llvm / llvm/llvm-project

Assertion failed: SemaTemplateInstantiate.cpp:4792: "declaration not instantiated in this scope" when using non-constant case label

Open
#212,239 2 comments 0 reactions 0 assignees View on GitHub
clang:frontend crash-on-invalid generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

```cpp
extern int sink(int a);

template
void func(T* p, long l = 0)
{
T t = 0;
switch (t)
{
case l:
int x = 0;
sink(x);
break;
}
}

int main()
{
long j = 0;
func(&j);
}
```
Triggers on trunk: https://github.com/llvm/llvm-project/commit/40f8720c5db91fdf753133af05ba14ce7c3e44d
https://godbolt.org/z/Pxbx3E78j
This bug was found via a fuzzer.

Bissect with compiler explorer:
Crashes on 7.0.0 assertions: https://godbolt.org/z/1PjK144a6
Does not crash on 6.0.0 assertions: https://godbolt.org/z/rzrq8d5Tn

Notably this looks very similar to https://github.com/llvm/llvm-project/issues/140898 but that reproducer does not crash on 7.0.0

Stacktrace:
```sh
$ clang /tmp/bug.cpp
/tmp/bug.cpp:9:14: error: case value is not a constant expression
9 | case l:
| ^
/tmp/bug.cpp:19:5: note: in instantiation of function template specialization 'func' requested here
19 | func(&j);
| ^
/tmp/bug.cpp:9:14: note: function parameter 'l' with unknown value cannot be used in a constant expression
9 | case l:
| ^
/tmp/bug.cpp:4:22: note: declared here
4 | void func(T* p, long l = 0)
| ^
clang-24: /home/user/software/llvm-install/slot-a/src/clang/lib/Sema/SemaTemplateInstantiate.cpp:4792: llvm::PointerUnion*>* clang::LocalInstantiationScope::findInstantiationOf(const clang::Decl*): Assertion `isa(D) && "declaration not instantiated in this scope"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /home/user/software/llvm-install/slot-a/bin/clang-24 -cc1 -triple x86_64-unknown-linux-gnu -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name bug.cpp -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/home/user/research/templfuzz-core -fcoverage-compilation-dir=/home/user/research/templfuzz-core -resource-dir /home/user/software/llvm-install/slot-a/lib/clang/24 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/x86_64-linux-gnu/c++/14 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/backward -internal-isystem /home/user/software/llvm-install/slot-a/lib/clang/24/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdeprecated-macro -ferror-limit 19 -fmessage-length=106 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcxx-exceptions -fexceptions -faddrsig -fdwarf2-cfi-asm -o /tmp/bug-07d30f.o -x c++ /tmp/bug.cpp
1. parser at end of file
2. /tmp/bug.cpp:4:6: instantiating function definition 'func'
#0 0x00005c4d9707af61 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/user/software/llvm-install/slot-a/bin/clang-24+0x1ec3f61)
#1 0x00005c4d9707786c llvm::sys::RunSignalHandlers() (/home/user/software/llvm-install/slot-a/bin/clang-24+0x1ec086c)
#2 0x00005c4d970779ce SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00005c4d97077a8c SignalHandlerTerminate(int, siginfo_t*, void*) Signals.cpp:0:0
#4 0x00007de0d3845330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#5 0x00007de0d389eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#6 0x00007de0d389eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#7 0x00007de0d389eb2c pthread_kill ./nptl/pthread_kill.c:89:10
#8 0x00007de0d384527e raise ./signal/../sysdeps/posix/raise.c:27:6
#9 0x00007de0d38288ff abort ./stdlib/abort.c:81:7
#10 0x00007de0d382881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#11 0x00007de0d383b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#12 0x00005c4d9a3a864f clang::LocalInstantiationScope::findInstantiationOf(clang::Decl const*) (/home/user/software/llvm-install/slot-a/bin/clang-24+0x51f164f)
#13 0x00005c4d9a49ced9 clang::Sema::FindInstantiatedDecl(clang::SourceLocation, clang::NamedDecl*, clang::MultiLevelTemplateArgumentList const&, bool) (/home/user/software/llvm-install/slot-a/bin/clang-24+0x52e5ed9)
#14 0x00005c4d9a435215 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformDeclRefExpr(clang::DeclRefExpr*) SemaTemplateInstantiate.cpp:0:0
#15 0x00005c4d9a3f2988 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformExpr(clang::Expr*) SemaTemplateInstantiate.cpp:0:0
#16 0x00005c4d9a4229c5 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformExprs(clang::Expr* const*, unsigned int, bool, llvm::SmallVectorImpl&, bool*) SemaTemplateInstantiate.cpp:0:0
#17 0x00005c4d9a426e33 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformCallExpr(clang::CallExpr*) SemaTemplateInstantiate.cpp:0:0
#18 0x00005c4d9a3ee363 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformStmt(clang::Stmt*, clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::StmtDiscardKind) SemaTemplateInstantiate.cpp:0:0
#19 0x00005c4d9a3eece0 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformCompoundStmt(clang::CompoundStmt*, bool) SemaTemplateInstantiate.cpp:0:0
#20 0x00005c4d9a3f426b clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformSwitchStmt(clang::SwitchStmt*) SemaTemplateInstantiate.cpp:0:0
#21 0x00005c4d9a3eece0 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformCompoundStmt(clang::CompoundStmt*, bool) SemaTemplateInstantiate.cpp:0:0
#22 0x00005c4d9a3ef893 clang::Sema::SubstStmt(clang::Stmt*, clang::MultiLevelTemplateArgumentList const&) (/home/user/software/llvm-install/slot-a/bin/clang-24+0x5238893)
#23 0x00005c4d9a4a52a3 clang::Sema::InstantiateFunctionDefinition(clang::SourceLocation, clang::FunctionDecl*, bool, bool, bool) (/home/user/software/llvm-install/slot-a/bin/clang-24+0x52ee2a3)
#24 0x00005c4d9a4a3484 clang::Sema::PerformPendingInstantiations(bool, bool) (/home/user/software/llvm-install/slot-a/bin/clang-24+0x52ec484)
#25 0x00005c4d999f6039 clang::Sema::ActOnEndOfTranslationUnitFragment(clang::TUFragmentKind) (.part.0) Sema.cpp:0:0
#26 0x00005c4d999f63a9 clang::Sema::ActOnEndOfTranslationUnit() (/home/user/software/llvm-install/slot-a/bin/clang-24+0x483f3a9)
#27 0x00005c4d9985c4da clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/home/user/software/llvm-install/slot-a/bin/clang-24+0x46a54da)
#28 0x00005c4d99839a19 clang::ParseAST(clang::Sema&, bool, bool) (/home/user/software/llvm-install/slot-a/bin/clang-24+0x4682a19)
#29 0x00005c4d97d793c1 clang::FrontendAction::Execute() (/home/user/software/llvm-install/slot-a/bin/clang-24+0x2bc23c1)
#30 0x00005c4d97d00ef8 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/home/user/software/llvm-install/slot-a/bin/clang-24+0x2b49ef8)
#31 0x00005c4d97e554ce clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/home/user/software/llvm-install/slot-a/bin/clang-24+0x2c9e4ce)
#32 0x00005c4d95a30449 cc1_main(llvm::ArrayRef, char const*, void*) (/home/user/software/llvm-install/slot-a/bin/clang-24+0x879449)
#33 0x00005c4d95a26637 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#34 0x00005c4d95a2b383 clang_main(int, char**, llvm::ToolContext const&) (/home/user/software/llvm-install/slot-a/bin/clang-24+0x874383)
#35 0x00005c4d95972800 main (/home/user/software/llvm-install/slot-a/bin/clang-24+0x7bb800)
#36 0x00007de0d382a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#37 0x00007de0d382a28b call_init ./csu/../csu/libc-start.c:128:20
#38 0x00007de0d382a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#39 0x00005c4d95a25ab5 _start (/home/user/software/llvm-install/slot-a/bin/clang-24+0x86eab5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed with exit code -2 (use -v to see invocation)
clang version 24.0.0git (https://github.com/llvm/llvm-project.git 40f8720c5db91fdf753133af05ba14ce7c3e44d7)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/user/software/llvm-install/slot-a/bin
Build config: +assertions
clang: note: diagnostic msg:
********************

PLEASE ATTACH THE FOLLOWING CRASH REPRODUCER FILES TO THE BUG REPORT:
clang: note: diagnostic msg: /tmp/bug-dcd6ba.cpp
clang: note: diagnostic msg: /tmp/bug-dcd6ba.sh
clang: note: diagnostic msg:

********************
Aborted (core dumped)
```

Contributor guide

Open the contributing guide

Research direction

Start with the reproducer in the issue and inspect clang/lib/Sema/SemaTemplateInstantiate.cpp around LocalInstantiationScope::findInstantiationOf at line 4792. Run the provided clang command with assertions enabled and trace template instantiation through TransformSwitchStmt. Done means the non-constant case label produces a diagnostic without triggering the assertion or crashing.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.