[llvm-bugs] [Bug 50538] New: NULL pointer dereference in FillInEmptyInitForField

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=50538

            Bug ID: 50538
           Summary: NULL pointer dereference in FillInEmptyInitForField
           Product: clang
           Version: 12.0
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: Frontend
          Assignee: unassignedclangbugs at nondot.org
          Reporter: radwanski.michal at outlook.com
                CC: llvm-bugs at lists.llvm.org, neeilans at live.com,
                    richard-llvm at metafoo.co.uk

Created attachment 24901
  --> https://bugs.llvm.org/attachment.cgi?id=24901&action=edit
Stack trace

Clang crashes when compiling. According to godbolt.org, this affects all
versions since 6.0.0. Tested on Fedora 34, with clang 12 from repositories.

POC:

template<typename Ti>
struct Wrap { Ti _; };
template<typename Ti, typename = decltype(Wrap<Ti> {0})>
using Void = void;
template<typename, typename = void>
struct variant;
template<typename Ti>
struct variant< Ti, Void<Ti> >;
struct S { int x; variant<S>& v; };
variant<S> v;

This code was hand-minimized from this one (using libstdc++):

#include <variant>
struct S;
using V = std::variant<int, S>;
struct S { int x; V& v; };
V l = 0;

After a bit of investigation, I come to conclusion, that there is a null
pointer dereference in FillInEmptyInitForField:

          InitListExpr *ILE 
/* some code */
          << ILE->getSyntacticForm()->getSourceRange();
Here, ILE->getSyntacticForm() evaluates to nullptr. I don't know enough
internals to know how to fix it.


I'm attaching the full stack trace I get. Top entries (excluding those from the
signal handler) are inline here:

 #4 0x00007f7e9edb80d6 clang::Stmt::getSourceRange() const
/usr/src/debug/clang-12.0.0-0.3.rc1.fc34.x86_64/x86_64-redhat-linux-gnu/../lib/AST/Stmt.cpp:325:3
 #5 0x00007f7e9f436737 clang::Sema::SemaDiagnosticBuilder const&
clang::Sema::SemaDiagnosticBuilder::operator<<<clang::SourceRange,
void>(clang::SourceRange&&) const
/usr/src/debug/clang-12.0.0-0.3.rc1.fc34.x86_64/x86_64-redhat-linux-gnu/../include/clang/Sema/Sema.h:1683:7
 #6 0x00007f7e9f436737 FillInEmptyInitForField
/usr/src/debug/clang-12.0.0-0.3.rc1.fc34.x86_64/x86_64-redhat-linux-gnu/../lib/Sema/SemaInit.cpp:697:54
 #7 0x00007f7e9f436d16 FillInEmptyInitializations
/usr/src/debug/clang-12.0.0-0.3.rc1.fc34.x86_64/x86_64-redhat-linux-gnu/../lib/Sema/SemaInit.cpp:820:9
 #8 0x00007f7e9f4364b6 FillInEmptyInitForField
/usr/src/debug/clang-12.0.0-0.3.rc1.fc34.x86_64/x86_64-redhat-linux-gnu/../lib/Sema/SemaInit.cpp:729:31
 #9 0x00007f7e9f436d16 FillInEmptyInitializations
/usr/src/debug/clang-12.0.0-0.3.rc1.fc34.x86_64/x86_64-redhat-linux-gnu/../lib/Sema/SemaInit.cpp:820:9
#10 0x00007f7e9f439c5d InitListChecker
/usr/src/debug/clang-12.0.0-0.3.rc1.fc34.x86_64/x86_64-redhat-linux-gnu/../lib/Sema/SemaInit.cpp:965:5
#11 0x00007f7e9f439f17 diagnoseListInit
/usr/src/debug/clang-12.0.0-0.3.rc1.fc34.x86_64/x86_64-redhat-linux-gnu/../lib/Sema/SemaInit.cpp:8912:3
#12 0x00007f7e9f43aad7 clang::InitializationSequence::Diagnose(clang::Sema&,
clang::InitializedEntity const&, clang::InitializationKind const&,
llvm::ArrayRef<clang::Expr*>)
/usr/src/debug/clang-12.0.0-0.3.rc1.fc34.x86_64/x86_64-redhat-linux-gnu/../lib/Sema/SemaInit.cpp:9361:5

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20210530/2b8663a6/attachment.html>