<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Issue</th>
<td>
<a href=https://github.com/llvm/llvm-project/issues/68278>68278</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>
[libtooling] CFG::print crashes on derived class template ctor calling dependent base ctor with AddInitializers=true
</td>
</tr>
<tr>
<th>Labels</th>
<td>
new issue
</td>
</tr>
<tr>
<th>Assignees</th>
<td>
</td>
</tr>
<tr>
<th>Reporter</th>
<td>
smcpeak
</td>
</tr>
</table>
<pre>
For the following input:
```c++
// test.cc
// Demonstrate CFG printing crash.
template <typename T>
struct Derived : public T {
Derived()
: T()
{}
};
// EOF
```
If [`CFG::buildCFG`](https://clang.llvm.org/doxygen/classclang_1_1CFG.html#a2e832d72829f1735bdc0aa7f1e80686c) is used with [`BuildOptions::AddInitializers`](https://clang.llvm.org/doxygen/classclang_1_1CFG_1_1BuildOptions.html#a9f3870f8091934cf596575fe3834b7a4) set to `true`, then the result printed with [`CFG::print`](https://clang.llvm.org/doxygen/classclang_1_1CFG.html#a13a2a8832530c090b627c6d47e725ca7), printing crashes:
```
scott@mint201vm:~/wrk/clang/bug-print-cfg$ lldb -- ./print-cfg.exe test.cc
(lldb) target create "./print-cfg.exe"
Current executable set to '/home/scott/wrk/clang/bug-print-cfg/print-cfg.exe' (x86_64).
(lldb) settings set -- target.run-args "test.cc"
(lldb) run
Process 591398 launched: '/home/scott/wrk/clang/bug-print-cfg/print-cfg.exe' (x86_64)
CFG for Derived::Derived<T>:
[B2 (ENTRY)]
Succs (1): B1
[B1]
1: Process 591398 stopped
* thread #1, name = 'print-cfg.exe', stop reason = signal SIGSEGV: invalid address (fault address: 0x28)
frame #0: 0x00007ffff036715b libclang-cpp.so.16`print_initializer(llvm::raw_ostream&, (anonymous namespace)::StmtPrinterHelper&, clang::CXXCtorInitializer const*) + 91
libclang-cpp.so.16`print_initializer:
-> 0x7ffff036715b <+91>: movq 0x28(%rax), %rax
0x7ffff036715f <+95>: testb $0x7, %al
0x7ffff0367161 <+97>: jne 0x7ffff03671b9 ; <+185>
0x7ffff0367163 <+99>: andq $-0x8, %rax
(lldb) bt
* thread #1, name = 'print-cfg.exe', stop reason = signal SIGSEGV: invalid address (fault address: 0x28)
* frame #0: 0x00007ffff036715b libclang-cpp.so.16`print_initializer(llvm::raw_ostream&, (anonymous namespace)::StmtPrinterHelper&, clang::CXXCtorInitializer const*) + 91
frame #1: 0x00007ffff035352b libclang-cpp.so.16`print_elem(llvm::raw_ostream&, (anonymous namespace)::StmtPrinterHelper&, clang::CFGElement const&) + 587
frame #2: 0x00007ffff0354d11 libclang-cpp.so.16`print_block(llvm::raw_ostream&, clang::CFG const*, clang::CFGBlock const&, (anonymous namespace)::StmtPrinterHelper&, bool, bool) + 1969
frame #3: 0x00007ffff035449f libclang-cpp.so.16`clang::CFG::print(llvm::raw_ostream&, clang::LangOptions const&, bool) const + 143
frame #4: 0x0000555555557844 print-cfg.exe`PrintCFGs::VisitFunctionDecl(clang::FunctionDecl*) + 340
frame #5: 0x000055555564776d print-cfg.exe`clang::RecursiveASTVisitor<PrintCFGs>::WalkUpFromFunctionDecl(clang::FunctionDecl*) + 93
[...bunch of RAV frames omitted...]
frame #17: 0x0000555555559646 print-cfg.exe`clang::RecursiveASTVisitor<PrintCFGs>::TraverseDecl(clang::Decl*) + 3910
frame #18: 0x0000555555557b83 print-cfg.exe`main + 771
frame #19: 0x00007fffed50f0b3 libc.so.6`__libc_start_main + 243
frame #20: 0x000055555555762e print-cfg.exe`_start + 46
```
The problem happens with Clang 16 as well as a trunk build from 2023-09-13.
