[llvm-bugs] [Bug 46177] New: webkit NoUncountedMemberChecker crashes on very simple C code

via llvm-bugs llvm-bugs at lists.llvm.org
Tue Jun 2 14:40:22 PDT 2020 

https://bugs.llvm.org/show_bug.cgi?id=46177

            Bug ID: 46177
           Summary: webkit NoUncountedMemberChecker crashes on very simple
                    C code
           Product: clang
           Version: unspecified
          Hardware: PC
                OS: Windows NT
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: Static Analyzer
          Assignee: dcoughlin at apple.com
          Reporter: chris.hamilton at ericsson.com
                CC: dcoughlin at apple.com, llvm-bugs at lists.llvm.org

Created attachment 23566
  --> https://bugs.llvm.org/attachment.cgi?id=23566&action=edit
Reduced reproducer.

webkit.WebKitNoUncountedMemberChecker crashes when presented with a very simple
bit of C code.  Example:


ch[16:24][repo/ch/llvm]$ cat reduced.c
struct {};
ch[16:24][repo/ch/llvm]$ /repo/ch/llvm/llvm/build-all-Debug/bin/clang-tidy
-checks='-*,clang-analyzer-webkit.WebKitNoUncountedMemberChecker' reduced.c
Error while trying to load a compilation database:
Could not auto-detect compilation database for file "reduced.c"
No compilation database found in /repo/ch/llvm or any parent directory
fixed-compilation-database: Error while opening fixed database: No such file or
directory
json-compilation-database: Error while opening JSON database: No such file or
directory
Running without flags.
clang-tidy:
/repo/ch/llvm/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp:147:
bool clang::isRefCounted(const clang::CXXRecordDecl *): Assertion `R' failed.
PLEASE submit a bug report to
https://developer.internal.ericsson.com/docs/bbi/languages/support/ and include
the crash backtrace.
Stack dump:
0.  Program arguments: /repo/ch/llvm/llvm/build-all-Debug/bin/clang-tidy
-checks=-*,clang-analyzer-webkit.WebKitNoUncountedMemberChecker reduced.c 
1.  <eof> parser at end of file
 #0 0x0000000004e3745c llvm::sys::PrintStackTrace(llvm::raw_ostream&)
/repo/ch/llvm/llvm/build-all-Debug/../lib/Support/Unix/Signals.inc:564:11
 #1 0x0000000004e37959 PrintStackTraceSignalHandler(void*)
/repo/ch/llvm/llvm/build-all-Debug/../lib/Support/Unix/Signals.inc:625:1
 #2 0x0000000004e35d96 llvm::sys::RunSignalHandlers()
/repo/ch/llvm/llvm/build-all-Debug/../lib/Support/Signals.cpp:67:5
 #3 0x0000000004e380cb SignalHandler(int)
/repo/ch/llvm/llvm/build-all-Debug/../lib/Support/Unix/Signals.inc:406:1
 #4 0x00007f801f690630 __restore_rt (/lib64/libpthread.so.0+0xf630)
 #5 0x00007f801e79b377 raise (/lib64/libc.so.6+0x36377)
 #6 0x00007f801e79ca68 abort (/lib64/libc.so.6+0x37a68)
 #7 0x00007f801e794196 __assert_fail_base (/lib64/libc.so.6+0x2f196)
 #8 0x00007f801e794242 (/lib64/libc.so.6+0x2f242)
 #9 0x0000000001e968bb clang::isRefCounted(clang::CXXRecordDecl const*)
/repo/ch/llvm/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp:148:21
#10 0x0000000001e92ce0 (anonymous
namespace)::NoUncountedMemberChecker::shouldSkipDecl(clang::RecordDecl const*)
const
/repo/ch/llvm/clang/lib/StaticAnalyzer/Checkers/WebKit/NoUncountedMembersChecker.cpp:117:5
#11 0x0000000001e92abf (anonymous
namespace)::NoUncountedMemberChecker::visitRecordDecl(clang::RecordDecl const*)
const
/repo/ch/llvm/clang/lib/StaticAnalyzer/Checkers/WebKit/NoUncountedMembersChecker.cpp:75:9
#12 0x0000000001e92a80 (anonymous
namespace)::NoUncountedMemberChecker::checkASTDecl(clang::TranslationUnitDecl
