[llvm-bugs] [Bug 44756] New: Crash on release version. Assertion `Arg < getNumArgs() && "Arg access out of range!"

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=44756

            Bug ID: 44756
           Summary: Crash on release version. Assertion `Arg <
                    getNumArgs() && "Arg access out of range!"
           Product: clang
           Version: trunk
          Hardware: PC
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: Frontend
          Assignee: unassignedclangbugs at nondot.org
          Reporter: changochen1 at gmail.com
                CC: llvm-bugs at lists.llvm.org, neeilans at live.com,
                    richard-llvm at metafoo.co.uk

POC:
---
# 1 "<built-in>"
# 1 "test1.c"
a() {          int strlen(;          strlen() - 5
---

Run script:
---
# Crash reproducer for clang version 11.0.0
(https://github.com/llvm/llvm-project.git
56b7f595d2b402ff177ca42214325c8fdea10fb0)
# Driver args: "-x" "c" "-o" "/dev/null" "test1.c"
# Original command:  "/home/rxz226/llvm-project/bld_instru/bin/clang-11" "-cc1"
"-triple" "x86_64-unknown-linux-gnu" "-emit-obj" "-mrelax-all" "-disable-free"
"-main-file-name" "test1.c" "-mrelocation-model" "static" "-mthread-model"
"posix" "-mframe-pointer=all" "-fmath-errno" "-fno-rounding-math"
"-masm-verbose" "-mconstructor-aliases" "-munwind-tables" "-target-cpu"
"x86-64" "-dwarf-column-info" "-fno-split-dwarf-inlining"
"-debugger-tuning=gdb" "-resource-dir"
"/home/rxz226/llvm-project/bld_instru/lib/clang/11.0.0" "-internal-isystem"
"/usr/local/include" "-internal-isystem"
"/home/rxz226/llvm-project/bld_instru/lib/clang/11.0.0/include"
"-internal-externc-isystem" "/usr/include/x86_64-linux-gnu"
"-internal-externc-isystem" "/include" "-internal-externc-isystem"
"/usr/include" "-fdebug-compilation-dir"
"/home/rxz226/fuzzing/2020-02-02/clang/hangs/test" "-ferror-limit" "19"
"-fmessage-length" "0" "-fgnuc-version=4.2.1" "-fobjc-runtime=gcc"
"-fdiagnostics-show-option" "-fcolor-diagnostics" "-faddrsig" "-o"
"/tmp/test1-076316.o" "-x" "c" "test1.c"
 "/home/rxz226/llvm-project/bld_instru/bin/clang-11" "-cc1" "-triple"
"x86_64-unknown-linux-gnu" "-emit-obj" "-mrelax-all" "-disable-free"
"-main-file-name" "test1.c" "-mrelocation-model" "static" "-mthread-model"
"posix" "-mframe-pointer=all" "-fmath-errno" "-fno-rounding-math"
"-masm-verbose" "-mconstructor-aliases" "-munwind-tables" "-target-cpu"
"x86-64" "-dwarf-column-info" "-fno-split-dwarf-inlining"
"-debugger-tuning=gdb" "-ferror-limit" "19" "-fmessage-length" "0"
"-fgnuc-version=4.2.1" "-fobjc-runtime=gcc" "-fdiagnostics-show-option"
"-fcolor-diagnostics" "-faddrsig" "-x" "c" "test1-31d3ae.c"
---

Stack dump:
---
clang: /home/rxz226/llvm-project/clang/include/clang/AST/Expr.h:2707: const
clang::Expr *clang::CallExpr::getArg(unsigned int) const: Assertion `Arg <
getNumArgs() && "Arg access out of range!"' failed.
Stack dump:
0.      Program arguments: /home/rxz226/llvm-project/bld_instru/bin/clang -x c
-o /dev/null test1.c
1.      <eof> parser at end of file
2.      test1.c:1:5: parsing function body 'a'
3.      test1.c:1:5: in compound statement ('{}')
 #0 0x000000000681faf6 llvm::sys::PrintStackTrace(llvm::raw_ostream&)
/home/rxz226/llvm-project/llvm/lib/Support/Unix/Signals.inc:560:7
 #1 0x000000000681ac5e llvm::sys::RunSignalHandlers()
/home/rxz226/llvm-project/llvm/lib/Support/Signals.cpp:69:18
 #2 0x000000000681dd30 llvm::sys::CleanupOnSignal(unsigned long)
/home/rxz226/llvm-project/llvm/lib/Support/Unix/Signals.inc:361:3
 #3 0x000000000662a5aa (anonymous
namespace)::CrashRecoveryContextImpl::HandleCrash(int, unsigned long)
/home/rxz226/llvm-project/llvm/lib/Support/CrashRecoveryContext.cpp:80:5
 #4 0x000000000662a9e6
/home/rxz226/llvm-project/llvm/lib/Support/CrashRecoveryContext.cpp:361:51
 #5 0x00007fc29911d390 __restore_rt
(/lib/x86_64-linux-gnu/libpthread.so.0+0x11390)
 #6 0x00007fc297c87428 raise
/build/glibc-LK5gWL/glibc-2.23/signal/../sysdeps/unix/sysv/linux/raise.c:54:0
 #7 0x00007fc297c8902a abort /build/glibc-LK5gWL/glibc-2.23/stdlib/abort.c:91:0
 #8 0x00007fc297c7fbd7 __assert_fail_base
/build/glibc-LK5gWL/glibc-2.23/assert/assert.c:92:0
 #9 0x00007fc297c7fc82 (/lib/x86_64-linux-gnu/libc.so.6+0x2dc82)
#10 0x0000000006fb3a35
(/home/rxz226/llvm-project/bld_instru/bin/clang+0x6fb3a35)
#11 0x000000000e63a5c2 (anonymous
namespace)::IntExprEvaluator::VisitBuiltinCallExpr(clang::CallExpr const*,
unsigned int) /home/rxz226/llvm-project/clang/lib/AST/ExprConstant.cpp:10944:48
#12 0x000000000e5f0fe2 (anonymous
namespace)::IntExprEvaluator::VisitCallExpr(clang::CallExpr const*)
/home/rxz226/llvm-project/clang/lib/AST/ExprConstant.cpp:10629:12
#13 0x000000000e5e2e03 clang::StmtVisitorBase<llvm::make_const_ptr, (anonymous
namespace)::IntExprEvaluator, bool>::Visit(clang::Stmt const*)
/home/rxz226/llvm-project/bld_instru/tools/clang/include/clang/AST/StmtNodes.inc:0:1
#14 0x000000000e55077f Evaluate(clang::APValue&, (anonymous
namespace)::EvalInfo&, clang::Expr const*) /home/rxz2
...
---

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20200203/7d179cd9/attachment-0001.html>