llvm / llvm/llvm-project

[clang] crash (out of memory) when #embed __FILE__ uses a prefix referring to a previous embedded array

Open
#219,332 5 comments 0 reactions 0 assignees View on GitHub
clang:frontend crash-on-invalid embed generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Reproducer:
https://godbolt.org/z/oYhTvzT8M
```c
char a[] = {
#embed
};

char b[] = {
#embed __FILE__ prefix([sizeof(a) - 1])
};
```

Backtrace:
```console
LLVM ERROR: out of memory
Allocation failed
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics -x c -std=c23
1. :7:2: current parser token ';'
#0 0x0000000004419288 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4419288)
#1 0x0000000004416134 llvm::sys::RunSignalHandlers() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4416134)
#2 0x000000000441676c llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x441676c)
#3 0x0000000004354378 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
#4 0x00007a6c1b445330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#5 0x00007a6c1b49ec0c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9ec0c)
#6 0x00007a6c1b44527e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#7 0x00007a6c1b4288ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#8 0x000000000435e79c (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x435e79c)
#9 0x000000000435e7b5 (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x435e7b5)
#10 0x00007a6c1b8bb9e8 operator new(unsigned long, std::align_val_t) (/lib/x86_64-linux-gnu/libstdc++.so.6+0xbb9e8)
#11 0x00007a6c1b8bba3d operator new(unsigned long, std::align_val_t, std::nothrow_t const&) (/lib/x86_64-linux-gnu/libstdc++.so.6+0xbba3d)
#12 0x0000000004388f30 llvm::allocate_buffer(unsigned long, unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4388f30)
#13 0x0000000000ef974e llvm::BumpPtrAllocatorImpl::AllocateSlow(unsigned long, unsigned long, llvm::Align) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xef974e)
#14 0x0000000008116b59 clang::ASTVector::grow(clang::ASTContext const&, unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x8116b59)
#15 0x0000000008116dd9 clang::InitListExpr::updateInit(clang::ASTContext const&, unsigned int, clang::Expr*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x8116dd9)
#16 0x00000000074760b8 (anonymous namespace)::InitListChecker::UpdateStructuredListElement(clang::InitListExpr*, unsigned int&, clang::Expr*) (.part.0) SemaInit.cpp:0:0
#17 0x0000000007489102 (anonymous namespace)::InitListChecker::CheckScalarType(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType, unsigned int&, clang::InitListExpr*, unsigned int&) SemaInit.cpp:0:0
#18 0x000000000748eb94 (anonymous namespace)::InitListChecker::CheckSubElementType(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType, unsigned int&, clang::InitListExpr*, unsigned int&, bool) SemaInit.cpp:0:0
#19 0x0000000007491e19 (anonymous namespace)::InitListChecker::CheckDesignatedInitializer(clang::InitializedEntity const&, clang::InitListExpr*, clang::DesignatedInitExpr*, unsigned int, clang::QualType&, clang::DeclContext::specific_decl_iterator*, llvm::APSInt*, unsigned int&, clang::InitListExpr*, unsigned int&, bool, bool) SemaInit.cpp:0:0
#20 0x0000000007491ccd (anonymous namespace)::InitListChecker::CheckDesignatedInitializer(clang::InitializedEntity const&, clang::InitListExpr*, clang::DesignatedInitExpr*, unsigned int, clang::QualType&, clang::DeclContext::specific_decl_iterator*, llvm::APSInt*, unsigned int&, clang::InitListExpr*, unsigned int&, bool, bool) SemaInit.cpp:0:0
#21 0x000000000748bda6 (anonymous namespace)::InitListChecker::CheckArrayType(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType&, llvm::APSInt, bool, unsigned int&, clang::InitListExpr*, unsigned int&) SemaInit.cpp:0:0
#22 0x000000000748d7b2 (anonymous namespace)::InitListChecker::CheckListElementTypes(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType&, bool, unsigned int&, clang::InitListExpr*, unsigned int&, bool) (.constprop.0) SemaInit.cpp:0:0
#23 0x000000000747a81a (anonymous namespace)::InitListChecker::CheckExplicitInitList(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType&, clang::InitListExpr*, bool) (.constprop.0) SemaInit.cpp:0:0
#24 0x000000000747b1e7 (anonymous namespace)::InitListChecker::InitListChecker(clang::Sema&, clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType&, bool, bool, bool, llvm::SmallVectorImpl*) SemaInit.cpp:0:0
#25 0x000000000747baa0 TryListInitialization(clang::Sema&, clang::InitializedEntity const&, clang::InitializationKind const&, clang::InitListExpr*, clang::InitializationSequence&, bool) SemaInit.cpp:0:0
#26 0x000000000747ce76 clang::InitializationSequence::InitializeFrom(clang::Sema&, clang::InitializedEntity const&, clang::InitializationKind const&, llvm::MutableArrayRef, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x747ce76)
#27 0x000000000718fa5a clang::Sema::AddInitializerToDecl(clang::Decl*, clang::Expr*, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x718fa5a)
#28 0x0000000006d9fe91 clang::Parser::ParseDeclarationAfterDeclaratorAndAttributes(clang::Declarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::ForRangeInit*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d9fe91)
#29 0x0000000006dc0029 clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6dc0029)
#30 0x0000000006d6b11b clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d6b11b)
#31 0x0000000006d6b90f clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d6b90f)
#32 0x0000000006d78428 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d78428)
#33 0x0000000006d79365 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d79365)
#34 0x0000000006d55f2a clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d55f2a)
#35 0x0000000004f28c28 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f28c28)
#36 0x00000000052558c8 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x52558c8)
#37 0x00000000051e34cd clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x51e34cd)
#38 0x000000000532b05d clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x532b05d)
#39 0x0000000000d91bfc cc1_main(llvm::ArrayRef, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xd91bfc)
#40 0x0000000000d888fa ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#41 0x0000000000d88a7d int llvm::function_ref&)>::callback_fn&)>(long, llvm::SmallVectorImpl&) driver.cpp:0:0
#42 0x0000000004fa15c9 void llvm::function_ref::callback_fn>, std::__cxx11::basic_string, std::allocator>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#43 0x00000000043547b4 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x43547b4)
#44 0x0000000004fa2135 clang::driver::CC1Command::Execute(llvm::ArrayRef>, std::__cxx11::basic_string, std::allocator>*, bool*) const (.part.0) Job.cpp:0:0
#45 0x0000000004f59fa2 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f59fa2)
#46 0x0000000004f5e907 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f5e907)
#47 0x0000000004f68ef5 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f68ef5)
#48 0x0000000000d8e0ea clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xd8e0ea)
#49 0x0000000000ccc1ea main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xccc1ea)
#50 0x00007a6c1b42a1ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#51 0x00007a6c1b42a28b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#52 0x0000000000d882a5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xd882a5)
clang++: error: clang frontend command failed due to signal (use -v to see invocation)
Compiler returned: 134
```

Contributor guide

Open the contributing guide

Research direction

Start by compiling the C23 reproducer from the Godbolt link and confirm the out-of-memory crash. Then inspect the InitListChecker path in SemaInit.cpp, especially updateInit as shown in the backtrace. Done means the same #embed prefix expression no longer exhausts memory and has regression coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.