const*, clang::ento::AnalysisManager&, clang::ento::BugReporter&)
const::LocalVisitor::VisitRecordDecl(clang::RecordDecl const*)
/repo/ch/llvm/clang/lib/StaticAnalyzer/Checkers/WebKit/NoUncountedMembersChecker.cpp:66:9
#13 0x0000000001e92985 clang::RecursiveASTVisitor<(anonymous
namespace)::NoUncountedMemberChecker::checkASTDecl(clang::TranslationUnitDecl
const*, clang::ento::AnalysisManager&, clang::ento::BugReporter&)
const::LocalVisitor>::WalkUpFromRecordDecl(clang::RecordDecl*)
/repo/ch/llvm/llvm/build-all-Debug/tools/clang/include/clang/AST/DeclNodes.inc:259:1
#14 0x0000000001e29572 clang::RecursiveASTVisitor<(anonymous
namespace)::NoUncountedMemberChecker::checkASTDecl(clang::TranslationUnitDecl
const*, clang::ento::AnalysisManager&, clang::ento::BugReporter&)
const::LocalVisitor>::TraverseRecordDecl(clang::RecordDecl*)
/repo/ch/llvm/clang/include/clang/AST/RecursiveASTVisitor.h:1928:1
#15 0x0000000001e23d6f clang::RecursiveASTVisitor<(anonymous
namespace)::NoUncountedMemberChecker::checkASTDecl(clang::TranslationUnitDecl
const*, clang::ento::AnalysisManager&, clang::ento::BugReporter&)
const::LocalVisitor>::TraverseDecl(clang::Decl*)
/repo/ch/llvm/llvm/build-all-Debug/tools/clang/include/clang/AST/DeclNodes.inc:259:1
#16 0x0000000001e304a8 clang::RecursiveASTVisitor<(anonymous
namespace)::NoUncountedMemberChecker::checkASTDecl(clang::TranslationUnitDecl
const*, clang::ento::AnalysisManager&, clang::ento::BugReporter&)
const::LocalVisitor>::TraverseDeclContextHelper(clang::DeclContext*)
/repo/ch/llvm/clang/include/clang/AST/RecursiveASTVisitor.h:1449:7
#17 0x0000000001e301f8 clang::RecursiveASTVisitor<(anonymous
namespace)::NoUncountedMemberChecker::checkASTDecl(clang::TranslationUnitDecl
const*, clang::ento::AnalysisManager&, clang::ento::BugReporter&)
const::LocalVisitor>::TraverseTranslationUnitDecl(clang::TranslationUnitDecl*)
/repo/ch/llvm/clang/include/clang/AST/RecursiveASTVisitor.h:1550:1
#18 0x0000000001e247e6 clang::RecursiveASTVisitor<(anonymous
namespace)::NoUncountedMemberChecker::checkASTDecl(clang::TranslationUnitDecl
const*, clang::ento::AnalysisManager&, clang::ento::BugReporter&)
const::LocalVisitor>::TraverseDecl(clang::Decl*)
/repo/ch/llvm/llvm/build-all-Debug/tools/clang/include/clang/AST/DeclNodes.inc:595:1
#19 0x0000000001e23557 (anonymous
namespace)::NoUncountedMemberChecker::checkASTDecl(clang::TranslationUnitDecl
const*, clang::ento::AnalysisManager&, clang::ento::BugReporter&) const
/repo/ch/llvm/clang/lib/StaticAnalyzer/Checkers/WebKit/NoUncountedMembersChecker.cpp:72:3
#20 0x0000000001e233ed void
clang::ento::check::ASTDecl<clang::TranslationUnitDecl>::_checkDecl<(anonymous
namespace)::NoUncountedMemberChecker>(void*, clang::Decl const*,
clang::ento::AnalysisManager&, clang::ento::BugReporter&)
/repo/ch/llvm/clang/include/clang/StaticAnalyzer/Core/Checker.h:34:3
#21 0x0000000001f8734a clang::ento::CheckerFn<void (clang::Decl const*,
clang::ento::AnalysisManager&,
clang::ento::BugReporter&)>::operator()(clang::Decl const*,
clang::ento::AnalysisManager&, clang::ento::BugReporter&) const
/repo/ch/llvm/clang/include/clang/StaticAnalyzer/Core/CheckerManager.h:71:5
#22 0x0000000001f815ef
clang::ento::CheckerManager::runCheckersOnASTDecl(clang::Decl const*,
clang::ento::AnalysisManager&, clang::ento::BugReporter&)
/repo/ch/llvm/clang/lib/StaticAnalyzer/Core/CheckerManager.cpp:94:28
#23 0x000000000175bb7d (anonymous
