Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[analyzer] Crash with "ArrayInitLoopExpr contains unexpected source expression" #112813

Closed
i80287 opened this issue Oct 18, 2024 · 6 comments · Fixed by #113570
Closed

[analyzer] Crash with "ArrayInitLoopExpr contains unexpected source expression" #112813

i80287 opened this issue Oct 18, 2024 · 6 comments · Fixed by #113570
Labels
clang:static analyzer confirmed Verified by a second party crash Prefer [crash-on-valid] or [crash-on-invalid]

Comments

@i80287
Copy link

i80287 commented Oct 18, 2024 •
edited by steakhal
Loading

Got an error while running clang-tidy. Clang-tidy is executed by CodeChecker, flags and options are generated by the cmake with -DCMAKE_EXPORT_COMPILE_COMMANDS=1. The same error occurs when CodeChecker runs clang static analyzer

Stack dump:
0.	Program arguments: /usr/lib/llvm-18/bin/clang-tidy /home/waste/Projects/cplusplus/algorithms/tf_idf_actrie/test_actrie.cpp --export-fixes /home/waste/Projects/cplusplus/algorithms/tests/cmake-build-codechecker/report_clang/fixit/test_actrie.cpp_clang-tidy_889ac94762fd440ca0328d94131f3632.yaml -- -Qunused-arguments -Wno-everything -x c++ --target=x86_64-pc-linux-gnu -D_GLIBCXX_CONCEPT_CHECKS -D_GLIBCXX_DEBUG -D_GLIBCXX_DEBUG_PEDANTIC -D_GLIBCXX_SANITIZE_VECTOR -D_LIBCPP_ENABLE_ASSERTIONS -fsanitize=address,undefined -O2 -g -std=c++20 -Wall -Wextra -Wcast-qual -Wpedantic -Wunused -Wshadow -Wnull-dereference -Wundef -Wwrite-strings -Wsign-conversion -Wsign-compare -Wsign-promo -Wconversion -Wmissing-noreturn -Wunreachable-code -Wcast-align -Wformat=2 -Wswitch-bool -Wswitch-default -Wswitch-enum -Wold-style-cast -Wdeprecated -Weffc++ -fstack-protector-strong -mshstk -Warray-bounds -Wshift-overflow -Wshift-sign-overflow -Wshorten-64-to-32 -Wthread-safety -fcolor-diagnostics -fansi-escape-codes -ftemplate-backtrace-limit=0 -U_GLIBCXX_USE_DEPRECATED -isystem /usr/include/c++/13 -isystem /usr/include/x86_64-linux-gnu/c++/13 -isystem /usr/include/c++/13/backward -isystem /usr/local/include -isystem /usr/include/x86_64-linux-gnu -isystem /usr/include
1.	<eof> parser at end of file
2.	While analyzing stack: 
	#0 Calling (anonymous namespace)::replacing_actrie_tests::test_replacing_actrie(const std::string_view (&)[5][2], std::string &, const std::string_view, const _Bool) at line /home/waste/Projects/cplusplus/algorithms/tf_idf_actrie/test_actrie.cpp:155:5 <Spelling=/home/waste/Projects/cplusplus/algorithms/tf_idf_actrie/test_actrie.cpp:155:12>
	#1 Calling (anonymous namespace)::replacing_actrie_tests::test0() at line 448
	#2 Calling main()
3.	/home/waste/Projects/cplusplus/algorithms/tf_idf_actrie/test_actrie.cpp:118:44: Error evaluating statement
4.	/home/waste/Projects/cplusplus/algorithms/tf_idf_actrie/test_actrie.cpp:118:44: Error evaluating statement
 #0 sys::PrintStackTrace(raw_ostream&, int) Signals.inc:723:13
 #1 sys::RunSignalHandlers() Signals.cpp:106:18
 #2 SignalHandler Signals.inc:413:1
 #3 (/lib/x86_64-linux-gnu/libc.so.6+0x45320)
 #4 getCanonicalDecl clang/AST/Decl.h:1274:40
 #5 MemRegionManager::getVarRegion(VarDecl const*, LocationContext const*) MemRegion.cpp:1007:10
 #6 clang/StaticAnalyzer/Core/PathSensitive/Store.h:136:5
 #7 getType clang/AST/Expr.h:143:37
 #8 bindRequiredArrayElementToEnvironment ExprEngineCXX.cpp:577:39
 #9 ExprEngine::handleConstructor(Expr const*, ExplodedNode*, ExplodedNodeSet&) ExprEngineCXX.cpp:660:15
#10 ExprEngine::Visit(Stmt const*, ExplodedNode*, ExplodedNodeSet&) ExprEngine.cpp:0:7
#11 ExprEngine::ProcessStmt(Stmt const*, ExplodedNode*) ExprEngine.cpp:1132:9
#12 ExprEngine::processCFGElement(CFGElement, ExplodedNode*, unsigned int, NodeBuilderContext*) ExprEngine.cpp:0:7
#13 CoreEngine::dispatchWorkItem(ExplodedNode*, ProgramPoint, WorkListUnit const&) CoreEngine.cpp:223:1
@github-actions github-actions bot added clang Clang issues not falling into any other category clang-tidy labels Oct 18, 2024
@EugeneZelenko EugeneZelenko added clang:static analyzer crash Prefer [crash-on-valid] or [crash-on-invalid] and removed clang Clang issues not falling into any other category clang-tidy labels Oct 18, 2024
@llvmbot
Copy link
Member

