Skip to content

Clang 20 frontend crash on clang::ParseAST #139130

Open
@N1coc4colA

Description

@N1coc4colA

Description

When running using CodeChecker, compilation fails for VkBoostrap's files. Notice that it does not happen when compiling my code in debug mode, with just a few flags (classic -Wall + debug flags). This happens with source file of VkBootstrap. The error happens on clang's frontend
So in substance, the only difference I see with when I "normally build" is that a lot of flags have been enabled in the command, on a large file (2000+ lines).
Notice: on ALL invocations of the command by CodeChecker, the SAME crash happens.

System Information

LLVM/Clang version: 20.1.3-1 (.fc42)
OS: Fedora 42
Arch: x86_64

Stacktrace

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: /usr/lib64/llvm20/bin/clang-20 --analyze -Qunused-arguments -Xclang -analyzer-opt-analyze-headers -Xclang -analyzer-output=plist-multi-file -o /home/nicolas/codechecker/reports/VkBootstrap.cpp_clangsa_9cc9b1826cd055458a99cd14f7562970.plist -Xclang -analyzer-config -Xclang expand-macros=true -Xclang -analyzer-checker=alpha.core.BoolAssignment,alpha.core.CastSize,alpha.core.Conversion,alpha.core.DynamicTypeChecker,alpha.core.TestAfterDivZero,alpha.cplusplus.DeleteWithNonVirtualDtor,alpha.cplusplus.InvalidatedIterator,alpha.cplusplus.IteratorRange,alpha.cplusplus.MismatchedIterator,alpha.cplusplus.STLAlgorithmModeling,alpha.cplusplus.SmartPtr,alpha.security.ReturnPtrRange,unix.BlockInCriticalSection,alpha.unix.PthreadLock,alpha.unix.cstring.OutOfBounds,core.BitwiseShift,core.CallAndMessage,core.DivideZero,core.NonNullParamChecker,core.NullDereference,core.StackAddressEscape,core.UndefinedBinaryOperatorResult,core.VLASize,core.uninitialized.ArraySubscript,core.uninitialized.Assign,core.uninitialized.Branch,core.uninitialized.CapturedBlockVariable,core.uninitialized.NewArraySize,core.uninitialized.UndefReturn,cplusplus.ArrayDelete,cplusplus.InnerPointer,cplusplus.Move,cplusplus.NewDelete,cplusplus.NewDeleteLeaks,cplusplus.PlacementNew,cplusplus.PureVirtualCall,cplusplus.StringChecker,deadcode.DeadStores,nullability.NullPassedToNonnull,nullability.NullReturnedFromNonnull,nullability.NullableDereferenced,nullability.NullablePassedToNonnull,nullability.NullableReturnedFromNonnull,optin.core.EnumCastOutOfRange,optin.cplusplus.UninitializedObject,optin.cplusplus.VirtualCall,optin.mpi.MPI-Checker,optin.portability.UnixAPI,optin.taint.GenericTaint,optin.taint.TaintedAlloc,optin.taint.TaintedDiv,security.FloatLoopCounter,security.MmapWriteExec,security.PointerSub,security.PutenvStackArray,security