Assertion `(!isa<llvm::Constant>(EvaluatedGEP.TotalOffset) || EvaluatedGEP.OffsetOverflows == Builder.getFalse()) && "If the offset got constant-folded, we don't expect that there was an " "overflow."'

[vabridgers]

Bugzilla Link	48824
Version	trunk
OS	All
CC	@LebedevRI,@zygoloid

Extended Description

This was found in a downstream compiler for an out-of-tree target using randomized testing, but is reproduced on tip of tree using an in-tree target. Two simple minimized reproducers show this crash.

It appears that the indices or address calculations expressed in these samples are not properly checked for maximum representation limits for the target? That seems to be why this is only reproducible for a 16-bit target like the msp430.

clang command line

clang -c -fsanitize=undefined --target=msp430-unknown test.c

Two test cases show this ...

case 1

a;
_Complex b[][1];
c() { b[a][8920]; }

case 2

int **a[];
int main() {
(*a)[28001000];
}

Relevant backtrace (edited)

clang: /clang/lib/CodeGen/CGExprScalar.cpp:4980: llvm::Value* clang::CodeGen::CodeGenFunction::EmitCheckedInBoundsGEP(llvm::Value*, llvm::ArrayRefllvm::Value*, bool, bool, clang::SourceLocation, const llvm::Twine&): Assertion `(!isallvm::Constant(EvaluatedGEP.TotalOffset) || EvaluatedGEP.OffsetOverflows == Builder.getFalse()) && "If the offset got constant-folded, we don't expect that there was an " "overflow."' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff4ff6387 in raise () from /lib64/libc.so.6
(gdb) bt

#​4 0x0000000005b2abee in clang::CodeGen::CodeGenFunction::EmitCheckedInBoundsGEP (this=0x7fffffff6a30, Ptr=0x123f99a0, IdxList=..., SignedIndices=true, IsSubtraction=false, Loc=..., Name=...)
at /clang/lib/CodeGen/CGExprScalar.cpp:4980
#​5 0x0000000005ad7a65 in emitArraySubscriptGEP (CGF=..., ptr=0x123f99a0, indices=..., inbounds=true, signedIndices=true, loc=..., name=...) at /clang/lib/CodeGen/CGExpr.cpp:3577
#​6 0x0000000005ad7f45 in emitArraySubscriptGEP (CGF=..., addr=..., indices=..., eltType=..., inbounds=true, signedIndices=true, loc=..., arrayType=0x7fffffff5750, Base=0x123b2918, name=...)
at /clang/lib/CodeGen/CGExpr.cpp:3674
#​7 0x0000000005ad92bd in clang::CodeGen::CodeGenFunction::EmitArraySubscriptExpr (this=0x7fffffff6a30, E=0x123b2930, Accessed=true) at /clang/lib/CodeGen/CGExpr.cpp:3839
#​8 0x0000000005aca6c9 in clang::CodeGen::CodeGenFunction::EmitCheckedLValue (this=0x7fffffff6a30, E=0x123b2930, TCK=clang::CodeGen::CodeGenFunction::TCK_Load)
at /clang/lib/CodeGen/CGExpr.cpp:1252
#​9 0x0000000005b1311b in (anonymous namespace)::ScalarExprEmitter::EmitCheckedLValue (this=0x7fffffff6550, E=0x123b2930, TCK=clang::CodeGen::CodeGenFunction::TCK_Load)
at /clang/lib/CodeGen/CGExprScalar.cpp:245
#​10 0x0000000005b133c6 in (anonymous namespace)::ScalarExprEmitter::EmitLoadOfLValue (this=0x7fffffff6550, E=0x123b2930) at /clang/lib/CodeGen/CGExprScalar.cpp:294
#​11 0x0000000005b199bd in (anonymous namespace)::ScalarExprEmitter::VisitArraySubscriptExpr (this=0x7fffffff6550, E=0x123b2930) at /clang/lib/CodeGen/CGExprScalar.cpp:1705
#​12 0x0000000005b2c02a in clang::StmtVisitorBase<std::add_pointer, (anonymous namespace)::ScalarExprEmitter, llvm::Value*>::Visit (this=0x7fffffff6550, S=0x123b2930) at tools/clang/include/clang/AST/StmtNodes.inc:635
#​13 0x0000000005b136c2 in (anonymous namespace)::ScalarExprEmitter::Visit (this=0x7fffffff6550, E=0x123b2930) at /clang/lib/CodeGen/CGExprScalar.cpp:409
#​14 0x0000000005b1bd41 in (anonymous namespace)::ScalarExprEmitter::VisitCastExpr (this=0x7fffffff6550, CE=0x123b2950) at /clang/lib/CodeGen/CGExprScalar.cpp:2191
#​15 0x0000000005b2ddc3 in clang::StmtVisitorBase<std::add_pointer, (anonymous namespace)::ScalarExprEmitter, llvm::Value*>::VisitImplicitCastExpr (this=0x7fffffff6550, S=0x123b2950)
at tools/clang/include/clang/AST/StmtNodes.inc:919