llvmbot commented Oct 18, 2024

@llvm/issue-subscribers-clang-static-analyzer

Author: i80287 (i80287)

Got an error while running clang-tidy. Clang-tidy is executed by CodeChecker, flags and options are generated by the cmake with -DCMAKE_EXPORT_COMPILE_COMMANDS=1. The same error occurs when CodeChecker runs clang static analyzer

Stack dump:
0. Program arguments: /usr/lib/llvm-18/bin/clang-tidy /home/waste/Projects/cplusplus/algorithms/tf_idf_actrie/test_actrie.cpp --export-fixes /home/waste/Projects/cplusplus/algorithms/tests/cmake-build-codechecker/report_clang/fixit/test_actrie.cpp_clang-tidy_889ac94762fd440ca0328d94131f3632.yaml -- -Qunused-arguments -Wno-everything -x c++ --target=x86_64-pc-linux-gnu -D_GLIBCXX_CONCEPT_CHECKS -D_GLIBCXX_DEBUG -D_GLIBCXX_DEBUG_PEDANTIC -D_GLIBCXX_SANITIZE_VECTOR -D_LIBCPP_ENABLE_ASSERTIONS -fsanitize=address,undefined -O2 -g -std=c++20 -Wall -Wextra -Wcast-qual -Wpedantic -Wunused -Wshadow -Wnull-dereference -Wundef -Wwrite-strings -Wsign-conversion -Wsign-compare -Wsign-promo -Wconversion -Wmissing-noreturn -Wunreachable-code -Wcast-align -Wformat=2 -Wswitch-bool -Wswitch-default -Wswitch-enum -Wold-style-cast -Wdeprecated -Weffc++ -fstack-protector-strong -mshstk -Warray-bounds -Wshift-overflow -Wshift-sign-overflow -Wshorten-64-to-32 -Wthread-safety -fcolor-diagnostics -fansi-escape-codes -ftemplate-backtrace-limit=0 -U_GLIBCXX_USE_DEPRECATED -isystem /usr/include/c++/13 -isystem /usr/include/x86_64-linux-gnu/c++/13 -isystem /usr/include/c++/13/backward -isystem /usr/local/include -isystem /usr/include/x86_64-linux-gnu -isystem /usr/include

