Skip to content

Clang 21 crash (Stack dump) when using _Atomic(struct) field access incorrectly in C code #137867

Open
@mariete1223

Description

@mariete1223

Summary:

Clang 21 crashes with a segmentation fault (SIGSEGV) when compiling C code that uses _Atomic(struct) and tries to load and dereference a member incorrectly.
Instead of reporting a clean error about invalid atomic access, the compiler crashes during semantic analysis (Sema::RefersToMemberWithReducedAlignment).

Stack dump

Stack dump:
0.      Program arguments: /usr/local/bin/clang-21 -cc1 -triple x86_64-unknown-linux-gnu -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name prueba.cpp -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root -fcoverage-compilation-dir=/root -resource-dir /usr/local/lib/clang/21 -internal-isystem /usr/local/lib/clang/21/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/9/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -std=c2x -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/prueba-4c1619.o -x c prueba.cpp
1.      prueba.cpp:12:38: current parser token ')'
2.      prueba.cpp:10:1: parsing function body 'main'
3.      prueba.cpp:10:1: in compound statement ('{}')
^[[A #0 0x000056358be8a18f llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/local/bin/clang-21+0x3c4a18f)
 #1 0x000056358be87bd4 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007f65c50ae420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #3 0x000056358f68488b getInterestingTagDecl(clang::TagDecl*) Type.cpp:0:0
 #4 0x000056358e2ffb2b clang::Sema::RefersToMemberWithReducedAlignment(clang::Expr*, llvm::function_ref<void (clang::Expr*, clang::RecordDecl*, clang::FieldDecl*, clang::CharUnits)>) (/usr/local/bin/clang-21+0x60bfb2b)
 #5 0x000056358e300180 clang::Sema::CheckAddressOfPackedMember(clang::Expr*) (/usr/local/bin/clang-21+0x60c0180)
 #6 0x000056358e5cd823 clang::Sema::CheckAddressOfOperand(clang::ActionResult<clang::Expr*, true>&, clang::SourceLocation) (/usr/local/bin/clang-21+0x638d823)
 #7 0x000056358e5f1710 clang::Sema::CreateBuiltinUnaryOp(clang::SourceLocation, clang::UnaryOperatorKind, clang::Expr*, bool) (/usr/local/bin/clang-21+0x63b1710)
 #8 0x000056358e5f1f85 clang::Sema::BuildUnaryOp(clang::Scope*, clang::SourceLocation, clang::UnaryOperatorKind, clang::Expr*, bool) (/usr/local/bin/clang-21+0x63b1f85)
 #9 0x000056358e6fdb15 clang::TreeTransform<clang::Sema::CorrectDelayedTyposInExpr(clang::Expr*, clang::VarDecl*, bool, llvm::function_ref<clang::ActionResult<clang::Expr*, true> (clang::Expr*)>)::TyposReplace>::TransformInitializer(clang::Expr*, bool) SemaExprCXX.cpp:0:0
#10 0x000056358e6fd892 clang::TreeTransform<clang::Sema::CorrectDelayedTyposInExpr(clang::Expr*, clang::VarDecl*, bool, llvm::function_ref<clang::ActionResult<clang::Expr*, true> (clang::Expr*)>)::TyposReplace>::TransformExprs(clang::Expr* const*, unsigned int, bool, llvm::SmallVectorImpl<clang::Expr*>&, bool*) SemaExprCXX.cpp:0:0
#11 0x000056358e7047e1 clang::TreeTransform<clang::Sema::CorrectDelayedTyposInExpr(clang::Expr*, clang::VarDecl*, bool, llvm::function_ref<clang::ActionResult<clang::Expr*, true> (clang::Expr*)>)::TyposReplace>::TransformCallExpr(clang::CallExpr*) SemaExprCXX.cpp:0:0
#12 0x000056358e715f64 clang::TreeTransform<clang::Sema::CorrectDelayedTyposInExpr(clang::Expr*, clang::VarDecl*, bool, llvm::function_ref<clang::ActionResult<clang::Expr*, true> (clang::Expr*)>)::TyposReplace>::TransformCXXDependentScopeMemberExpr(clang::CXXDependentScopeMemberExpr*) SemaExprCXX.cpp:0:0
#13 0x000056358e71b813 clang::TreeTransform<clang::Sema::CorrectDelayedTyposInExpr(clang::Expr*, clang::VarDecl*, bool, llvm::function_ref<clang::ActionResult<clang::Expr*, true> (clang::Expr*)>)::TyposReplace>::TransformUnaryOperator(clang::UnaryOperator*) SemaExprCXX.cpp:0:0