namespace)::AnalysisConsumer::runAnalysisOnTranslationUnit(clang::ASTContext&)
/repo/ch/llvm/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:490:15
#24 0x000000000175b7a2 (anonymous
namespace)::AnalysisConsumer::HandleTranslationUnit(clang::ASTContext&)
/repo/ch/llvm/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:0:5
#25 0x000000000226f73b
clang::MultiplexConsumer::HandleTranslationUnit(clang::ASTContext&)
/repo/ch/llvm/clang/lib/Frontend/MultiplexConsumer.cpp:291:23
#26 0x000000000250173c clang::ParseAST(clang::Sema&, bool, bool)
/repo/ch/llvm/clang/lib/Parse/ParseAST.cpp:178:12
#27 0x0000000002232682 clang::ASTFrontendAction::ExecuteAction()
/repo/ch/llvm/clang/lib/Frontend/FrontendAction.cpp:1063:1
#28 0x0000000002232031 clang::FrontendAction::Execute()
/repo/ch/llvm/clang/lib/Frontend/FrontendAction.cpp:958:7
#29 0x00000000021c2760
clang::CompilerInstance::ExecuteAction(clang::FrontendAction&)
/repo/ch/llvm/clang/lib/Frontend/CompilerInstance.cpp:973:23
#30 0x000000000173ea1a
clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr<clang::CompilerInvocation>,
clang::FileManager*, std::shared_ptr<clang::PCHContainerOperations>,
clang::DiagnosticConsumer*) /repo/ch/llvm/clang/lib/Tooling/Tooling.cpp:397:14
#31 0x00000000016cb63e
clang::tidy::runClangTidy(clang::tidy::ClangTidyContext&,
clang::tooling::CompilationDatabase const&,
llvm::ArrayRef<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > >,
llvm::IntrusiveRefCntPtr<llvm::vfs::OverlayFileSystem>, bool, bool,
llvm::StringRef)::ActionFactory::runInvocation(std::shared_ptr<clang::CompilerInvocation>,
clang::FileManager*, std::shared_ptr<clang::PCHContainerOperations>,
clang::DiagnosticConsumer*)
/repo/ch/llvm/clang-tools-extra/clang-tidy/ClangTidy.cpp:552:7
#32 0x000000000173e8b8 clang::tooling::ToolInvocation::runInvocation(char
const*, clang::driver::Compilation*,
std::shared_ptr<clang::CompilerInvocation>,
std::shared_ptr<clang::PCHContainerOperations>)
/repo/ch/llvm/clang/lib/Tooling/Tooling.cpp:372:3
#33 0x000000000173d81e clang::tooling::ToolInvocation::run()
/repo/ch/llvm/clang/lib/Tooling/Tooling.cpp:357:3
#34 0x000000000173fcf0
clang::tooling::ClangTool::run(clang::tooling::ToolAction*)
/repo/ch/llvm/clang/lib/Tooling/Tooling.cpp:550:11
#35 0x00000000016c94fd
clang::tidy::runClangTidy(clang::tidy::ClangTidyContext&,
clang::tooling::CompilationDatabase const&,
llvm::ArrayRef<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > >,
llvm::IntrusiveRefCntPtr<llvm::vfs::OverlayFileSystem>, bool, bool,
llvm::StringRef) /repo/ch/llvm/clang-tools-extra/clang-tidy/ClangTidy.cpp:573:8
#36 0x0000000000430caf clang::tidy::clangTidyMain(int, char const**)
/repo/ch/llvm/clang-tools-extra/clang-tidy/tool/ClangTidyMain.cpp:455:7
#37 0x000000000042feb2 main
/repo/ch/llvm/clang-tools-extra/clang-tidy/tool/ClangTidyToolMain.cpp:20:3
#38 0x00007f801e787545 __libc_start_main (/lib64/libc.so.6+0x22545)
#39 0x000000000042fdb4 _start
(/repo/ch/llvm/llvm/build-all-Debug/bin/clang-tidy+0x42fdb4)
Aborted


It may not make much sense to run this checker on plain C code, since use of
the reference-counting template types this checker looks for is simply not
possible; however, the checker should not crash when run on C.  

Crash behavior appears to be a regression introduced by 660cda572d6e. 
(https://reviews.llvm.org/D77178)

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20200602/80437c48/attachment.html>

More information about the llvm-bugs mailing list