[clang-tidy] `altera-id-dependent-backward-branch` crash

[hakjo666]

System Info

Program: clang-tidy
Version: 13.0.1 and 14.0.0
Platform: Red Hat Enterprise Linux release 8.6 (Ootpa)

Description

We run clang-tidy as part a sonar job in a Jenkins server.
This job randomly fails because clang-tidy crashes. This has been the case since quite a while back.

Recently we upgraded from clang 11 (unknown patch version) to 13.0.1
Before the crash was quite rare and not reproducible. Which files it crashed on is random.
Now it crashed every time on some files.
I will dig into that code and see if I can create a minimal test case for you.

Stacktrace

PLEASE submit a bug report to https://bugs.llvm.org/ and include the crash backtrace.
Stack dump:
0.	Program arguments: clang-tidy --use-color -p=<*snip*>
1.	<eof> parser at end of file
 #0 0x00007fe74c02ef00 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/lib64/libLLVM-13.so+0xae3f00)
 #1 0x00007fe74c02cae4 llvm::sys::RunSignalHandlers() (/lib64/libLLVM-13.so+0xae1ae4)
 #2 0x00007fe74c02d615 (/lib64/libLLVM-13.so+0xae2615)
 #3 0x00007fe754a77ce0 __restore_rt (/lib64/libpthread.so.0+0x12ce0)
 #4 0x000055ca1ab5a1d3 (/usr/bin/clang-tidy+0x1191d3)
 #5 0x000055ca1ab5a0f5 (/usr/bin/clang-tidy+0x1190f5)
 #6 0x000055ca1ab5a278 (/usr/bin/clang-tidy+0x119278)
 #7 0x000055ca1ab5a0f5 (/usr/bin/clang-tidy+0x1190f5)
 #8 0x000055ca1ab5a278 (/usr/bin/clang-tidy+0x119278)
 #9 0x000055ca1ab5a0f5 (/usr/bin/clang-tidy+0x1190f5)
#10 0x000055ca1ab5a278 (/usr/bin/clang-tidy+0x119278)
#11 0x000055ca1ab5a0f5 (/usr/bin/clang-tidy+0x1190f5)
#12 0x000055ca1ab5faf1 (/usr/bin/clang-tidy+0x11eaf1)
#13 0x00007fe7520737f9 (/lib64/libclang-cpp.so.13+0x12057f9)
#14 0x00007fe7520b38cc clang::ast_matchers::internal::BoundNodesTreeBuilder::visitMatches(clang::ast_matchers::internal::BoundNodesTreeBuilder::Visitor*) (/lib64/libclang-cpp.so.13+0x12458cc)
#15 0x00007fe7520762b0 (/lib64/libclang-cpp.so.13+0x12082b0)
#16 0x00007fe75209a30c (/lib64/libclang-cpp.so.13+0x122c30c)
#17 0x00007fe7520ab9de (/lib64/libclang-cpp.so.13+0x123d9de)
#18 0x00007fe7520993e5 (/lib64/libclang-cpp.so.13+0x122b3e5)
#19 0x00007fe75209a9c0 (/lib64/libclang-cpp.so.13+0x122c9c0)
#20 0x00007fe7520af262 (/lib64/libclang-cpp.so.13+0x1241262)
#21 0x00007fe752096086 (/lib64/libclang-cpp.so.13+0x1228086)
#22 0x00007fe752096fbd (/lib64/libclang-cpp.so.13+0x1228fbd)
#23 0x00007fe7520adc7c (/lib64/libclang-cpp.so.13+0x123fc7c)
#24 0x00007fe752096fbd (/lib64/libclang-cpp.so.13+0x1228fbd)
#25 0x00007fe752097a31 (/lib64/libclang-cpp.so.13+0x1229a31)
#26 0x00007fe7520964cd (/lib64/libclang-cpp.so.13+0x12284cd)
#27 0x00007fe752096fbd (/lib64/libclang-cpp.so.13+0x1228fbd)
#28 0x00007fe752097a31 (/lib64/libclang-cpp.so.13+0x1229a31)
#29 0x00007fe7520964cd (/lib64/libclang-cpp.so.13+0x12284cd)
#30 0x00007fe752096fbd (/lib64/libclang-cpp.so.13+0x1228fbd)
#31 0x00007fe752097a31 (/lib64/libclang-cpp.so.13+0x1229a31)
#32 0x00007fe7520ae59c (/lib64/libclang-cpp.so.13+0x124059c)
#33 0x00007fe752096fbd (/lib64/libclang-cpp.so.13+0x1228fbd)
#34 0x00007fe752097243 clang::ast_matchers::MatchFinder::matchAST(clang::ASTContext&) (/lib64/libclang-cpp.so.13+0x1229243)
#35 0x00007fe753404270 clang::MultiplexConsumer::HandleTranslationUnit(clang::ASTContext&) (/lib64/libclang-cpp.so.13+0x2596270)
#36 0x00007fe751a893a9 clang::ParseAST(clang::Sema&, bool, bool) (/lib64/libclang-cpp.so.13+0xc1b3a9)
#37 0x00007fe7533d1841 clang::FrontendAction::Execute() (/lib64/libclang-cpp.so.13+0x2563841)
#38 0x00007fe75336d2ab clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/lib64/libclang-cpp.so.13+0x24ff2ab)
#39 0x00007fe7535ef880 clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr<clang::CompilerInvocation>, clang::FileManager*, std::shared_ptr<clang::PCHContainerOperations>, clang::DiagnosticConsumer*) (/lib64/libclang-cpp.so.13+0x2781880)
#40 0x000055ca1b01d3b2 (/usr/bin/clang-tidy+0x5dc3b2)
#41 0x00007fe7535e86a6 clang::tooling::ToolInvocation::runInvocation(char const*, clang::driver::Compilation*, std::shared_ptr<clang::CompilerInvocation>, std::shared_ptr<clang::PCHContainerOperations>) (/lib64/libclang-cpp.so.13+0x277a6a6)
#42 0x00007fe7535eb158 clang::tooling::ToolInvocation::run() (/lib64/libclang-cpp.so.13+0x277d158)
#43 0x00007fe7535ee05c clang::tooling::ClangTool::run(clang::tooling::ToolAction*) (/lib64/libclang-cpp.so.13+0x278005c)
#44 0x000055ca1b01e7fa (/usr/bin/clang-tidy+0x5dd7fa)
#45 0x000055ca1aaf931b (/usr/bin/clang-tidy+0xb831b)
#46 0x00007fe74a891ca3 __libc_start_main (/lib64/libc.so.6+0x3aca3)
#47 0x000055ca1aaeff4e (/usr/bin/clang-tidy+0xaef4e)
<*snip*>: terminated by signal 11

[llvmbot]

@llvm/issue-subscribers-clang-tidy

[whisperity]

What checks have you enabled? (Sadly only the important bits are missing from the stack trace...) Could there be llvmlibc- or something in the check list?

[hakjo666]

I have managed a minimal use case now, at least when it comes to the code.
I know nothing about the code itself as it comes from a third party library.
I have removed as much as I can from the code to minimize the problem space.

File: .clang-tidy

---
Checks: >
   *,
   -abseil-*,
   -android-*,
   -cppcoreguidelines-avoid-magic-numbers,
   -cppcoreguidelines-owning-memory,
   -cppcoreguidelines-pro-bounds-array-to-pointer-decay,
   -cppcoreguidelines-pro-bounds-constant-array-index,
   -cppcoreguidelines-pro-bounds-pointer-arithmetic,
   -fuchsia-*,
   -google-*,
   -hicpp-*,
   -llvm*,
   -modernize-use-nodiscard,
   -modernize-use-trailing-return-type,
   -readability-magic-numbers,
   -zircon-*,

HeaderFilterRegex: 'src'
FormatStyle:        none

File: source.cc

#include <cstddef>

using glyph_scanner_func = std::size_t(char const buffer[], std::size_t buffer_len, std::size_t start);

template<char... STOP>
inline std::size_t scan_unquoted_string(char const input[], std::size_t size, std::size_t pos, glyph_scanner_func *scan)
{
  while (((input[pos] != STOP) and ...)))
  {}

  return pos;
}

[hakjo666]

I asked clang-tidy for a list of all checks it had and replaced my config with that.
I then halved the number of checks until only one check remained, while still getting the crash.