  1. <eof> parser at end of file
  2. While analyzing stack:
    #0 Calling (anonymous namespace)::replacing_actrie_tests::test_replacing_actrie(const std::string_view (&)[5][2], std::string &, const std::string_view, const _Bool) at line /home/waste/Projects/cplusplus/algorithms/tf_idf_actrie/test_actrie.cpp:155:5 <Spelling=/home/waste/Projects/cplusplus/algorithms/tf_idf_actrie/test_actrie.cpp:155:12>
    #1 Calling (anonymous namespace)::replacing_actrie_tests::test0() at line 448
    #2 Calling main()
  3. /home/waste/Projects/cplusplus/algorithms/tf_idf_actrie/test_actrie.cpp:118:44: Error evaluating statement
  4. /home/waste/Projects/cplusplus/algorithms/tf_idf_actrie/test_actrie.cpp:118:44: Error evaluating statement
    #0 0x0000785c835a63bf llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) build-llvm/tools/clang/stage2-bins/llvm/lib/Support/Unix/Signals.inc:723:13
    #1 0x0000785c835a44f9 llvm::sys::RunSignalHandlers() build-llvm/tools/clang/stage2-bins/llvm/lib/Support/Signals.cpp:106:18
    #2 0x0000785c835a6b00 SignalHandler build-llvm/tools/clang/stage2-bins/llvm/lib/Support/Unix/Signals.inc:413:1
    #3 0x0000785c82045320 (/lib/x86_64-linux-gnu/libc.so.6+0x45320)
    #4 0x0000785c8cd0f1b7 getCanonicalDecl build-llvm/tools/clang/stage2-bins/clang/include/clang/AST/Decl.h:1274:40
    #5 0x0000785c8cd0f1b7 clang::ento::MemRegionManager::getVarRegion(clang::VarDecl const*, clang::LocationContext const*) build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Core/MemRegion.cpp:1007:10
    #6 0x0000785c8cd40a61 build-llvm/tools/clang/stage2-bins/clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h:136:5
    #7 0x0000785c8ccefe8b getType build-llvm/tools/clang/stage2-bins/clang/include/clang/AST/Expr.h:143:37
    #8 0x0000785c8ccefe8b bindRequiredArrayElementToEnvironment build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp:577:39
    #9 0x0000785c8ccefe8b clang::ento::ExprEngine::handleConstructor(clang::Expr const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&) build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp:660:15
    #10 0x0000785c8ccd32a5 clang::ento::ExprEngine::Visit(clang::Stmt const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&) build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp:0:7
    #11 0x0000785c8ccd0e7a clang::ento::ExprEngine::ProcessStmt(clang::Stmt const*, clang::ento::ExplodedNode*) build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp:1132:9
    #12 0x0000785c8ccd0bb8 clang::ento::ExprEngine::processCFGElement(clang::CFGElement, clang::ento::ExplodedNode*, unsigned int, clang::ento::NodeBuilderContext*) build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp:0:7
    #13 0x0000785c8ccb7418 clang::ento::CoreEngine::dispatchWorkItem(clang::ento::ExplodedNode*, clang::ProgramPoint, clang::ento::WorkListUnit const&) build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Core/CoreEngine.cpp:223:1
    #14 0x0000785c8ccb6f6c _M_ptr /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/unique_ptr.h:199:51
    #15 0x0000785c8ccb6f6c get /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/unique_ptr.h:470:21
    #16 0x0000785c8ccb6f6c operator-> /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/unique_ptr.h:463:9
    #17 0x0000785c8ccb6f6c operator() build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Core/CoreEngine.cpp:140:12
    #18 0x0000785c8ccb6f6c clang::ento::CoreEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Core/CoreEngine.cpp:163:29
    #19 0x0000785c8d0d4529 release build-llvm/tools/clang/stage2-bins/llvm/include/llvm/ADT/IntrusiveRefCntPtr.h:232:9
    #20 0x0000785c8d0d4529 ~IntrusiveRefCntPtr build-llvm/tools/clang/stage2-bins/llvm/include/llvm/ADT/IntrusiveRefCntPtr.h:196:27
    #21 0x0000785c8d0d4529 ExecuteWorkList build-llvm/tools/clang/stage2-bins/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h:190:5
    #22 0x0000785c8d0d4529 RunPathSensitiveChecks build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:727:7
    #23 0x0000785c8d0d4529 HandleCode build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:697:5
    #24 0x0000785c8d0b451f empty build-llvm/tools/clang/stage2-bins/llvm/include/llvm/ADT/DenseMap.h:98:61
    #25 0x0000785c8d0b451f begin build-llvm/tools/clang/stage2-bins/llvm/include/llvm/ADT/DenseMap.h:78:9
    #26 0x0000785c8d0b451f begin build-llvm/tools/clang/stage2-bins/llvm/include/llvm/ADT/DenseSet.h:173:45