#14 0x000056358e6cd20d clang::Sema::CorrectDelayedTyposInExpr(clang::Expr*, clang::VarDecl*, bool, llvm::function_ref<clang::ActionResult<clang::Expr*, true> (clang::Expr*)>) (/usr/local/bin/clang-21+0x648d20d)
#15 0x000056358e6ce45d clang::Sema::ActOnFinishFullExpr(clang::Expr*, clang::SourceLocation, bool, bool, bool) (/usr/local/bin/clang-21+0x648e45d)
#16 0x000056358e5e23b5 clang::Sema::ActOnCondition(clang::Scope*, clang::SourceLocation, clang::Expr*, clang::Sema::ConditionKind, bool) (/usr/local/bin/clang-21+0x63a23b5)
#17 0x000056358e1afef0 clang::Parser::ParseParenExprOrCondition(clang::ActionResult<clang::Stmt*, true>*, clang::Sema::ConditionResult&, clang::SourceLocation, clang::Sema::ConditionKind, clang::SourceLocation&, clang::SourceLocation&) (/usr/local/bin/clang-21+0x5f6fef0)
#18 0x000056358e1bb526 clang::Parser::ParseWhileStatement(clang::SourceLocation*) (/usr/local/bin/clang-21+0x5f7b526)
#19 0x000056358e1b211e clang::Parser::ParseStatementOrDeclarationAfterAttributes(llvm::SmallVector<clang::Stmt*, 32u>&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::ParsedAttributes&, clang::ParsedAttributes&) (/usr/local/bin/clang-21+0x5f7211e)
#20 0x000056358e1b3104 clang::Parser::ParseStatementOrDeclaration(llvm::SmallVector<clang::Stmt*, 32u>&, clang::Parser::ParsedStmtContext, clang::SourceLocation*) (/usr/local/bin/clang-21+0x5f73104)
#21 0x000056358e1b446c clang::Parser::ParseCompoundStatementBody(bool) (/usr/local/bin/clang-21+0x5f7446c)
#22 0x000056358e1b67e2 clang::Parser::ParseFunctionStatementBody(clang::Decl*, clang::Parser::ParseScope&) (/usr/local/bin/clang-21+0x5f767e2)
#23 0x000056358e0ade83 clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::LateParsedAttrList*) (/usr/local/bin/clang-21+0x5e6de83)
#24 0x000056358e0f7f05 clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/usr/local/bin/clang-21+0x5eb7f05)
#25 0x000056358e0a662d clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/usr/local/bin/clang-21+0x5e6662d)
#26 0x000056358e0a716e clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/usr/local/bin/clang-21+0x5e6716e)
#27 0x000056358e0b0d73 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/usr/local/bin/clang-21+0x5e70d73)
#28 0x000056358e0b26a8 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr<clang::DeclGroupRef>&, clang::Sema::ModuleImportState&) (/usr/local/bin/clang-21+0x5e726a8)
#29 0x000056358e0a062a clang::ParseAST(clang::Sema&, bool, bool) (/usr/local/bin/clang-21+0x5e6062a)
#30 0x000056358c80ee45 clang::CodeGenAction::ExecuteAction() (/usr/local/bin/clang-21+0x45cee45)
#31 0x000056358caf39b8 clang::FrontendAction::Execute() (/usr/local/bin/clang-21+0x48b39b8)
#32 0x000056358ca71d3b clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/usr/local/bin/clang-21+0x4831d3b)
#33 0x000056358cbe5c7b clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/usr/local/bin/clang-21+0x49a5c7b)
#34 0x00005635890e2f51 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/usr/local/bin/clang-21+0xea2f51)
#35 0x00005635890db5fd ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#36 0x00005635890de99f clang_main(int, char**, llvm::ToolContext const&) (/usr/local/bin/clang-21+0xe9e99f)
#37 0x0000563588fb130b main (/usr/local/bin/clang-21+0xd7130b)
#38 0x00007f65c4b5c083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#39 0x00005635890db07e _start (/usr/local/bin/clang-21+0xe9b07e)

Program

#include <stdlib.h>
#include <pthread.h>
struct T {
 char value;
};
void* work(void* p) {
 struct T* t = (struct T*)p;
}
int main()
{
 _Atomic(struct T) t;
 while (!atomic_load(&t.value)->value)
  ;
 return t.value->value;
}

To quickly reproduce

https://gcc.godbolt.org/z/d6GbsWjq5

Metadata

Metadata

Assignees

No one assigned

    Labels

    clang:frontendLanguage frontend issues, e.g. anything involving "Sema"confirmedVerified by a second partycrashPrefer [crash-on-valid] or [crash-on-invalid]generated by fuzzer

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions