<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/75194>75194</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            "error in backend: Invalid size request on a scalable vector" with -fsanitize=array-bounds, __counted_by__
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          arndb
      </td>
    </tr>
</table>

<pre>
    A build failure from the linux kernel with the new ``__counted_by__`` attribute ran into an internal bug that I reduced to this test case

```
#define __counted_by(member) __attribute__((__counted_by__(member)))

struct irq_data {
  struct irq_domain *domain;
} data;

struct irq_domain {
  int mapcount;
  int revmap_size;
  struct irq_data revmap[] __counted_by(revmap_size);
};

struct irq_data *irq_domain_fix_revmap(int i)
{
  return &data.domain->revmap[i];
}
```
building this with ``clang-18 -O2 -fsanitize=array-bounds`` results in

```
fatal error: error in backend: Invalid size request on a scalable vector.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: /opt/compiler-explorer/clang-trunk/bin/clang -gdwarf-4 -g -o /app/output.s -mllvm --x86-asm-syntax=intel -S --gcc-toolchain=/opt/compiler-explorer/gcc-9.2.0 -fcolor-diagnostics -fno-crash-diagnostics -O2 -Wall -fsanitize=array-bounds <source>
1.      <eof> parser at end of file
2.      <source>:13:18: LLVM IR generation of declaration 'irq_domain_fix_revmap'
3.      <source>:13:18: Generating code for declaration 'irq_domain_fix_revmap'
 #0 0x00000000034e3088 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-trunk/bin/clang+0x34e3088)
 #1 0x00000000034e11d4 llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-trunk/bin/clang+0x34e11d4)
 #2 0x000000000342f723 llvm::CrashRecoveryContext::HandleExit(int) (/opt/compiler-explorer/clang-trunk/bin/clang+0x342f723)
 #3 0x00000000034d8bde llvm::sys::Process::Exit(int, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+0x34d8bde)
 #4 0x0000000000c0d206 (/opt/compiler-explorer/clang-trunk/bin/clang+0xc0d206)
 #5 0x0000000003438773 llvm::report_fatal_error(llvm::Twine const&, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3438773)
 #6 0x00000000034388d8 (/opt/compiler-explorer/clang-trunk/bin/clang+0x34388d8)
 #7 0x000000000348773d (/opt/compiler-explorer/clang-trunk/bin/clang+0x348773d)
 #8 0x000000000348775c llvm::TypeSize::operator unsigned long() const (/opt/compiler-explorer/clang-trunk/bin/clang+0x348775c)
 #9 0x0000000003ba7260 emitAddrOfFieldStorage(clang::CodeGen::CodeGenFunction&, clang::CodeGen::Address, clang::FieldDecl const*) CGExpr.cpp:0:0
#10 0x0000000003ba7cc2 clang::CodeGen::CodeGenFunction::EmitLValueForField(clang::CodeGen::LValue, clang::FieldDecl const*) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3ba7cc2)
#11 0x0000000003bbd147 clang::CodeGen::CodeGenFunction::EmitMemberExpr(clang::MemberExpr const*) (.part.0) CGExpr.cpp:0:0
#12 0x0000000003bbe26e clang::CodeGen::CodeGenFunction::EmitMemberExpr(clang::MemberExpr const*) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3bbe26e)
#13 0x0000000003bb38c2 clang::CodeGen::CodeGenFunction::EmitLValueHelper(clang::Expr const*, clang::CodeGen::KnownNonNull_t) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3bb38c2)