    #27 0x0000785c8d0b451f HandleDeclsCallGraph build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:490:29
    #28 0x0000785c8d0b451f runAnalysisOnTranslationUnit build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:557:5
    #29 0x0000785c8d0b451f HandleTranslationUnit build-llvm/tools/clang/stage2-bins/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:612:3
    #30 0x0000785c8ca42fbc operator++ /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_iterator.h:1111:2
    #31 0x0000785c8ca42fbc clang::MultiplexConsumer::HandleTranslationUnit(clang::ASTContext&) build-llvm/tools/clang/stage2-bins/clang/lib/Frontend/MultiplexConsumer.cpp:297:23
    #32 0x0000785c8ab973d6 __normal_iterator /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_iterator.h:1077:20
    #33 0x0000785c8ab973d6 begin /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:874:16
    #34 0x0000785c8ab973d6 finalize<std::vector<std::unique_ptr<clang::TemplateInstantiationCallback, std::default_delete<clang::TemplateInstantiationCallback> >, std::allocator<std::unique_ptr<clang::TemplateInstantiationCallback, std::default_delete<clang::TemplateInstantiationCallback> > > > > build-llvm/tools/clang/stage2-bins/clang/include/clang/Sema/TemplateInstCallback.h:54:16
    #35 0x0000785c8ab973d6 clang::ParseAST(clang::Sema&, bool, bool) build-llvm/tools/clang/stage2-bins/clang/lib/Parse/ParseAST.cpp:183:3
    #36 0x0000785c8ca0662c clang::FrontendAction::Execute() build-llvm/tools/clang/stage2-bins/clang/lib/Frontend/FrontendAction.cpp:1073:10
    #37 0x0000785c8c9830b4 getPtr build-llvm/tools/clang/stage2-bins/llvm/include/llvm/Support/Error.h:279:12
    #38 0x0000785c8c9830b4 operator bool build-llvm/tools/clang/stage2-bins/llvm/include/llvm/Support/Error.h:239:16
    #39 0x0000785c8c9830b4 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) build-llvm/tools/clang/stage2-bins/clang/lib/Frontend/CompilerInstance.cpp:1057:23
    #40 0x0000785c8cbfa6b9 clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr<clang::CompilerInvocation>, clang::FileManager*, std::shared_ptr<clang::PCHContainerOperations>, clang::DiagnosticConsumer*) build-llvm/tools/clang/stage2-bins/clang/lib/Tooling/Tooling.cpp:465:33
    #41 0x0000587f55574ab3 ~__shared_count /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1070:6
    #42 0x0000587f55574ab3 ~__shared_ptr /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1524:31
    #43 0x0000587f55574ab3 runInvocation build-llvm/tools/clang/stage2-bins/clang-tools-extra/clang-tidy/ClangTidy.cpp:581:7
    #44 0x0000785c8cbfa414 ~__shared_count /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1070:6
    #45 0x0000785c8cbfa414 ~__shared_ptr /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1524:31
    #46 0x0000785c8cbfa414 clang::tooling::ToolInvocation::runInvocation(char const*, clang::driver::Compilation*, std::shared_ptr<clang::CompilerInvocation>, std::shared_ptr<clang::PCHContainerOperations>) build-llvm/tools/clang/stage2-bins/clang/lib/Tooling/Tooling.cpp:440:3
    #47 0x0000785c8cbf917f clang::tooling::ToolInvocation::run() build-llvm/tools/clang/stage2-bins/clang/lib/Tooling/Tooling.cpp:425:10
    #48 0x0000785c8cbfc1c1 clang::tooling::ClangTool::run(clang::tooling::ToolAction*) build-llvm/tools/clang/stage2-bins/clang/lib/Tooling/Tooling.cpp:623:11
    #49 0x0000587f55570d9b clang::tidy::runClangTidy(clang::tidy::ClangTidyContext&, clang::tooling::CompilationDatabase const&, llvm::ArrayRef<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, llvm::IntrusiveRefCntPtr<llvm::vfs::OverlayFileSystem>, bool, bool, llvm::StringRef) build-llvm/tools/clang/stage2-bins/clang-tools-extra/clang-tidy/ClangTidy.cpp:0:8
    #50 0x0000587f548f0c65 release build-llvm/tools/clang/stage2-bins/llvm/include/llvm/ADT/IntrusiveRefCntPtr.h:232:9
    #51 0x0000587f548f0c65 ~IntrusiveRefCntPtr build-llvm/tools/clang/stage2-bins/llvm/include/llvm/ADT/IntrusiveRefCntPtr.h:196:27
    #52 0x0000587f548f0c65 clang::tidy::clangTidyMain(int, char const**) build-llvm/tools/clang/stage2-bins/clang-tools-extra/clang-tidy/tool/ClangTidyMain.cpp:681:7
    #53 0x0000785c8202a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
    #54 0x0000785c8202a28b call_init ./csu/../csu/libc-start.c:128:20
    #55 0x0000785c8202a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
    #56 0x0000587f548ebfe5 _start (/usr/lib/llvm-18/bin/clang-tidy+0x6fafe5)