.SetgidSetuidOrder,security.cert.env.InvalidPtr,security.insecureAPI.UncheckedReturn,security.insecureAPI.getpw,security.insecureAPI.gets,security.insecureAPI.mkstemp,security.insecureAPI.mktemp,security.insecureAPI.rand,security.insecureAPI.vfork,unix.API,unix.Chroot,unix.Errno,unix.Malloc,unix.MallocSizeof,unix.MismatchedDeallocator,unix.StdCLibraryFunctions,unix.Stream,unix.Vfork,unix.cstring.BadSizeArg,unix.cstring.NullArg,valist.CopyToSelf,valist.Uninitialized,valist.Unterminated -Xclang -analyzer-config -Xclang aggressive-binary-operation-simplification=true -x c++ --target=x86_64-redhat-linux -std=gnu++17 -DASSETS_DIR=\"/home/nicolas/Documents/projects/juice-power/assets\" -DCOMPILED_SHADERS_DIR=\"/home/nicolas/Documents/projects/juice-power/shaders\" -I/usr/include/openblas -I/home/nicolas/Documents/projects/juice-power/submodules/vk-bootstrap/src -std=gnu++26 -idirafter /usr/include/c++/15 -idirafter /usr/include/c++/15/x86_64-redhat-linux -idirafter /usr/include/c++/15/backward -idirafter /usr/local/include -idirafter /usr/include /home/nicolas/Documents/projects/juice-power/submodules/vk-bootstrap/src/VkBootstrap.cpp
1.      <eof> parser at end of file
 #0 0x00007f5d4242914a llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/lib64/libLLVM.so.20.1+0x22914a)
 #1 0x00007f5d424260d4 llvm::sys::RunSignalHandlers() (/lib64/libLLVM.so.20.1+0x2260d4)
 #2 0x00007f5d4233f8e4 (/lib64/libLLVM.so.20.1+0x13f8e4)
 #3 0x00007f5d41c27c30 __restore_rt (/lib64/libc.so.6+0x19c30)
 #4 0x00007f5d4d65206c clang::ento::ConditionBRVisitor::VisitTerminator(clang::Stmt const*, clang::ento::ExplodedNode const*, clang::CFGBlock const*, clang::CFGBlock const*, clang::ento::PathSensitiveBugReport&, clang::ento::BugReporterContext&) (/lib64/libclang-cpp.so.20.1+0x2c5206c)
 #5 0x00007f5d4d651fc1 clang::ento::ConditionBRVisitor::VisitNodeImpl(clang::ento::ExplodedNode const*, clang::ento::BugReporterContext&, clang::ento::PathSensitiveBugReport&) (/lib64/libclang-cpp.so.20.1+0x2c51fc1)
 #6 0x00007f5d4d651e6d clang::ento::ConditionBRVisitor::VisitNode(clang::ento::ExplodedNode const*, clang::ento::BugReporterContext&, clang::ento::PathSensitiveBugReport&) (/lib64/libclang-cpp.so.20.1+0x2c51e6d)
 #7 0x00007f5d4d63e570 (/lib64/libclang-cpp.so.20.1+0x2c3e570)
 #8 0x00007f5d4d639977 clang::ento::PathSensitiveBugReporter::generatePathDiagnostics(llvm::ArrayRef<clang::ento::PathDiagnosticConsumer*>, llvm::ArrayRef<clang::ento::PathSensitiveBugReport*>&) (/lib64/libclang-cpp.so.20.1+0x2c39977)