Impact: This is mainly troublesome because printing the CFG is a natural thing to do while debugging, so when that crashes too it impedes the original debug effort.
Complete program to reproduce:
```c++
// print-cfg.cc
// Print CFGs of all functions.
#include "clang/AST/RecursiveASTVisitor.h" // clang::RecursiveASTVisitor
#include "clang/Analysis/CFG.h" // clang::CFG
#include "clang/Frontend/ASTUnit.h" // clang::ASTUnit
#include "clang/Frontend/CompilerInstance.h" // clang::CompilerInstance
#include "clang/Frontend/CompilerInvocation.h" // clang::CompilerInvocation
#include "clang/Frontend/Utils.h" // clang::createInvocation
#include "clang/Serialization/PCHContainerOperations.h" // clang::PCHContainerOperations
class PrintCFGs : public clang::RecursiveASTVisitor<PrintCFGs> {
public: // data
// The ASTUnit we want to process.
clang::ASTUnit *m_astUnit;
public: // methods
PrintCFGs(clang::ASTUnit *astUnit)
: m_astUnit(astUnit)
{}
clang::ASTContext &getASTContext()
{ return m_astUnit->getASTContext(); }
bool VisitFunctionDecl(clang::FunctionDecl *decl);
};
bool PrintCFGs::VisitFunctionDecl(
clang::FunctionDecl *decl)
{
if (!decl->doesThisDeclarationHaveABody()) {
return true;
}
llvm::outs() << "CFG for " << decl->getQualifiedNameAsString() << ":\n";
llvm::outs().flush();
clang::CFG::BuildOptions buildOptions;
// Setting this option is required for the bug to happen.
buildOptions.AddInitializers = true;
std::unique_ptr<clang::CFG> cfg(clang::CFG::buildCFG(
decl,
decl->getBody(),
&getASTContext(),
buildOptions));
if (!cfg) {
// CFG construction can fail for some template function cases.
return true;
}
// BUG: This crashes for a class template constructor that explicitly
// calls a dependent base class constructor.
cfg->print(llvm::outs(),
getASTContext().getLangOpts(),
false /*showColors*/);
llvm::outs().flush();
return true;
}
// This is boilerplate up to running the visitor.
int main(int argc, char **argv)
{
std::vector<char const *> commandLine;
commandLine.push_back(CLANG_LLVM_INSTALL_DIR "/bin/clang");
for (int i = 1; i < argc; ++i) {
commandLine.push_back(argv[i]);
}
std::shared_ptr<clang::CompilerInvocation> compilerInvocation(
clang::createInvocation(llvm::ArrayRef(commandLine)));
if (!compilerInvocation) {
return 2;
}
std::shared_ptr<clang::PCHContainerOperations> pchContainerOps(
new clang::PCHContainerOperations());
clang::DiagnosticOptions *diagnosticOptions =
&(compilerInvocation->getDiagnosticOpts());
clang::IntrusiveRefCntPtr<clang::DiagnosticsEngine> diagnosticsEngine(
clang::CompilerInstance::createDiagnostics(
diagnosticOptions /*callee takes refcount ownership*/));
std::unique_ptr<clang::ASTUnit> ast(
clang::ASTUnit::LoadFromCompilerInvocationAction(
compilerInvocation,
pchContainerOps,
diagnosticsEngine));
if (ast == nullptr || diagnosticsEngine->getNumErrors() > 0) {
return 2;
}
clang::TranslationUnitDecl *tu =
ast->getASTContext().getTranslationUnitDecl();
PrintCFGs visitor(ast.get());
visitor.TraverseDecl(tu);
return 0;
}
// EOF
```
`Makefile`:
```
# print-cfg/Makefile
# ---- Configuration ----
# Set to 1 if I am using a build from source, 0 for a binary
# distribution.
USE_SOURCE_BUILD := 0
ifeq ($(USE_SOURCE_BUILD),1)
