llvm / llvm/llvm-project

[clang] __builtin_memset_inline with negative size causes compiler to be killed(SIGKILL)

Open
#216,054 4 comments 0 reactions 0 assignees View on GitHub
clang:frontend crash generated by fuzzer llvm:SelectionDAG
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Clang trunk on x86-64 fails to compile the following testcase:
Reproducer: https://godbolt.org/z/W893PsEj3

```c
void fun(void *dst, char value) {

__builtin_memset_inline(dst, value, -1);
}
```

The compiler is terminated with SIGKILL:

```
Program terminated with signal: SIGKILL
Compiler returned: 137
```

The issue only occurs when the size argument is negative. Non-negative constant sizes compile normally.

This reproduces on Clang trunk, and the issue can be traced back to Clang 15.0.0.
This testcase was generated by fuzzer.

Contributor guide

Open the contributing guide

Research direction

Start with the Godbolt reproducer and trace Clang's handling of __builtin_memset_inline when its constant size is negative. Compare this path with non-negative sizes and add a regression test showing that the negative-size case no longer terminates the compiler with SIGKILL.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.