#14 0x0000000003bbce21 clang::CodeGen::CodeGenFunction::EmitCheckedLValue(clang::Expr const*, clang::CodeGen::CodeGenFunction::TypeCheckKind) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3bbce21)
#15 0x0000000003c06960 (anonymous namespace)::ScalarExprEmitter::EmitLoadOfLValue(clang::Expr const*) CGExprScalar.cpp:0:0
#16 0x0000000003c06ba2 (anonymous namespace)::ScalarExprEmitter::VisitMemberExpr(clang::MemberExpr*) CGExprScalar.cpp:0:0
#17 0x0000000003bfeb88 (anonymous namespace)::ScalarExprEmitter::Visit(clang::Expr*) CGExprScalar.cpp:0:0
#18 0x0000000003bffdf3 clang::CodeGen::CodeGenFunction::EmitScalarExpr(clang::Expr const*, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3bffdf3)
#19 0x0000000003ba3d4e clang::CodeGen::CodeGenFunction::EmitAnyExpr(clang::Expr const*, clang::CodeGen::AggValueSlot, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3ba3d4e)
#20 0x0000000003ba44f5 clang::CodeGen::CodeGenFunction::EmitAnyExprToTemp(clang::Expr const*) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3ba44f5)
#21 0x0000000003bb1399 clang::CodeGen::CodeGenFunction::EmitBoundsCheck(clang::Expr const*, clang::Expr const*, llvm::Value*, clang::QualType, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3bb1399)
#22 0x0000000003bb15a6 clang::CodeGen::CodeGenFunction::EmitArraySubscriptExpr(clang::ArraySubscriptExpr const*, bool)::'lambda'(bool)::operator()(bool) const CGExpr.cpp:0:0
#23 0x0000000003bbb500 clang::CodeGen::CodeGenFunction::EmitArraySubscriptExpr(clang::ArraySubscriptExpr const*, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3bbb500)
#24 0x0000000003bb389c clang::CodeGen::CodeGenFunction::EmitLValueHelper(clang::Expr const*, clang::CodeGen::KnownNonNull_t) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3bb389c)
#25 0x0000000003bb3f41 clang::CodeGen::CodeGenFunction::EmitLValue(clang::Expr const*, clang::CodeGen::KnownNonNull_t) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3bb3f41)
#26 0x0000000003bff084 (anonymous namespace)::ScalarExprEmitter::Visit(clang::Expr*) CGExprScalar.cpp:0:0
#27 0x0000000003bffdf3 clang::CodeGen::CodeGenFunction::EmitScalarExpr(clang::Expr const*, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3bffdf3)
#28 0x00000000037df233 clang::CodeGen::CodeGenFunction::EmitReturnStmt(clang::ReturnStmt const&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x37df233)
#29 0x00000000037e7615 clang::CodeGen::CodeGenFunction::EmitStmt(clang::Stmt const*, llvm::ArrayRef<clang::Attr const*>) (/opt/compiler-explorer/clang-trunk/bin/clang+0x37e7615)
#30 0x00000000037ed5a9 clang::CodeGen::CodeGenFunction::EmitCompoundStmtWithoutScope(clang::CompoundStmt const&, bool, clang::CodeGen::AggValueSlot) (/opt/compiler-explorer/clang-trunk/bin/clang+0x37ed5a9)
#31 0x0000000003856689 clang::CodeGen::CodeGenFunction::GenerateCode(clang::GlobalDecl, llvm::Function*, clang::CodeGen::CGFunctionInfo const&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3856689)
#32 0x00000000038b177b clang::CodeGen::CodeGenModule::EmitGlobalFunctionDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/opt/compiler-explorer/clang-trunk/bin/clang+0x38b177b)