# Use my own build.
CLANG_LLVM_SRC_DIR = $(HOME)/wrk/clang/llvm-project
CLANG_LLVM_INSTALL_DIR = $(CLANG_LLVM_SRC_DIR)/build
else
# Installation directory from a binary distribution.
# Has five subdirectories: bin include lib libexec share.
CLANG_LLVM_INSTALL_DIR = $(HOME)/opt/clang+llvm-16.0.0-x86_64-linux-gnu-ubuntu-18.04
endif
# Let the user override my defaults.
-include pre-config.mk
# ---- llvm-config query results ----
# Program to query the various LLVM configuration options.
LLVM_CONFIG := $(CLANG_LLVM_INSTALL_DIR)/bin/llvm-config
# C++ compiler options to ensure ABI compatibility.
LLVM_CXXFLAGS := $(shell $(LLVM_CONFIG) --cxxflags)
# Directory containing the clang library files, both static and dynamic.
LLVM_LIBDIR := $(shell $(LLVM_CONFIG) --libdir)
# Other flags needed for linking, whether statically or dynamically.
LLVM_LDFLAGS_AND_SYSTEM_LIBS := $(shell $(LLVM_CONFIG) --ldflags --system-libs)
# ---- Compiler options ----
# C++ compiler.
CXX = $(CLANG_LLVM_INSTALL_DIR)/bin/clang++
# Compiler options, including preprocessor options.
CXXFLAGS =
CXXFLAGS += -Wall
CXXFLAGS += -Werror
# Silence a warning about a multi-line comment in DeclOpenMP.h.
CXXFLAGS += -Wno-comment
# Get llvm compilation flags.
CXXFLAGS += $(LLVM_CXXFLAGS)
ifeq ($(USE_SOURCE_BUILD),1)
# When using my own build, I need to separately point at clang includes.
CXXFLAGS += -I$(CLANG_LLVM_SRC_DIR)/clang/include
CXXFLAGS += -I$(CLANG_LLVM_INSTALL_DIR)/tools/clang/include
endif
# Tell the source code where the clang installation directory is.
CXXFLAGS += -DCLANG_LLVM_INSTALL_DIR='"$(CLANG_LLVM_INSTALL_DIR)"'
# Switch to enable creation of .d files.
GENDEPS_FLAGS = -MMD
# Linker options.
LDFLAGS =
# Pull in clang+llvm via libclang-cpp.so, which has everything, but is
# only available as a dynamic library.
LDFLAGS += -lclang-cpp
# Arrange for the compiled binary to search the libdir for that library.
# Otherwise, one can set the LD_LIBRARY_PATH envvar before running it.
# Note: the -rpath switch does not work on Windows.
LDFLAGS += -Wl,-rpath=$(LLVM_LIBDIR)
# It appears that llvm::raw_os_ostream::~raw_os_ostream is missing from
# libclang-cpp, so I have to link with LLVMSupport statically.
LDFLAGS += -lLLVMSupport
# Get the needed -L search path, plus things like -ldl.
LDFLAGS += $(LLVM_LDFLAGS_AND_SYSTEM_LIBS)
# Optional custom modifications.
-include config.mk
# ---- Recipes ----
# Default target.
all:
.PHONY: all
# Pull in automatic dependencies.
-include $(wildcard *.d)
# Compile a C++ source file.
%.o: %.cc
$(CXX) -c -o $@ $(GENDEPS_FLAGS) $(CXXFLAGS) $<
OBJS :=
OBJS += print-cfg.o
# Executable.
all: print-cfg.exe
print-cfg.exe: $(OBJS)
$(CXX) -g -Wall -o $@ $(OBJS) $(LDFLAGS)