@EugeneZelenko EugeneZelenko added the incomplete Issue not complete (e.g. missing a reproducer, build arguments, etc.) label Oct 18, 2024
@EugeneZelenko
Copy link
Contributor

Could you please try 19 or main branch?

Please provide reproducer.

@steakhal
Copy link
Contributor

I had a look, but without a reproducer I can't fix this.

@whisperity whisperity changed the title [clang-tidy] Clang crashed during analyzing the cpp file Clang analyzer crashed during analyzing the cpp file Oct 18, 2024
@i80287
Copy link
Author

i80287 commented Oct 23, 2024

Reproducer for this error may look like this:

#include <string_view>

int main() {
    std::string_view pairs[][2] = {
        {"ab", "cd"},
    };
    for (const auto [lhs, rhs] : pairs) {
    }
    return 0;
}

assuming that the code above is put in the file.cpp, the following command exits with error and backtrace as in the first message of this github issue:
clang --analyze file.cpp
This command with some additional arguments is called during the analysis of the source code by the CodeChecker (in the logs it is said that it happens during the analysis of the code by clang-tidy)
The version of clang used is 18.1.3 (from the Ubuntu apt package)

I will try main branch later: linking binaries when building llvm from source takes eternity on my pc...(

@EugeneZelenko EugeneZelenko removed the incomplete Issue not complete (e.g. missing a reproducer, build arguments, etc.) label Oct 23, 2024
@i80287
Copy link
Author

i80287 commented Oct 24, 2024 •
edited by whisperity
Loading

Result of the clang --analyze file.cpp is pretty the same when using clang 20.0.0 built from the main branch:

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: /mnt/wd15/projects/c++/llvm-project/build/bin/clang --analyze file.cpp
1.      <eof> parser at end of file
2.      While analyzing stack: 
        #0 Calling main()
3.      file.cpp:7:32: Error evaluating statement
4.      file.cpp:7:32: Error evaluating statement
 #0 0x00005b5c8701c6a2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x720e6a2)
 #1 0x00005b5c8701a3ec llvm::sys::CleanupOnSignal(unsigned long) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x720c3ec)
 #2 0x00005b5c86f53058 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x000071a780045320 (/lib/x86_64-linux-gnu/libc.so.6+0x45320)
 #4 0x00005b5c8969e840 clang::ento::MemRegionManager::getVarRegion(clang::VarDecl const*, clang::LocationContext const*) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x9890840)
 #5 0x00005b5c8966aac9 clang::ento::ExprEngine::handleConstructor(clang::Expr const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x985cac9)
 #6 0x00005b5c8963f1f2 clang::ento::ExprEngine::Visit(clang::Stmt const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x98311f2)
 #7 0x00005b5c896411fd clang::ento::ExprEngine::ProcessStmt(clang::Stmt const*, clang::ento::ExplodedNode*) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x98331fd)
 #8 0x00005b5c8964ee0a clang::ento::ExprEngine::processCFGElement(clang::CFGElement, clang::ento::ExplodedNode*, unsigned int, clang::ento::NodeBuilderContext*) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x9840e0a)
 #9 0x00005b5c895fba62 clang::ento::CoreEngine::dispatchWorkItem(clang::ento::ExplodedNode*, clang::ProgramPoint, clang::ento::WorkListUnit const&) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x97eda62)
#10 0x00005b5c895fbcce clang::ento::CoreEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x97edcce)
#11 0x00005b5c891375fa (anonymous namespace)::AnalysisConsumer::HandleCode(clang::Decl*, unsigned int, clang::ento::ExprEngine::InliningModes, llvm::DenseSet<clang::Decl const*, llvm::DenseMapInfo<clang::Decl const*, void>>*) AnalysisConsumer.cpp:0:0
#12 0x00005b5c8914bfd3 (anonymous namespace)::AnalysisConsumer::HandleTranslationUnit(clang::ASTContext&) AnalysisConsumer.cpp:0:0
#13 0x00005b5c8975b42c clang::ParseAST(clang::Sema&, bool, bool) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x994d42c)
#14 0x00005b5c87ed53b9 clang::FrontendAction::Execute() (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x80c73b9)
#15 0x00005b5c87e55d9b clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x8047d9b)
#16 0x00005b5c87fb949b clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x81ab49b)
#17 0x00005b5c843c63c1 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x45b83c1)
#18 0x00005b5c843bda4a ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#19 0x00005b5c87c3ca0d void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#20 0x00005b5c86f534a7 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x71454a7)
#21 0x00005b5c87c3d0d1 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#22 0x00005b5c87c009ba clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x7df29ba)
#23 0x00005b5c87c01a6d clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x7df3a6d)
#24 0x00005b5c87c1422c clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x7e0622c)
#25 0x00005b5c843c2116 clang_main(int, char**, llvm::ToolContext const&) (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x45b4116)
#26 0x00005b5c843d479a main (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x45c679a)
#27 0x000071a78002a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#28 0x000071a78002a28b call_init ./csu/../csu/libc-start.c:128:20
#29 0x000071a78002a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#30 0x00005b5c843bd4a5 _start (/mnt/wd15/projects/c++/llvm-project/build/bin/clang+0x45af4a5)
clang: error: clang frontend command failed with exit code 139 (use -v to see invocation)
clang version 20.0.0git (https://github.com/llvm/llvm-project.git c77d8edf80570f450122a7687100553836149652)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /mnt/wd15/projects/c++/llvm-project/build/bin
clang: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/file-26c5dd.cpp
clang: note: diagnostic msg: /tmp/file-26c5dd.sh
clang: note: diagnostic msg: 

********************

@steakhal
Copy link
Contributor

Reproduces on trunk, https://compiler-explorer.com/z/KqTn678xn
@isuckatcs I think this one is for you ;)

