[clang] assertion failure at clang::BinaryOperator::BinaryOperator
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
The following code:
```objective-c++
@interface B
@property B1 b1;
void testB1(B *b) {
b.b1 += { b_makeInt() };
}
```
Resulted in this output:
```
/tmp/test.mm:2:11: error: unknown type name 'B1'
2 | @property B1 b1;
| ^
/tmp/test.mm:3:6: warning: function definition inside an Objective-C container is deprecated [-Wfunction-def-in-objc-container]
3 | void testB1(B *b) {
| ^
/tmp/test.mm:4:13: error: use of undeclared identifier 'b_makeInt'
4 | b.b1 += { b_makeInt() };
| ^~~~~~~~~
clang++: /home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-project/clang/lib/AST/Expr.cpp:5066: clang::BinaryOperator::BinaryOperator(const clang::ASTContext&, clang::Expr*, clang::Expr*, clang::BinaryOperator::Opcode, clang::QualType, clang::ExprValueKind, clang::ExprObjectKind, clang::SourceLocation, clang::FPOptionsOverride): Assertion `!isCompoundAssignmentOp() && "Use CompoundAssignOperator for compound assignments"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-clang-install/bin/clang++ -S -o /dev/null -O3 -std=c++20 /tmp/test.mm
1. /tmp/test.mm:4:26: current parser token ';'
2. /tmp/test.mm:3:19: parsing function body 'testB1'
3. /tmp/test.mm:3:19: in compound statement ('{}')
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0 clang++ 0x000055b2799dc0f9 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) + 121
1 clang++ 0x000055b2799d8dcc llvm::sys::RunSignalHandlers() + 76
2 clang++ 0x000055b2799d9678 llvm::sys::CleanupOnSignal(unsigned long) + 216
3 clang++ 0x000055b27991bf88
4 libc.so.6 0x00007f8fc0596520
5 libc.so.6 0x00007f8fc05ea9fc pthread_kill + 300
6 libc.so.6 0x00007f8fc0596476 raise + 22
7 libc.so.6 0x00007f8fc057c7f3 abort + 211
8 libc.so.6 0x00007f8fc057c71b
9 libc.so.6 0x00007f8fc058de96
10 clang++ 0x000055b27d537b5b clang::BinaryOperator::BinaryOperator(clang::ASTContext const&, clang::Expr*, clang::Expr*, clang::BinaryOperatorKind, clang::QualType, clang::ExprValueKind, clang::ExprObjectKind, clang::SourceLocation, clang::FPOptionsOverride) + 795
11 clang++ 0x000055b27d5422ee clang::BinaryOperator::Create(clang::ASTContext const&, clang::Expr*, clang::Expr*, clang::BinaryOperatorKind, clang::QualType, clang::ExprValueKind, clang::ExprObjectKind, clang::SourceLocation, clang::FPOptionsOverride) + 126
12 clang++ 0x000055b27caff03a clang::SemaPseudoObject::checkAssignment(clang::Scope*, clang::SourceLocation, clang::BinaryOperatorKind, clang::Expr*, clang::Expr*) + 154
13 clang++ 0x000055b27c726111 clang::Sema::ActOnBinOp(clang::Scope*, clang::SourceLocation, clang::tok::TokenKind, clang::Expr*, clang::Expr*) + 209
14 clang++ 0x000055b27c1eedd4 clang::Parser::ParseRHSOfBinaryExpression(clang::ActionResult, clang::prec::Level) + 772
15 clang++ 0x000055b27c1f1d7d clang::Parser::ParseExpression(clang::TypoCorrectionTypeBehavior) + 13
16 clang++ 0x000055b27c281f81 clang::Parser::ParseExprStatement(clang::Parser::ParsedStmtContext) + 81
17 clang++ 0x000055b27c279b7b clang::Parser::ParseStatementOrDeclarationAfterAttributes(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::ParsedAttributes&, clang::ParsedAttributes&, clang::LabelDecl*) + 5547
18 clang++ 0x000055b27c27a54b clang::Parser::ParseStatementOrDeclaration(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::LabelDecl*) + 363
19 clang++ 0x000055b27c2827f7 clang::Parser::ParseCompoundStatementBody(bool) + 1639
20 clang++ 0x000055b27c28304f clang::Parser::ParseFunctionStatementBody(clang::Decl*, clang::Parser::ParseScope&) + 207
21 clang++ 0x000055b27c17632f clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::LateParsedAttrList*) + 2559