# Test.
.PHONY: check
check: print-cfg.exe test.cc
./print-cfg.exe test.cc
.PHONY: clean
clean:
$(RM) *.o *.d *.exe
$(RM) -r out
# EOF
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzcW0lz27qT_zTMBSUVRWo95KDV8ZSzjO28l3dSQWRTxN8gwACglzn8P_tUA9xFO86bN1VT40o5Egh0_7rRGxo01ZqdBcBHb7bxZrsPtDCpVB91FuVAHz6cZPzy8SAVMSmQRHIun5g4Eybywnjh2vN3nl_9nvvuX-QFG_znRoODFxyIAW3GUdQZ20EmhTaKGiDbwxXJFRMGqUeK6nTcpm0gyznO88KteclB0AzIvRfu3WNtVBEZsgPFHiEmXrgmeXHiLCL3xFuUSEj13AuWXrCqBomdft8ZxDWLXQlgsfPCTUdQB3__9dATvD3pOiGo0bm_PVyhosL1qWA8xm9z35vtvGCZGpNrfGbpRZyK85jzx2ws1dkLDrF8fjmDcI-0ts-Pk-Nke7gapybjXhDSAJZhEC-CZbBKJotwdoojn9JFMoGlP1_OIy9YEaZJoSEmT8ykJaYNQvmaGyaFduDWcXwtmGGUs_8Cpf8BjPhfm0-NeZWEy4WfLP3VZBVOo2S2ms8WswTCZTg9LegUMWswxEjizX2jCkA0wRZNUFg7VKALbpy9dAWrlW2f_ZOanoQ0oMtlGMxCP_JX_mkeLKJ5PF3AIphFdIHGE2x7Ngz6NR8p7TaSxnhTP2PCBP7kMfPC9b-94PCkHiqcXnA4FeeRpTuKkrMXTAnn8YmMRmTsBYf6wRieoe9mS5yJ-jRUncGQSIF1oiC4WOoFgVu1LZQCYQg8Q1QYeuJQ70aw8IJDKjPwgoOD_guofRYL4gXL5-X8OMddHl_A1GBQedpyHI1K2GNViBFVZ00QeSVihbe1XBXCjX1TMgKtyWw1CVdLwmkhohRidPR_WohSaYcrkkhVRxhrg_WXrY1UXUtAg90ESGr_5f72L6Q029Ux6a6IIo0PJ_ggXJPN5GLxpL1ggpN6Ymsj8xziSk1rYlIFNCZeEE7QVm0Q9cId6qQvIz7H9UQB1VLYaZgoKCd311d3-6s_kCETj5SzmNA4VsjYC5YJRdcsB3CO_9yOrImyTIPQd8983_cXSZIkfjhfTGYnwtnJ7sMoyvOxluPJ3Jv7Ft2RNQHKbrp1Fy9cK_p0lNoooJkXzBG5FyypkOIlk4W2YuqcRuBU6YXrO5OZbzZ4qE_AcyRnlzkDsFO2P35sjVStmEgiTFZesEZL84INWZVb8k7E1faPvHBPiP_ckdoLt16wWU2cnZBMPv4sFbf0gpmiz2V4Kb_UqatDJqnIzEoy6CondJqp_7wol1Nerm4vnU-qpYty6b8E9OmfVqT144Wbcs1kOasTcZdqWFFdlVSpiH8SC2jkPy_7ArU8-WT-T1ktQRz_D023kWlyIdMsnAVvygQcsv99YQ5Xew4ZJqRSiHklxGy5aByhFiS4FGQaTyZvCXLiMnr4hSRdSC2F9h9tkFgL699WwklK3vzvRJ6s5qsBmcMBmaerZFjmLtx2tfRuDdxQcS6ruo6kFVQ75gBPwwG80wbvrPxZLKdT0nXnuW_Vsj1clTXqH0wzcyhEhJx3EHEvWLZQdZ_Uth5O_b6xz_r859PFYh5f8G8Rv4WoUJo9wvru3uKQygu3LYB7N-9Pyh--5wcls98GuipV5c024_H4hCULkQm5Xf_hkGsiM2YMxOPxuJ36W068uFTsaj6d_xOC3Sv6CErDpTh9fa8m_hC25cCmn5bhBbaMMmEJLRaXUWrVtXSIZ37in0Jr6WjhaODHI347akOVOdbUgkFLDPwBVPMALlA5cpbSdP7Gse8-xbXyxCEjKc1zENqdT7aoMDKZE6rJE3CO_1NiVCEeiD0ZkkTJjAR-EI781WgSds6_11lOI2MPqinTeKRDwfgLMUoWJw5aZkBOENFCQ3MGwbMSRiuGrAQ1haKcmNQ-kiSW5CllHEgMp-J8Zlj7bonGUXvOoqY6xBAjJWGGsCyHGL-mQKRiZ4aJ1a4mkCRSmQ7mrcxyDsbq46xohjwV5ErGRQS_0zto9qLXQLBWihJqdBTKOUlK19Lj7oE9ZCLiRWyPPlWZv76794LDgP2PUy_Aytzy-IWrvEVfUP6imfaCgz1IDhPFGPwGkYOSwoCIHd7vgpnXCJWP30kMN4dxUNdCGyoicFS7PwNge6t-m9mjjCjuz6vauJj5ThbfDeP6Naru2Ps-mnegbNXkJgaHb9tPWykMZQLU1xwULZsZpboumQ0v6Jij_W1bDaQOtO2m1W-F56bB5VYjnfb2xdTQpoy1QxikSnMhT0CeqLDn-9wdH8fV7Evjwjo4O1JtrKV1u2IN95JLBiaVsa6oNZg72aNFuaLb7801HIPl5ZxOr24QOW4HPCOL-RlMM9Bv-REFplCi4YdHtaEVePTps8Tah_xGhYICx3bGqlHkZavR_ra031EMDYj_GsuSX90aZQmxwk1wAsodS9CYa3AhdUb8iT7CeiPjl1INmPAbCqRSn-3YhZtmf7qaampMWRjtSNlzYoilclB1Uqwnu9EK0hnMfxaUs4RB_IVmsNZ3Rtm01aOB5GdbYT_VOIb4jhNe6LTe1VeNqC6U2w1Nl7brLmpvdekEd66jhVlXE2nnYjpW8LNgCmIrKqZTzKFGliVD7YFtDuNei9Yebju6LldpU_afCsF-FnDMDYaMvjR7YptbyyEp6051Y1KEOMvZlgOtPWlbxLblucPe1p7SUaA1qNZ-1RZpcfZMrdRufRRThbVyElFBEsq41astiuqbg6o0IBHV0AS595ptxXLz_aouw6ryCJlR4gJ6za_GZXeYGgLPOWcRM_ylRzKinGOFFkMOIsaj7olqKOm1yDSBOTmj7i9PbY1lN3oe2ITxGUx5hruY3v5JKNfgUK51Kp-2kkulba1_GPCY3_awIc339N6p96ra9ySxRnBqLnJbVxZCVBXvY1nFuaVYIWKt7AVL_EjVObKn2ZRijFlj2lHnx6GQWPvRI0Qu7dpF1eF2bX1IZhkV8Q0TLdtpDY7zQqfHE7X9he3N-svV8ebmj8_H6y939-ubm-Pu-tYGrOBwYqJpQQddV3Dx0OJn1u0nmILw49YJhAnJ1s3swlNeA2Olnm2YvSBZvWH4tRp0ShXEA-HksmZzmumP1tHkrdKsbc5rpejLLSQYplqKdpHilWAxwHY4TQX_E5lfKfLCPcmjtPVEd0KogKd3VIpVcm3ha5-2GT0LqQ2LqjSEWf1yMNx1QrFTYU81ZQDvkBzi32J_LYwqsB69hWQrzLe-Yhpaei_O1i32JL4YHDKFi8NFy0BaZDsaJWRAdBuvMKgCEEMfANNtEslCGCKfBCidsrwJYpdx6ZcJtDpqhXtCtRkUpp5i-2WSxgcls0tPWUc9zxgw305kvjCvOiFf6njQRygGr3CHUUQUnOdGEW-x9RbbSwqleXwpsr1SNvCXddae-L_lVW3F3CsqNLeioYKqutQULZOl-rXSGzPXAIVX8ktzuCpzgpMfiQx5WZU4eq0uU7yRu_x3Ja63XxXw5v5n-gAJ4_am-80bYy9odcy84FAv7LY7yGg0GpGtFAk7Fy6w2KFmwp27052gWVwTmpFCYwKl7WaUloWKANOlX9Y4JyaoemmoxEwbxU6FPdO74e93--Pd1--32_1x8_36Zkfsvu9IR2SWwE8XsadesOwvcQXJpHP_EpLvGkj2gi7sMNblUCuv3