@steakhal steakhal added the confirmed Verified by a second party label Oct 24, 2024
@steakhal steakhal changed the title Clang analyzer crashed during analyzing the cpp file [analyzer] Cras with "ArrayInitLoopExpr contains unexpected source expression" Oct 24, 2024
@steakhal steakhal changed the title [analyzer] Cras with "ArrayInitLoopExpr contains unexpected source expression" [analyzer] Crash with "ArrayInitLoopExpr contains unexpected source expression" Oct 24, 2024
isuckatcs added a commit to isuckatcs/llvm-project that referenced this issue Oct 24, 2024
@isuckatcs
[analyzer] Fix a crash from element region construction during `Array…
902980e 
…InitLoopExpr` analysis

This patch generalizes the way element regions are constructed when an `ArrayInitLoopExpr`
is being analyzed. Previously the base region of the `ElementRegion` was determined with
pattern matching, which led to crashes, when an unhandled pattern was encountered.

Fixes llvm#112813
@isuckatcs isuckatcs mentioned this issue Oct 24, 2024
Merged
isuckatcs added a commit to isuckatcs/llvm-project that referenced this issue Oct 24, 2024
@isuckatcs
[analyzer] Fix a crash from element region construction during `Array…
ba10a34 
…InitLoopExpr` analysis

This patch generalizes the way element regions are constructed when an `ArrayInitLoopExpr`
is being analyzed. Previously the base region of the `ElementRegion` was determined with
pattern matching, which led to crashes, when an unhandled pattern was encountered.

Fixes llvm#112813
isuckatcs added a commit to isuckatcs/llvm-project that referenced this issue Oct 24, 2024
@isuckatcs
[analyzer] Fix a crash from element region construction during `Array…
a5fbcd5 
…InitLoopExpr` analysis

This patch generalizes the way element regions are constructed when an `ArrayInitLoopExpr`
is being analyzed. Previously the base region of the `ElementRegion` was determined with
pattern matching, which led to crashes, when an unhandled pattern was encountered.

Fixes llvm#112813
isuckatcs added a commit to isuckatcs/llvm-project that referenced this issue Oct 25, 2024
@isuckatcs
[analyzer] Fix a crash from element region construction during `Array…
f6f54e9 
…InitLoopExpr` analysis

This patch generalizes the way element regions are constructed when an `ArrayInitLoopExpr`
is being analyzed. Previously the base region of the `ElementRegion` was determined with
pattern matching, which led to crashes, when an unhandled pattern was encountered.

Fixes llvm#112813
isuckatcs added a commit to isuckatcs/llvm-project that referenced this issue Oct 25, 2024
@isuckatcs
[analyzer] Fix a crash from element region construction during `Array…
dfb862d 
…InitLoopExpr` analysis

This patch generalizes the way element regions are constructed when an `ArrayInitLoopExpr`
is being analyzed. Previously the base region of the `ElementRegion` was determined with
pattern matching, which led to crashes, when an unhandled pattern was encountered.

Fixes llvm#112813
steakhal pushed a commit that referenced this issue Oct 26, 2024
@isuckatcs
[analyzer] Fix a crash from element region construction during `Array…
a917ae0 
…InitLoopExpr` analysis (#113570)

This patch generalizes the way element regions are constructed when an
`ArrayInitLoopExpr` is being analyzed. Previously the base region of the
`ElementRegion` was determined with pattern matching, which led to
crashes, when an unhandled pattern was encountered.

Fixes #112813
NoumanAmir657 pushed a commit to NoumanAmir657/llvm-project that referenced this issue Nov 4, 2024
@isuckatcs @NoumanAmir657
[analyzer] Fix a crash from element region construction during `Array…
4d27eb0 
…InitLoopExpr` analysis (llvm#113570)

This patch generalizes the way element regions are constructed when an
`ArrayInitLoopExpr` is being analyzed. Previously the base region of the
`ElementRegion` was determined with pattern matching, which led to
crashes, when an unhandled pattern was encountered.

Fixes llvm#112813
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
clang:static analyzer confirmed Verified by a second party crash Prefer [crash-on-valid] or [crash-on-invalid]
Projects
None yet
Milestone
No milestone
4 participants
@steakhal @EugeneZelenko @llvmbot @i80287