 167
42 clang++ 0x000055b27a39e1e0 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const + 304
43 clang++ 0x000055b27a3abe44 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) + 404
44 clang++ 0x000055b2783ac2d3 clang_main(int, char**, llvm::ToolContext const&) + 7267
45 clang++ 0x000055b2782fe7a1 main + 113
46 libc.so.6 0x00007f8fc057dd90
47 libc.so.6 0x00007f8fc057de40 __libc_start_main + 128
48 clang++ 0x000055b2783a6055 _start + 37
clang++: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 24.0.0git (https://github.com/llvm/llvm-project.git aefba88f46a6e55645c848f58f6ba56944d5ae62)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-clang-install/bin
Build config: +assertions
clang++: note: diagnostic msg:
********************

PLEASE ATTACH THE FOLLOWING CRASH REPRODUCER FILES TO THE BUG REPORT:
clang++: note: diagnostic msg: /tmp/test-234715.mm
clang++: note: diagnostic msg: /tmp/test-234715.sh
clang++: note: diagnostic msg:

********************
Aborted (core dumped)

```

To reproduce:
```
/home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-clang-install/bin/clang++ ./test.mm
```

Compiler version:
```
clang version 24.0.0git (https://github.com/llvm/llvm-project.git aefba88f46a6e55645c848f58f6ba56944d5ae62)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-clang-install/bin
Build config: +assertions
```

*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*

Contributor guide

Open the contributing guide

Research direction

Reproduce the assertion with the provided test.mm command, then inspect clang/lib/AST/Expr.cpp around BinaryOperator::BinaryOperator and SemaPseudoObject::checkAssignment, both named in the stack trace. Trace how the malformed Objective-C++ compound assignment reaches the assertion and add a regression test using this reproducer. Done means the compiler no longer aborts on the input and reports diagnostics normally.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, objective-c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.