llvm / llvm/llvm-project

[clang][objective-c] crash at CGObjCMac.cpp `__autoreleasing`

Open
#218,317 3 comments 0 reactions 0 assignees View on GitHub
clang:codegen crash generated by fuzzer objective-c++ regression:19
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

The following code:

```objective-c++
@interface Foo {
id __autoreleasing z; // expected-error {{instance variables cannot have __autoreleasing ownership}}
}
@end
@implementation Foo
@end
```

Resulted in this output:
```
/tmp/test.mm:2:24: error: instance variables cannot have __autoreleasing ownership
2 | id __autoreleasing z; // expected-error {{instance variables cannot have __autoreleasing ownership}}
| ^
/tmp/test.mm:1:12: warning: class 'Foo' defined without specifying a base class [-Wobjc-root-class]
1 | @interface Foo {
| ^
/tmp/test.mm:1:15: note: add a super class to fix this problem
1 | @interface Foo {
| ^
autoreleasing ivar?
UNREACHABLE executed at /home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-project/clang/lib/CodeGen/CGObjCMac.cpp:2913!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-clang-install/bin/clang++ -emit-llvm -S -O0 -std=c++11 -fblocks -fobjc-runtime=macosx-10.14 -fobjc-arc -fno-inline -target x86_64-apple-darwin11 -ffreestanding /tmp/test.mm
1. parser at end of file
2. /tmp/test.mm:5:17: LLVM IR generation of declaration 'Foo'
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0 clang++ 0x000061f54fa63329 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) + 121
1 clang++ 0x000061f54fa5ffec llvm::sys::RunSignalHandlers() + 76
2 clang++ 0x000061f54fa608a8 llvm::sys::CleanupOnSignal(unsigned long) + 216
3 clang++ 0x000061f54f9a2218
4 libc.so.6 0x00007ea8a6aa2520
5 libc.so.6 0x00007ea8a6af69bc pthread_kill + 300
6 libc.so.6 0x00007ea8a6aa2476 raise + 22
7 libc.so.6 0x00007ea8a6a887f3 abort + 211
8 clang++ 0x000061f54f9ad11e
9 clang++ 0x000061f550536ecd
10 clang++ 0x000061f5505371e5
11 clang++ 0x000061f55053b19f
12 clang++ 0x000061f55054ecd1
13 clang++ 0x000061f55055092c
14 clang++ 0x000061f5501e9fa0
15 clang++ 0x000061f55058cef1
16 clang++ 0x000061f55057c0f1 clang::BackendConsumer::HandleTopLevelDecl(clang::DeclGroupRef) + 209
17 clang++ 0x000061f55225961c clang::ParseAST(clang::Sema&, bool, bool) + 508
18 clang++ 0x000061f5508fa061 clang::FrontendAction::Execute() + 65
19 clang++ 0x000061f550883e65 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) + 1589
20 clang++ 0x000061f5509d1de3 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) + 467
21 clang++ 0x000061f54d82d33e cc1_main(llvm::ArrayRef, char const*, void*) + 7166
22 clang++ 0x000061f54d82313a
23 clang++ 0x000061f54d8232cf
24 clang++ 0x000061f550608cfd
25 clang++ 0x000061f54f9a2630 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) + 160
26 clang++ 0x000061f550609b53
27 clang++ 0x000061f5505be607 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const + 167
28 clang++ 0x000061f5505c2ef0 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const + 304
29 clang++ 0x000061f5505d1004 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) + 404
30 clang++ 0x000061f54d828923 clang_main(int, char**, llvm::ToolContext const&) + 7315
31 clang++ 0x000061f54d7647f1 main + 113
32 libc.so.6 0x00007ea8a6a89d90
33 libc.so.6 0x00007ea8a6a89e40 __libc_start_main + 128
34 clang++ 0x000061f54d822765 _start + 37
clang++: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 24.0.0git (https://github.com/llvm/llvm-project.git 0976d75180f482c1175ea1f204f9bfd56dd163b1)
Target: x86_64-apple-darwin11
Thread model: posix
InstalledDir: /home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-clang-install/bin
Build config: +assertions
clang++: note: diagnostic msg:
********************

PLEASE ATTACH THE FOLLOWING CRASH REPRODUCER FILES TO THE BUG REPORT:
clang++: note: diagnostic msg: /tmp/test-be0b5c.mm
clang++: note: diagnostic msg: /tmp/test-be0b5c.sh
clang++: note: diagnostic msg:

********************
Aborted (core dumped)
```

To reproduce:
```
/home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-clang-install/bin/clang++ -S -fobjc-arc -target x86_64-apple-darwin11 ./test.mm
```

Reproduced in trunk: https://godbolt.org/z/r9a9jfzb7

It goes back to clang-19: https://godbolt.org/z/P5axnGEor

Compiler version:
```
clang version 24.0.0git (https://github.com/llvm/llvm-project.git 0976d75180f482c1175ea1f204f9bfd56dd163b1)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/fuzz/WorkSpace/fusion-fuzz/projects/clang/llvm-clang-install/bin
Build config: +assertions
```

*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*

Contributor guide

Open the contributing guide

Research direction

Reproduce the crash with the provided clang++ command and test.mm, then inspect clang/lib/CodeGen/CGObjCMac.cpp around line 2913. Trace how the invalid __autoreleasing instance variable reaches LLVM IR generation. Done means this input emits its diagnostic without hitting the unreachable assertion, with regression coverage for the reproducer.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, objective-c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.