 #9 0x00007f5d4d63cd4c clang::ento::PathSensitiveBugReporter::generateDiagnosticForConsumerMap(clang::ento::BugReport*, llvm::ArrayRef<clang::ento::PathDiagnosticConsumer*>, llvm::ArrayRef<clang::ento::BugReport*>) (/lib64/libclang-cpp.so.20.1+0x2c3cd4c)
#10 0x00007f5d4d6378e7 clang::ento::BugReporter::FlushReport(clang::ento::BugReportEquivClass&) (/lib64/libclang-cpp.so.20.1+0x2c378e7)
#11 0x00007f5d4d63771b clang::ento::BugReporter::FlushReports() (/lib64/libclang-cpp.so.20.1+0x2c3771b)
#12 0x00007f5d4d9f3844 (/lib64/libclang-cpp.so.20.1+0x2ff3844)
#13 0x00007f5d4d9f174a (/lib64/libclang-cpp.so.20.1+0x2ff174a)
#14 0x00007f5d4ac12e89 clang::ParseAST(clang::Sema&, bool, bool) (/lib64/libclang-cpp.so.20.1+0x212e89)
#15 0x00007f5d4d31642f clang::FrontendAction::Execute() (/lib64/libclang-cpp.so.20.1+0x291642f)
#16 0x00007f5d4d278cc4 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/lib64/libclang-cpp.so.20.1+0x2878cc4)
#17 0x00007f5d4d3a9f3e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/lib64/libclang-cpp.so.20.1+0x29a9f3e)
#18 0x000055da75822695 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/usr/lib64/llvm20/bin/clang-20+0xa695)
#19 0x000055da7581e727 (/usr/lib64/llvm20/bin/clang-20+0x6727)
#20 0x00007f5d4ce193dd (/lib64/libclang-cpp.so.20.1+0x24193dd)
#21 0x00007f5d4233f5f0 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/lib64/libLLVM.so.20.1+0x13f5f0)
#22 0x00007f5d4ce18c95 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (/lib64/libclang-cpp.so.20.1+0x2418c95)
#23 0x00007f5d4cdd4eb9 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/lib64/libclang-cpp.so.20.1+0x23d4eb9)
#24 0x00007f5d4cdd5177 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/lib64/libclang-cpp.so.20.1+0x23d5177)
#25 0x00007f5d4cdf7d39 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/lib64/libclang-cpp.so.20.1+0x23f7d39)
#26 0x000055da7581db54 clang_main(int, char**, llvm::ToolContext const&) (/usr/lib64/llvm20/bin/clang-20+0x5b54)
#27 0x000055da7582d9a8 main (/usr/lib64/llvm20/bin/clang-20+0x159a8)
#28 0x00007f5d41c115f5 __libc_start_call_main (/lib64/libc.so.6+0x35f5)
#29 0x00007f5d41c116a8 __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x36a8)
#30 0x000055da7581be05 _start (/usr/lib64/llvm20/bin/clang-20+0x3e05)
clang-20: error: clang frontend command failed with exit code 139 (use -v to see invocation)
clang version 20.1.3 (Fedora 20.1.3-1.fc42)
Target: x86_64-redhat-linux
Thread model: posix
InstalledDir: /usr/lib64/llvm20/bin
clang-20: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-20: note: diagnostic msg: /tmp/VkBootstrap-761f91.cpp
clang-20: note: diagnostic msg: /tmp/VkBootstrap-761f91.sh
clang-20: note: diagnostic msg: 