22 clang++ 0x000055b27c1bfeb4 clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) + 5140
23 clang++ 0x000055b27c16f15c clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) + 924
24 clang++ 0x000055b27c16f809 clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) + 665
25 clang++ 0x000055b27c22cba0 clang::Parser::ParseObjCInterfaceDeclList(clang::tok::ObjCKeywordKind, clang::Decl*) + 480
26 clang++ 0x000055b27c22e686 clang::Parser::ParseObjCAtInterfaceDeclaration(clang::SourceLocation, clang::ParsedAttributes&) + 1254
27 clang++ 0x000055b27c22f445 clang::Parser::ParseObjCAtDirectives(clang::ParsedAttributes&, clang::ParsedAttributes&) + 1317
28 clang++ 0x000055b27c17be70 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) + 2720
29 clang++ 0x000055b27c17c7df clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) + 575
30 clang++ 0x000055b27c17cbf4 clang::Parser::ParseFirstTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) + 68
31 clang++ 0x000055b27c1596db clang::ParseAST(clang::Sema&, bool, bool) + 539
32 clang++ 0x000055b27a6d2071 clang::FrontendAction::Execute() + 65
33 clang++ 0x000055b27a65bc65 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) + 1589
34 clang++ 0x000055b27a7adea3 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) + 467
35 clang++ 0x000055b2783b0c96 cc1_main(llvm::ArrayRef, char const*, void*) + 7046
36 clang++ 0x000055b2783a6a2a
37 clang++ 0x000055b2783a6bbf
38 clang++ 0x000055b27a3e335d
39 clang++ 0x000055b27991c3a0 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) + 160
40 clang++ 0x000055b27a3e41b3
41 clang++ 0x000055b27a399987 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const + 167
42 clang++ 0x000055b27a39e1e0 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const + 304
43 clang++ 0x000055b27a3abe44 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) + 404
44 clang++ 0x000055b2783ac2d3 clang_main(int, char**, llvm::ToolContext const&) + 7267
45 clang++ 0x000055b2782fe7a1 main + 113
46 libc.so.6 0x00007f8fc057dd90
47 libc.so.6 0x00007f8fc057de40 __libc_start_main + 128
48 clang++ 0x000055b2783a6055 _start + 37
clang++: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 24.0.0git (https://github.com/llvm/llvm-project.git aefba88f46a6e55645c848f58f6ba56944d5ae62)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-clang-install/bin
Build config: +assertions
clang++: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING CRASH REPRODUCER FILES TO THE BUG REPORT:
clang++: note: diagnostic msg: /tmp/test-234715.mm
clang++: note: diagnostic msg: /tmp/test-234715.sh
clang++: note: diagnostic msg:
********************
Aborted (core dumped)
```
To reproduce:
```
/home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-clang-install/bin/clang++ ./test.mm
```
Compiler version:
```
clang version 24.0.0git (https://github.com/llvm/llvm-project.git aefba88f46a6e55645c848f58f6ba56944d5ae62)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-clang-install/bin
Build config: +assertions
```
*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*
Contributor guide
Research direction
Reproduce the assertion with the provided test.mm command, then inspect clang/lib/AST/Expr.cpp around BinaryOperator::BinaryOperator and SemaPseudoObject::checkAssignment, both named in the stack trace. Trace how the malformed Objective-C++ compound assignment reaches the assertion and add a regression test using this reproducer. Done means the compiler no longer aborts on the input and reports diagnostics normally.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, objective-c
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100