#33 0x00000000038ad535 clang::CodeGen::CodeGenModule::EmitGlobalDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/opt/compiler-explorer/clang-trunk/bin/clang+0x38ad535)
#34 0x00000000038ae150 clang::CodeGen::CodeGenModule::EmitGlobal(clang::GlobalDecl) (/opt/compiler-explorer/clang-trunk/bin/clang+0x38ae150)
#35 0x00000000038b6167 clang::CodeGen::CodeGenModule::EmitTopLevelDecl(clang::Decl*) (.part.0) CodeGenModule.cpp:0:0
#36 0x0000000003d17f66 (anonymous namespace)::CodeGeneratorImpl::HandleTopLevelDecl(clang::DeclGroupRef) ModuleBuilder.cpp:0:0
#37 0x0000000003d09ea9 clang::BackendConsumer::HandleTopLevelDecl(clang::DeclGroupRef) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3d09ea9)
#38 0x0000000005b23d44 clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+0x5b23d44)
#39 0x0000000003d15995 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-trunk/bin/clang+0x3d15995)
#40 0x0000000003f9acc1 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-trunk/bin/clang+0x3f9acc1)
#41 0x0000000003f174bb clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3f174bb)
#42 0x00000000040793b3 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-trunk/bin/clang+0x40793b3)
#43 0x0000000000c0efa6 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-trunk/bin/clang+0xc0efa6)
#44 0x0000000000c079cd ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#45 0x0000000003d5cbd9 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#46 0x000000000342f623 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-trunk/bin/clang+0x342f623)
#47 0x0000000003d5cdf9 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#48 0x0000000003d24fe7 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-trunk/bin/clang+0x3d24fe7)
#49 0x0000000003d2599d clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-trunk/bin/clang+0x3d2599d)
#50 0x0000000003d2f6fc clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3d2f6fc)
#51 0x0000000000c0c371 clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-trunk/bin/clang+0xc0c371)
#52 0x0000000000b064e1 main (/opt/compiler-explorer/clang-trunk/bin/clang+0xb064e1)
#53 0x00007facbbc29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#54 0x00007facbbc29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#55 0x0000000000c071ce _start (/opt/compiler-explorer/clang-trunk/bin/clang+0xc071ce)
clang: error: clang frontend command failed with exit code 70 (use -v to see invocation)
Compiler returned: 70
```

See also https://godbolt.org/z/73Yz1ebc1
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzkW11z4yiz_jXKDWWXhGR9XOTC48Tzzr6zO3Mmqdk6VyoEyOEMAi1CGWd__SlAjoVi58ve3TrnncokFqDu5-lu6BbCqOvYRlB6GSw-BIurC9TrO6kukRKkuqgkebhcgqpnnIAaMd4rCmolG6DvKOBM9FvwgypBOfjJ9J1tFfQnCNIwSMOyxLIXmpKyeihL1waQ1opVvaZAIQGY0BK4v1QJxEHVb4C-Qxp8AoqSHlMCtAT6jnVA004DjDoahFdBuBx-W6nmx13CmNCaCQrGygOYN7SpqApgAcryEUJZBjAPYD4BOho9_IwUdlr1WAOm_igJ0ggE2QfXAcC4SzaICRDApfsUxMOoILsC5r59wxOpw617uUxo0KDWYny8zzUret-gtuzYn3TUM8XoRjkHTw0zlgCLMc5nIFricLmHW9ZsWw5qYG6Qsb3d9kwU1b0yZkmNiLm7dxbE148IWbC48kAc8rKNRyY2Li5s5LluzJHYzKIczL5AMKs7JJi2prlCSqGHWSV7QbohEhXteq47wMQzAVUjjTigSkkVxEv3ATABKoR_UEFM2ydxjzgjwJgQKPpHb-JUCoBAhxFHFafgnmIt