Problematic check: altera-id-dependent-backward-branch

[njames93]

Can you reproduce this on the latest release or more preferably on trunk?

[hakjo666]

Trunk failed to build for me.

/usr/include/c++/11/bits/stl_vector.h:1123: std::vector<_Tp, _Alloc>::reference std::vector<_Tp, _Alloc>::front() [with _Tp = cmGccStyleDependency; _Alloc = std::allocator<cmGccStyleDependency>; std::vector<_Tp, _Alloc>::reference = cmGccStyleDependency&]: Assertion '!this->empty()' failed.

I will try with the latest official release instead.

[hakjo666]

The crash happens with clang-tidy version 14.0.0 as well.

[EugeneZelenko]

Could you please provide crash information for 14 or main? It should be mire detailed than in 13.

[hakjo666]

Stack trace for version 14:

Stack dump:
0.	Program arguments: /home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy --use-color -p=build -quiet src/source.cc
1.	<eof> parser at end of file
 #0 0x00000000033fbe33 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x33fbe33)
 #1 0x00000000033f9d8e llvm::sys::RunSignalHandlers() (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x33f9d8e)
 #2 0x00000000033fc2cf SignalHandler(int) Signals.cpp:0:0
 #3 0x00007fe9bd6bae30 __restore_rt (/lib64/libc.so.6+0x55e30)
 #4 0x00000000009ab220 clang::tidy::altera::IdDependentBackwardBranchCheck::hasIdDepVar(clang::Expr const*) (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x9ab220)
 #5 0x00000000009ac7c6 clang::tidy::altera::IdDependentBackwardBranchCheck::check(clang::ast_matchers::MatchFinder::MatchResult const&) (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x9ac7c6)
 #6 0x000000000270ad27 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::MatchVisitor::visitMatch(clang::ast_matchers::BoundNodes const&) ASTMatchFinder.cpp:0:0
 #7 0x000000000273567c clang::ast_matchers::internal::BoundNodesTreeBuilder::visitMatches(clang::ast_matchers::internal::BoundNodesTreeBuilder::Visitor*) (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x273567c)
 #8 0x000000000270a780 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::matchWithFilter(clang::DynTypedNode const&) ASTMatchFinder.cpp:0:0
 #9 0x0000000002717245 clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseCompoundStmt(clang::CompoundStmt*, llvm::SmallVectorImpl<llvm::PointerIntPair<clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits<clang::Stmt*>, llvm::PointerIntPairInfo<clang::Stmt*, 1u, llvm::PointerLikeTypeTraits<clang::Stmt*> > > >*) ASTMatchFinder.cpp:0:0
#10 0x0000000002715981 clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl<llvm::PointerIntPair<clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits<clang::Stmt*>, llvm::PointerIntPairInfo<clang::Stmt*, 1u, llvm::PointerLikeTypeTraits<clang::Stmt*> > > >*) ASTMatchFinder.cpp:0:0
#11 0x0000000002735087 clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseFunctionHelper(clang::FunctionDecl*) ASTMatchFinder.cpp:0:0
#12 0x0000000002711bb2 clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseFunctionDecl(clang::FunctionDecl*) ASTMatchFinder.cpp:0:0
#13 0x000000000270caac clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::TraverseDecl(clang::Decl*) ASTMatchFinder.cpp:0:0
#14 0x000000000270f591 clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseFunctionTemplateDecl(clang::FunctionTemplateDecl*) ASTMatchFinder.cpp:0:0
#15 0x000000000270c884 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::TraverseDecl(clang::Decl*) ASTMatchFinder.cpp:0:0
#16 0x00000000027140db clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseTranslationUnitDecl(clang::TranslationUnitDecl*) ASTMatchFinder.cpp:0:0
#17 0x000000000270cd6a clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::TraverseDecl(clang::Decl*) ASTMatchFinder.cpp:0:0
