llvm / llvm/llvm-project

[clang-doc] UNREACHABLE crash when serializing invalid nested type inside enum scope

Open
#210,872 0 comments 0 reactions 0 assignees View on GitHub
clang-doc crash generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

This input is generated by a fuzzer.
Source code:
```cxx
enum class E {};
struct E::S {};
```
```
clang-doc --format=html
```

```
UNREACHABLE executed at clang-tools-extra/clang-doc/Serialize.cpp:537!
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=) at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3 0x00007ffff764527e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4 0x00007ffff76288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x000055555685fc6b in llvm::llvm_unreachable_internal (msg=, file=0x5555626a48c0 "tmp/llvm-project-main-20260622-latest/clang-tools-extra/clang-doc/Serialize.cpp", line=line@entry=537) at tmp/llvm-project-main-20260622-latest/llvm/lib/Support/ErrorHandling.cpp:244
#6 0x0000555556f719c6 in clang::doc::serialize::Serializer::makeAndInsertIntoParent (this=this@entry=0x7ffff5aa5680, Child=...) at tmp/llvm-project-main-20260622-latest/clang-tools-extra/clang-doc/Serialize.cpp:537
#7 0x0000555556f6fc81 in clang::doc::serialize::Serializer::emitInfo (this=, D=, FC=, Loc=..., PublicOnly=) at tmp/llvm-project-main-20260622-latest/clang-tools-extra/clang-doc/Serialize.cpp:1163
#8 0x0000555556e1d01b in clang::doc::MapASTVisitor::mapDecl (this=, D=0x521000077918, IsDefinition=) at tmp/llvm-project-main-20260622-latest/clang-tools-extra/clang-doc/Mapper.cpp:90
#9 0x0000555556e474ec in clang::doc::MapASTVisitor::VisitRecordDecl (D=0x521000077918, this=) at llvm-project-main-20260622-latest/clang-tools-extra/clang-doc/Mapper.cpp:115
#10 clang::RecursiveASTVisitor::WalkUpFromRecordDecl (D=0x521000077918, this=) at tools/clang/include/clang/AST/DeclNodes.inc:428
#11 clang::RecursiveASTVisitor::WalkUpFromCXXRecordDecl (D=0x521000077918, this=) at tools/clang/include/clang/AST/DeclNodes.inc:432
#12 clang::RecursiveASTVisitor::TraverseCXXRecordDecl (this=0x515000001e80, D=0x521000077918) at tmp/llvm-project-main-20260622-latest/clang/include/clang/AST/RecursiveASTVisitor.h:2203
#13 0x0000555556e19dd9 in clang::RecursiveASTVisitor::TraverseDecl (this=0xc3a, this@entry=0x515000001e80, D=0xc3a, D@entry=0x521000077918) at tools/clang/include/clang/AST/DeclNodes.inc:432
#14 0x0000555556e2b4fa in clang::RecursiveASTVisitor::TraverseDeclContextHelper (this=0x515000001e80, DC=) at tmp/llvm-project-main-20260622-latest/clang/include/clang/AST/RecursiveASTVisitor.h:1653
#15 clang::RecursiveASTVisitor::TraverseTranslationUnitDecl (this=0x515000001e80, D=0x521000023108) at tmp/llvm-project-main-20260622-latest/clang/include/clang/AST/RecursiveASTVisitor.h:1773
#16 0x0000555556e18ebb in clang::RecursiveASTVisitor::TraverseDecl (this=0xc3a, this@entry=0x515000001e80, D=0xc3a) at tools/clang/include/clang/AST/DeclNodes.inc:24
#17 0x0000555556e189ff in clang::doc::MapASTVisitor::HandleTranslationUnit (this=0x515000001e80, Context=...) at tmp/llvm-project-main-20260622-latest/clang-tools-extra/clang-doc/Mapper.cpp:45
#18 0x00005555580a84c6 in clang::ParseAST (S=..., PrintStats=false, SkipFunctionBodies=) at tmp/llvm-project-main-20260622-latest/clang/lib/Parse/ParseAST.cpp:183
#19 0x0000555557cc5555 in clang::FrontendAction::Execute (this=0x516000003f80) at tmp/llvm-project-main-20260622-latest/clang/lib/Frontend/FrontendAction.cpp:1342
#20 0x0000555557a1f535 in clang::CompilerInstance::ExecuteAction (this=0x7ffff5a91c20, Act=...) at tmp/llvm-project-main-20260622-latest/clang/lib/Frontend/CompilerInstance.cpp:1027
#21 0x0000555556cd5dbd in clang::tooling::FrontendActionFactory::runInvocation (this=, Invocation=..., Files=, PCHContainerOps=..., DiagConsumer=) at tmp/llvm-project-main-20260622-latest/clang/lib/Tooling/Tooling.cpp:459
#22 0x0000555556cd4a25 in clang::tooling::ToolInvocation::runInvocation (this=, BinaryName=, Compilation=, Invocation=std::shared_ptr (empty) = {...}, PCHContainerOps=...) at tmp/llvm-project-main-20260622-latest/clang/lib/Tooling/Tooling.cpp:439
#23 0x0000555556cce5dd in clang::tooling::ToolInvocation::run (this=) at tmp/llvm-project-main-20260622-latest/clang/lib/Tooling/Tooling.cpp:424
#24 0x0000555556cde702 in clang::tooling::ClangTool::run (this=0x5150000000d0, Action=) at tmp/llvm-project-main-20260622-latest/clang/lib/Tooling/Tooling.cpp:631
#25 0x0000555556cc64d3 in clang::tooling::StandaloneToolExecutor::execute(llvm::ArrayRef >, std::function, std::allocator >, std::allocator, std::allocator > > > (std::vector, std::allocator >, std::allocator, std::allocator > > > const&, llvm::StringRef)> > >) (this=, Actions=...) at tmp/llvm-project-main-20260622-latest/clang/lib/Tooling/StandaloneExecution.cpp:66
#26 0x0000555556cb2bcf in clang::tooling::ToolExecutor::execute(std::unique_ptr >, std::function, std::allocator >, std::allocator, std::allocator > > > (std::vector, std::allocator >, std::allocator, std::allocator > > > const&, llvm::StringRef)>) (this=, Action=std::unique_ptr = {...}, Adjuster=...) at tmp/llvm-project-main-20260622-latest/clang/lib/Tooling/Execution.cpp:53
#27 0x00005555567b352d in main (argc=, argv=) at tmp/llvm-project-main-20260622-latest/clang-tools-extra/clang-doc/tool/ClangDocMain.cpp:324
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the crash with the provided enum and clang-doc --format=html command. Start at clang-tools-extra/clang-doc/Serialize.cpp:537, then follow the Mapper.cpp call path; done means this input no longer triggers the UNREACHABLE failure, with coverage for the regression if the existing clang-doc tests provide a suitable location.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
documentation, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.