1dyJ_Pr5enlzDbq-apgGyIa8oq1U2oT6ndZtF8TLAK4DuN4wfddXcyybAK45v9_9mbVK_g_FOoBr1nU97QK4BkgQwATmPaF2JmKFujuLVCuEaQBXoFW0VRLTrqMEdLJXrtncibpOYoY0JUD1AnRYsVYPkG80wj8A6ZvWILNN4TwIi69KbhRqAFKbvqFCG-AggGvZGmRYNi3jVM3otuVSmQm1dh7Sqhc_AriumNi1gdmG_ESqniVgtgEzacSgtjXCet32et6BWWOog9lsm6cz1DWz7kFotA3iK7N8cDC7AbPZBuOZlpLjOzvtrp5FYwYXczgPwazGkks1IwxthOw0wx2Y1ULOrBH9ZhNbvyPOj0cYCOLVYN342tkrMvYK4hWVdRBfgxapjiqANKCCAFmDmvFhYYPDyL2AeBnF5lduzPv58_dfwadvYEMFVUgzKczthGKOhssAZkdmZuY0xM9r-DhIFhuAJaGglupt8kEA4xCE23D3L05oHOY5sBEcL4N42T107sNXxYS28XXrgjTfD1LoZyk7rShqApiaQGVCmzXcLtvvibIAfgi3A5rHBcrAjSZwo4gkh-CuOEWib7-IG7YRiAcw74VNoARwaeSfAZzR7YGDPjhYZzAegVuZEP1Gsbyn6mElhaZb7Xr-hQTh9HrLtFuVzwHPavfgxT48kleEHna1XXncxRjUClRS8nOAs7o9cMkYXIhDAsP0RDVOiKdl4ZsgzrNs7CG3vJc2mZQumYzj_PanqViwFJ0e4vxc9rBAPKTpFGlO8jOoyYk_nzJfjYFBTlZjpXhq8idqFnhk99uHlt7Y5dlcydYsa1KByZQ1yJ31z4FwgT2EhYewQhlMQ0AbppeEqC_1mlFObrRUaGPWPifLzWpJ6EcqvIt1L7BZgocoOTbaiDYTzR9iVV1RzHeRtjS8Vx-vt62a49ak9tD-31XSUTjFjjE8qnQK0c3yhunP3xHv6VoqC-AZkm7gq1Cf6CdHZV-hwjjyE0BVkSjJ3s71V_vgYCzq89y3T2nMW6T0PHzJFXACj8KU_h3wTrKyRelZOZ7QiPP3R9S_KG_phMiEwvEp8m8hf4rfpPit57w8R150XDyyyYQspjB6O9nVHcU_KNlNjnexPSjcLI5W-L-ZIGexgCHoWcBPizhMizQ0apCQ4qGRfQcEamjX2sKvcLBuzEOTjUXDXlM18rtE5Ev9Ckvs5pKTdXhGpVNsFYLvxPadda-ZW6-G5ifPqqZVnp8C7amtXg0ln0CpSR2_PYb34F4I4DPVPQ6nF4rTPByT5B0L6FI8vILF0by82djYveHynFWvIzNmC6eZO0nqxbvZ3spb2rQvTLiTORiIHodpRo7iong7hw_2gdyuc6_32pO-fUk5LD7TO_6rR9wsqOd0q2XsmWRaBUQLlL7DrUqhh5u-cls8T-P5af-hOerGBjDjqKkIMg__MPf6dvW2q7D3vUOt_Uy5A6d1QrUIw3-K6Ol-NOg9P04rgzgv8P-fMqjAHtnFlGydvKMMOqn--Sto1olX68B0minDPPlnkjac1g__V5M29KuPjNQwfgeRb_atw41uJjbdt4_2Xk6m4VB6NPzaI6NZGr0jGz8lMIY-SVN2aftG6yBejRc8rUeui6_PQdeyGdOdbP1mlCzQOxL3Sjatyd2G5O9M38le32DZPtkl2Y86sIP22lrsDGYwLD0z-PVLvkjT_I1mGDbiqen0aX_kskL8imLuu32_QfT88-DH3cBPopbnjH5H07ODX7TkVZRl1Ut2-FWSntN9MDi-O9BXtGaCOZ6vsYpr31dup7O0JDyWfsWSI7KIX5zjh1n-8-wseI9dMmFHo8WL9dhhdsc5nQG3geXhXkxiL43SF3f1prhvZfuZ3tMB5Ri9azm0kzeWdDBHT_bhSZTVafpSuTCIdVX1p6blrtm95Xke5kcl-9bkA1gAB-tDzzihhyuIyfY9CQvqL-Ef3OvvlRRd3-zKlrfiONHdDpXnbq9eWFQwJkkyhv0VqY4ub24naZQ2aJI1zlPSDAg8iMXE74uiOLROLMfZcEtxr-nQ5F5XnGo7q3cMLPGzdl0gjL0yfa2k0FSQA8jOg8mp9DD5KbSOsqSapA6n5ZPoNBKYHrbXcRJnSXkOlofbS3lJmBVxFfv7CxbhHv69xOgp2if0zrG8D3A8vPHkJSmtUQowjkp7dmn8qnJcV96hSTG5An4bXIF7ychZYDtQHurpq92swATsTLuKbu0cHmG_aRDn3-1RHLd4HqCQ-rnVyBjeqHtVElHs_sjamfg5hyxwRQprh5HceqhkSmVNaXuHbRJ7GiOIlxhxXiH8o6yFX8Q73UOErKKVbBpkTyJ5E_KgyzpNdlszRjsyNhjZRysmNnbk9eDPxxvKEm-3UeQuKtQxXHZ2-GBFb7BpKLVCTHe77ok4xLmJeKlG_WbI6Hly-bhTdHCnaTAVzHfHLn6R1WF_pNPTE-krT09868UNqil_8Mz5vOvOcsAihf70zKYRRWovG__HRcSk3Drqen__gMCkptlRw1lXoSfJbWdNb2We3GgGeE-frxu6nJz2OMsZBMfSi59JzQEXRUHeaoZfZNUdt8EvsvrMOv8J_LmF99HtLWLG48MxoNeabYiNv8J4xjZj4y3CifHqtMbHgF6NPns5_kByP2b0v9F4p5eR1hqeuaJJUsZxNpSRu2JiB9euEcsnO1fHUu6p5YMB4iH1irSwCtOERmA4tn2KKifJU7Wrr7Ia4arCsCBFOGjhrArgepunZZrM7In62Ub0rgPPOzlPrVB7iyczmcqkSQjK0txWdhopXY64vFoLTXwti2mNFWEKnPyTPWJkPSrbRe_-rLVtAfVQsQM8xHGNGKfEnfqmW6bdGdXM2rPvKJjdAy1BRylgo7J60LKrqIeT6NQe4M7Cw98lcEefKQWId08OZktSSa7nUm0CuP4zgOss_u8_I1rh6IJcxqSIC3RBL6MshHEB0yy8uLsMaUVqGMVhhqOa1BXEaR1lCKd1klWLgl6wSxjCOIIRjJJFFObzmlbJIs9gWGFc1CEOkpA2iPG5mS5G94U9_X2ZLaIiueCooryzX-SAUNCfwHYGEAaLqwt1ac-NV_2mC5KQs053eymaaU4vAwhPOt8eQOjccvzkPVwB_8sWF73il-8_826J_28AAAD__8gxhKw">