#18 0x00000000026e2af7 clang::ast_matchers::MatchFinder::matchAST(clang::ASTContext&) (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x26e2af7)
#19 0x0000000001adfb1c clang::MultiplexConsumer::HandleTranslationUnit(clang::ASTContext&) (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x1adfb1c)
#20 0x0000000001cd1304 clang::ParseAST(clang::Sema&, bool, bool) (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x1cd1304)
#21 0x0000000001aa7ad9 clang::FrontendAction::Execute() (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x1aa7ad9)
#22 0x0000000001a22c36 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x1a22c36)
#23 0x00000000015156ed clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr<clang::CompilerInvocation>, clang::FileManager*, std::shared_ptr<clang::PCHContainerOperations>, clang::DiagnosticConsumer*) (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x15156ed)
#24 0x00000000014e12c6 clang::tidy::runClangTidy(clang::tidy::ClangTidyContext&, clang::tooling::CompilationDatabase const&, llvm::ArrayRef<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, llvm::IntrusiveRefCntPtr<llvm::vfs::OverlayFileSystem>, bool, bool, llvm::StringRef)::ActionFactory::runInvocation(std::shared_ptr<clang::CompilerInvocation>, clang::FileManager*, std::shared_ptr<clang::PCHContainerOperations>, clang::DiagnosticConsumer*) ClangTidy.cpp:0:0
#25 0x000000000151544a clang::tooling::ToolInvocation::runInvocation(char const*, clang::driver::Compilation*, std::shared_ptr<clang::CompilerInvocation>, std::shared_ptr<clang::PCHContainerOperations>) (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x151544a)
#26 0x00000000015143e4 clang::tooling::ToolInvocation::run() (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x15143e4)
#27 0x0000000001516e5b clang::tooling::ClangTool::run(clang::tooling::ToolAction*) (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x1516e5b)
#28 0x00000000014dceaf clang::tidy::runClangTidy(clang::tidy::ClangTidyContext&, clang::tooling::CompilationDatabase const&, llvm::ArrayRef<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, llvm::IntrusiveRefCntPtr<llvm::vfs::OverlayFileSystem>, bool, bool, llvm::StringRef) (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x14dceaf)
#29 0x000000000095a5c7 clang::tidy::clangTidyMain(int, char const**) (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x95a5c7)
#30 0x00007fe9bd6a5f20 __libc_start_call_main (/lib64/libc.so.6+0x40f20)
#31 0x00007fe9bd6a5fd0 __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x40fd0)
#32 0x000000000095667a _start (/home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy+0x95667a)
./run.sh: line 3: 22071 Segmentation fault      (core dumped) /home/user/Downloads/clang+llvm-14.0.0-x86_64-linux-gnu-ubuntu-18.04/bin/clang-tidy --use-color -p=build -quiet src/source.cc

[Izaron]

File: source.cc

#include <cstddef>

using glyph_scanner_func = std::size_t(char const buffer[], std::size_t buffer_len, std::size_t start);

template<char... STOP>
inline std::size_t scan_unquoted_string(char const input[], std::size_t size, std::size_t pos, glyph_scanner_func *scan)
{
  while (((input[pos] != STOP) and ...)))
  {}

  return pos;
}

Hi @hakjo666! What flags do you use for compiling this file? I'm getting an error with clang++ -std=c++20 -c a.cpp

a.cpp:8:41: error: extraneous ')' after condition, expected a statement
  while (((input[pos] != STOP) and ...)))
                                        ^
1 error generated.

So I suppose there are some flags that make this compile, because one can't run clang-tidy over non-compilable code and expect to get something good =)