t1uXU6190NI-9PXz3tLr3fJi1lmlCv5L4jMAKFOgq6JXXJypC2etnzANbSx25jGndGSmClbUbw4LVdaHVKmW_2JapKwRyC6OFWLmX23AJeSqovBmb2vgWeIiE1cQxoaFqzRksxNo6WN1dJkPvbH_shdeY84E8Xz6CyKUXEqhClGk-XYn3aEFzFL-gZ5g_aWAik0KCIfQSkW2_2MwV6-VRX5qJImVzCKrAGPs4chzyqN3EJ0E8nPAtRL-XqI7hn8t6YL6abZWpEqJgtNUDUk6riLzNuNRKu77dcvh-uryqAvTKKl2tIsbE3XAtgXYOuqtjrsV0wRJAhdKCDrzbV9TA07Mc7MSwfQjx-Hm_XVXReSToHz8nMLN4bs0Sh6fk44Peum4q3R7Gq7jFyKqSpqaw1oWgrNFMONdtc9JiXaUMMiQkVM4hdBMxa1Ad5cb5yhvRceZ2jhA-C-mhQUsdCJAIjLszNn4qHsXD-lYOc4RJTzFyJVBQq_doDtrOKO6y-7491fd_d7i_V3FMljB2Y00i_aQIbQL7Taj8e9be5aaN8aSrzbHz-GQ9Ar9lb5btNGbzj0AKDanL_hVue2Ox-B1lL1zL9laLv-SLBBdKM_KeevPQKsH_pg7hgHEQGh5Ikqa2v0JAtDKMkKbhgGGrDHFzwRM0EwHX_NQXz-Nk4vYFWchByVS_rsrsDYWFGq1zm53cJXiLX3vXzU296_k8X-TEGUubadzHAnrq1ho-9ryKmiBvgLyaU9tprSCcvo2PQvLlRw_XaqqvJfSeg3yFyYm5GS69dIDiaBe_QnjCiusiCRjAH9VkErzrDhXMle26fR7hWQ4c6-EhL8UpIA5_Wt84mZKHWB2L4EZw8iNjEkZBy7KFgiutp_2e2_3R1rFyGjz58Hq8GQ3DDxAH33KqNR412ttFVwjtbfzsjkkdH-5b6LgCxKSUo1gUdQL_amzwbqwhCmG5pS8BdCHynjVjJ7E1nGySrK94GVquY1yz5OPKuLM9QNzTKIxVVxY62aKlRpakuVmKlyMjU9rnW8f2Lalp8SIwEV7kXEFMjNDqP17fr2r-O39f0nAuLxkSpygkQqqJtBzLTofZEG7DtRKZCRyimmLrfFsQRNhDTkSaoHIgX5k4lYPl3sTRViuBdsHQVrYXWQcLluIHVdG0LzHKjSpbC9tyzqFy3s2L-7g_aul2kbMLBcbMi2DaC8ub0mKX0E1DXmRXfxjNjuijyXyrRS42v725o9FEBRe2X2Hd1UG2pVEWxJzgvtrpc14ewByIjHfJhRW23DmXioBLA-QzmJCm1kRjIZs4RFtO1Jdfn4ntLxFiKWQz8N71xBWr186h5gcqsOZuNvn75--cu-z1alvEt_pYWRmS2NqrZuxOACpdPDE-NxRFWMB-FxPCB5mbcJrWuEMoBiFKqNfDaW7vpt1lyU-6sy-v34YcuWiIyk5Tr1S-ad4OVe4igXdEbCbRvU181_VLVSe8BtbnNfL_uC7OuXijt67b1uYZ90h6xciAsZtTTUE-_s6pALIctVld3thrK5S1C62vFml6MUotKM3Mc-4N5r1_7qVy9m9xlwoOWltPvYtABK-W4_O_TrsXRGYn_XuurNGykiCzNs-K-1Ij7EH8N4Fa7oB_g4ma_m00UQTMMP6ccQaBwsT9Q_TcIonsyicD6DZLVcRItVkiwnH9jHwA_Cie_P_GCyCMJxPJ3R5SRZwSmZTJNg4k19yCjj9Sv3H5jWBXycL4PF8gOnJ-Da_vlJEAh4IvYhJuXZ7oP6aE9Pp-KsvanPmTa6oWKY4fbvVjg7YS2C2W62I9232upLGiwmyr8P6d_UGKnsJQzG2P4lDD6zcbT_FxLhzqgCPhSKf-z-ecGZmbQ4jSOZlYe_frchOFgRsXSyKvjvAAAA__8fsTJv">