[Endilll]

Both test cases are still crashing as of post-17 trunk:
https://godbolt.org/z/54PdWjxhs
https://godbolt.org/z/xsWzGs8z7
Crash of the first test case (the second one looks very similar, not posting here):

<source>:2:1: warning: plain '_Complex' requires a type specifier; assuming '_Complex double'
    2 | _Complex b[][1];
      | ^
      |          double
<source>:3:16: warning: expression result unused [-Wunused-value]
    3 | c() { b[a][8920]; }
      |       ~~~~ ~~~~^
<source>:3:7: warning: array index 8920 is past the end of the array (that has type '_Complex double[1]') [-Warray-bounds]
    3 | c() { b[a][8920]; }
      |       ^    ~~~~
<source>:2:1: note: array 'b' declared here
    2 | _Complex b[][1];
      | ^
<source>:3:19: warning: non-void function does not return a value [-Wreturn-type]
    3 | c() { b[a][8920]; }
      |                   ^

clang++: /root/llvm-project/clang/lib/CodeGen/CGExprScalar.cpp:5346:
llvm::Value* clang::CodeGen::CodeGenFunction::EmitCheckedInBoundsGEP(llvm::Type*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, bool, bool, clang::SourceLocation, const llvm::Twine&):
Assertion `(!isa<llvm::Constant>(EvaluatedGEP.TotalOffset) || EvaluatedGEP.OffsetOverflows == Builder.getFalse()) && "If the offset got constant-folded, we don't expect that there was an " "overflow."' failed.

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -gdwarf-4 -g -o /app/output.s -mllvm --x86-asm-syntax=intel -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics -x c -Wno-implicit-int -Wno-implicit-function-declaration -fsanitize=undefined --target=msp430-unknown <source>
1.	<eof> parser at end of file
2.	<source>:3:1: LLVM IR generation of declaration 'c'
3.	<source>:3:1: Generating code for declaration 'c'
 #0 0x00000000036afc28 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x36afc28)
 #1 0x00000000036ad8ec llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x36ad8ec)
 #2 0x00000000035f6d08 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007fece5f2e420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #4 0x00007fece59f100b raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300b)
 #5 0x00007fece59d0859 abort (/lib/x86_64-linux-gnu/libc.so.6+0x22859)
 #6 0x00007fece59d0729 (/lib/x86_64-linux-gnu/libc.so.6+0x22729)
 #7 0x00007fece59e1fd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
 #8 0x0000000003dfcf67 clang::CodeGen::CodeGenFunction::EmitCheckedInBoundsGEP(llvm::Type*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, bool, bool, clang::SourceLocation, llvm::Twine const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3dfcf67)
 #9 0x0000000003da861c emitArraySubscriptGEP(clang::CodeGen::CodeGenFunction&, clang::CodeGen::Address, llvm::ArrayRef<llvm::Value*>, clang::QualType, bool, bool, clang::SourceLocation, clang::QualType*, clang::Expr const*, llvm::Twine const&) CGExpr.cpp:0:0
#10 0x0000000003dbd1c1 clang::CodeGen::CodeGenFunction::EmitArraySubscriptExpr(clang::ArraySubscriptExpr const*, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3dbd1c1)
#11 0x0000000003db450f clang::CodeGen::CodeGenFunction::EmitLValueHelper(clang::Expr const*, clang::CodeGen::KnownNonNull_t) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3db450f)
#12 0x0000000003db4bc1 clang::CodeGen::CodeGenFunction::EmitLValue(clang::Expr const*, clang::CodeGen::KnownNonNull_t) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3db4bc1)
#13 0x0000000003de6bfb (anonymous namespace)::ComplexExprEmitter::EmitLoadOfLValue(clang::Expr const*) CGExprComplex.cpp:0:0
#14 0x0000000003de8ed9 (anonymous namespace)::ComplexExprEmitter::Visit(clang::Expr*) CGExprComplex.cpp:0:0
#15 0x0000000003deab90 (anonymous namespace)::ComplexExprEmitter::EmitCast(clang::CastKind, clang::Expr*, clang::QualType) CGExprComplex.cpp:0:0
#16 0x0000000003de8a6d (anonymous namespace)::ComplexExprEmitter::Visit(clang::Expr*) CGExprComplex.cpp:0:0
#17 0x0000000003deb4e3 clang::CodeGen::CodeGenFunction::EmitComplexExpr(clang::Expr const*, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3deb4e3)
#18 0x0000000003d9f0e0 clang::CodeGen::CodeGenFunction::EmitAnyExpr(clang::Expr const*, clang::CodeGen::AggValueSlot, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3d9f0e0)
#19 0x0000000003dc022b clang::CodeGen::CodeGenFunction::EmitIgnoredExpr(clang::Expr const*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3dc022b)
#20 0x00000000039caca2 clang::CodeGen::CodeGenFunction::EmitStmt(clang::Stmt const*, llvm::ArrayRef<clang::Attr const*>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x39caca2)
#21 0x00000000039d113c clang::CodeGen::CodeGenFunction::EmitCompoundStmtWithoutScope(clang::CompoundStmt const&, bool, clang::CodeGen::AggValueSlot) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x39d113c)
#22 0x0000000003a2eab6 clang::CodeGen::CodeGenFunction::EmitFunctionBody(clang::Stmt const*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3a2eab6)
#23 0x0000000003a41c5a clang::CodeGen::CodeGenFunction::GenerateCode(clang::GlobalDecl, llvm::Function*, clang::CodeGen::CGFunctionInfo const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3a41c5a)
#24 0x0000000003aa2fe3 clang::CodeGen::CodeGenModule::EmitGlobalFunctionDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3aa2fe3)
#25 0x0000000003a9e0d5 clang::CodeGen::CodeGenModule::EmitGlobalDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3a9e0d5)
#26 0x0000000003a9e69b clang::CodeGen::CodeGenModule::EmitGlobal(clang::GlobalDecl) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3a9e69b)
#27 0x0000000003aa7b13 clang::CodeGen::CodeGenModule::EmitTopLevelDecl(clang::Decl*) (.part.0) CodeGenModule.cpp:0:0
#28 0x00000000049126c6 (anonymous namespace)::CodeGeneratorImpl::HandleTopLevelDecl(clang::DeclGroupRef) ModuleBuilder.cpp:0:0
#29 0x00000000049032d8 clang::BackendConsumer::HandleTopLevelDecl(clang::DeclGroupRef) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x49032d8)
#30 0x0000000005e04a04 clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x5e04a04)
#31 0x000000000490f578 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x490f578)
#32 0x0000000004177f89 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4177f89)
#33 0x00000000040f818e clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x40f818e)
#34 0x00000000042561fe clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x42561fe)
#35 0x0000000000bd6ea0 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xbd6ea0)
#36 0x0000000000bcf0ca ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#37 0x0000000003f59309 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#38 0x00000000035f71b4 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x35f71b4)
#39 0x0000000003f598ff clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#40 0x0000000003f21c85 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3f21c85)
#41 0x0000000003f226ed clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3f226ed)
#42 0x0000000003f2a615 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3f2a615)
#43 0x0000000000bd4cac clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xbd4cac)
#44 0x0000000000ad14a1 main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xad14a1)
#45 0x00007fece59d2083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#46 0x0000000000bcebae _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xbcebae)
clang++: error: clang frontend command failed with exit code 134 (use -v to see invocation)

[llvmbot]

@llvm/issue-subscribers-backend-msp430

[llvmbot]

@llvm/issue-subscribers-clang-codegen