********************

[ERROR 2025-05-08 19:50] - 

[ERROR 2025-05-08 19:50] - 
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: /usr/lib64/llvm20/bin/clang-20 --analyze -Qunused-arguments -Xclang -analyzer-opt-analyze-headers -Xclang -analyzer-output=plist-multi-file -o /home/nicolas/codechecker/reports/VkBootstrap.cpp_clangsa_9cc9b1826cd055458a99cd14f7562970.plist -Xclang -analyzer-config -Xclang expand-macros=true -Xclang -analyzer-checker=alpha.core.BoolAssignment,alpha.core.CastSize,alpha.core.Conversion,alpha.core.DynamicTypeChecker,alpha.core.TestAfterDivZero,alpha.cplusplus.DeleteWithNonVirtualDtor,alpha.cplusplus.InvalidatedIterator,alpha.cplusplus.IteratorRange,alpha.cplusplus.MismatchedIterator,alpha.cplusplus.STLAlgorithmModeling,alpha.cplusplus.SmartPtr,alpha.security.ReturnPtrRange,unix.BlockInCriticalSection,alpha.unix.PthreadLock,alpha.unix.cstring.OutOfBounds,core.BitwiseShift,core.CallAndMessage,core.DivideZero,core.NonNullParamChecker,core.NullDereference,core.StackAddressEscape,core.UndefinedBinaryOperatorResult,core.VLASize,core.uninitialized.ArraySubscript,core.uninitialized.Assign,core.uninitialized.Branch,core.uninitialized.CapturedBlockVariable,core.uninitialized.NewArraySize,core.uninitialized.UndefReturn,cplusplus.ArrayDelete,cplusplus.InnerPointer,cplusplus.Move,cplusplus.NewDelete,cplusplus.NewDeleteLeaks,cplusplus.PlacementNew,cplusplus.PureVirtualCall,cplusplus.StringChecker,deadcode.DeadStores,nullability.NullPassedToNonnull,nullability.NullReturnedFromNonnull,nullability.NullableDereferenced,nullability.NullablePassedToNonnull,nullability.NullableReturnedFromNonnull,optin.core.EnumCastOutOfRange,optin.cplusplus.UninitializedObject,optin.cplusplus.VirtualCall,optin.mpi.MPI-Checker,optin.portability.UnixAPI,optin.taint.GenericTaint,optin.taint.TaintedAlloc,optin.taint.TaintedDiv,security.FloatLoopCounter,security.MmapWriteExec,security.PointerSub,security.PutenvStackArray,security.SetgidSetuidOrder,security.cert.env.InvalidPtr,security.insecureAPI.UncheckedReturn,security.insecureAPI.getpw,security.insecureAPI.gets,security.insecureAPI.mkstemp,security.insecureAPI.mktemp,security.insecureAPI.rand,security.insecureAPI.vfork,unix.API,unix.Chroot,unix.Errno,unix.Malloc,unix.MallocSizeof,unix.MismatchedDeallocator,unix.StdCLibraryFunctions,unix.Stream,unix.Vfork,unix.cstring.BadSizeArg,unix.cstring.NullArg,valist.CopyToSelf,valist.Uninitialized,valist.Unterminated -Xclang -analyzer-config -Xclang aggressive-binary-operation-simplification=true -x c++ --target=x86_64-redhat-linux -std=gnu++17 -DASSETS_DIR=\"/home/nicolas/Documents/projects/juice-power/assets\" -DCOMPILED_SHADERS_DIR=\"/home/nicolas/Documents/projects/juice-power/shaders\" -I/usr/include/openblas -I/home/nicolas/Documents/projects/juice-power/submodules/vk-bootstrap/src -std=gnu++26 -idirafter /usr/include/c++/15 -idirafter /usr/include/c++/15/x86_64-redhat-linux -idirafter /usr/include/c++/15/backward -idirafter /usr/local/include -idirafter /usr/include /home/nicolas/Documents/projects/juice-power/submodules/vk-bootstrap/src/VkBootstrap.cpp
1.      <eof> parser at end of file
 #0 0x00007f5d4242914a llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/lib64/libLLVM.so.20.1+0x22914a)
 #1 0x00007f5d424260d4 llvm::sys::RunSignalHandlers() (/lib64/libLLVM.so.20.1+0x2260d4)
 #2 0x00007f5d4233f8e4 (/lib64/libLLVM.so.20.1+0x13f8e4)
 #3 0x00007f5d41c27c30 __restore_rt (/lib64/libc.so.6+0x19c30)
 #4 0x00007f5d4d65206c clang::ento::ConditionBRVisitor::VisitTerminator(clang::Stmt const*, clang::ento::ExplodedNode const*, clang::CFGBlock const*, clang::CFGBlock const*, clang::ento::PathSensitiveBugReport&, clang::ento::BugReporterContext&) (/lib64/libclang-cpp.so.20.1+0x2c5206c)
 #5 0x00007f5d4d651fc1 clang::ento::ConditionBRVisitor::VisitNodeImpl(clang::ento::ExplodedNode const*, clang::ento::BugReporterContext&, clang::ento::PathSensitiveBugReport&) (/lib64/libclang-cpp.so.20.1+0x2c51fc1)
 #6 0x00007f5d4d651e6d clang::ento::ConditionBRVisitor::VisitNode(clang::ento::ExplodedNode const*, clang::ento::BugReporterContext&, clang::ento::PathSensitiveBugReport&) (/lib64/libclang-cpp.so.20.1+0x2c51e6d)
 #7 0x00007f5d4d63e570 (/lib64/libclang-cpp.so.20.1+0x2c3e570)
 #8 0x00007f5d4d639977 clang::ento::PathSensitiveBugReporter::generatePathDiagnostics(llvm::ArrayRef<clang::ento::PathDiagnosticConsumer*>, llvm::ArrayRef<clang::ento::PathSensitiveBugReport*>&) (/lib64/libclang-cpp.so.20.1+0x2c39977)
 #9 0x00007f5d4d63cd4c clang::ento::PathSensitiveBugReporter::generateDiagnosticForConsumerMap(clang::ento::BugReport*, llvm::ArrayRef<clang::ento::PathDiagnosticConsumer*>, llvm::ArrayRef<clang::ento::BugReport*>) (/lib64/libclang-cpp.so.20.1+0x2c3cd4c)
#10 0x00007f5d4d6378e7 clang::ento::BugReporter::FlushReport(clang::ento::BugReportEquivClass&) (/lib64/libclang-cpp.so.20.1+0x2c378e7)
#11 0x00007f5d4d63771b clang::ento::BugReporter::FlushReports() (/lib64/libclang-cpp.so.20.1+0x2c3771b)
#12 0x00007f5d4d9f3844 (/lib64/libclang-cpp.so.20.1+0x2ff3844)
#13 0x00007f5d4d9f174a (/lib64/libclang-cpp.so.20.1+0x2ff174a)
#14 0x00007f5d4ac12e89 clang::ParseAST(clang::Sema&, bool, bool) (/lib64/libclang-cpp.so.20.1+0x212e89)
#15 0x00007f5d4d31642f clang::FrontendAction::Execute() (/lib64/libclang-cpp.so.20.1+0x291642f)
#16 0x00007f5d4d278cc4 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/lib64/libclang-cpp.so.20.1+0x2878cc4)
#17 0x00007f5d4d3a9f3e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/lib64/libclang-cpp.so.20.1+0x29a9f3e)
#18 0x000055da75822695 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/usr/lib64/llvm20/bin/clang-20+0xa695)
#19 0x000055da7581e727 (/usr/lib64/llvm20/bin/clang-20+0x6727)
#20 0x00007f5d4ce193dd (/lib64/libclang-cpp.so.20.1+0x24193dd)
#21 0x00007f5d4233f5f0 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/lib64/libLLVM.so.20.1+0x13f5f0)
#22 0x00007f5d4ce18c95 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (/lib64/libclang-cpp.so.20.1+0x2418c95)
#23 0x00007f5d4cdd4eb9 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/lib64/libclang-cpp.so.20.1+0x23d4eb9)
#24 0x00007f5d4cdd5177 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/lib64/libclang-cpp.so.20.1+0x23d5177)
#25 0x00007f5d4cdf7d39 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/lib64/libclang-cpp.so.20.1+0x23f7d39)
#26 0x000055da7581db54 clang_main(int, char**, llvm::ToolContext const&) (/usr/lib64/llvm20/bin/clang-20+0x5b54)
#27 0x000055da7582d9a8 main (/usr/lib64/llvm20/bin/clang-20+0x159a8)
#28 0x00007f5d41c115f5 __libc_start_call_main (/lib64/libc.so.6+0x35f5)
#29 0x00007f5d41c116a8 __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x36a8)
#30 0x000055da7581be05 _start (/usr/lib64/llvm20/bin/clang-20+0x3e05)
clang-20: error: clang frontend command failed with exit code 139 (use -v to see invocation)
clang version 20.1.3 (Fedora 20.1.3-1.fc42)
Target: x86_64-redhat-linux
Thread model: posix
InstalledDir: /usr/lib64/llvm20/bin
clang-20: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-20: note: diagnostic msg: /tmp/VkBootstrap-761f91.cpp
clang-20: note: diagnostic msg: /tmp/VkBootstrap-761f91.sh
clang-20: note: diagnostic msg: 

********************

Here are the files (.txt added to be able to make the upload):
VkBootstrap-761f91.cpp.txt
VkBootstrap-761f91.sh.txt

Metadata

Metadata

Assignees

No one assigned

    Labels

    clang:static analyzercrashPrefer [crash-on-valid] or [crash-on-invalid]needs-reductionLarge reproducer that should be reduced into a simpler form

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions