This is an archive of the discontinued LLVM Phabricator instance.

[clang][Sema] Fix a clang crash with btf_type_tag

Authored by yonghong-song on Oct 26 2022, 5:57 PM.



For the following program,

$ cat t.c 
struct t { 
 int (__attribute__((btf_type_tag("rcu"))) *f)();
 int a;
int foo(struct t *arg) {
  return arg->a;

Compiling with 'clang -g -O2 -S t.c' will cause a failure like below:

clang: /home/yhs/work/llvm-project/clang/lib/Sema/SemaType.cpp:6391: void {anonymous}::DeclaratorLocFiller::VisitParenTypeLoc(clang::ParenTypeLoc):
       Assertion `Chunk.Kind == DeclaratorChunk::Paren' failed.
PLEASE submit a bug report to and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
#5 0x00007f89e4280ea5 abort (/lib64/
#6 0x00007f89e4280d79 _nl_load_domain.cold.0 (/lib64/
#7 0x00007f89e42a6456 (/lib64/
#8 0x00000000045c2596 GetTypeSourceInfoForDeclarator((anonymous namespace)::TypeProcessingState&, clang::QualType, clang::TypeSourceInfo*) SemaType.cpp:0:0
#9 0x00000000045ccfa5 GetFullTypeForDeclarator((anonymous namespace)::TypeProcessingState&, clang::QualType, clang::TypeSourceInfo*) SemaType.cpp:0:0

The reason of the failure is due to the mismatch of TypeLoc and D.getTypeObject().Kind. For example,
the TypeLoc is

BTFTagAttributedType 0x88614e0 'int  btf_type_tag(rcu)()' sugar
|-ParenType 0x8861480 'int ()' sugar
| `-FunctionNoProtoType 0x8861450 'int ()' cdecl
|   `-BuiltinType 0x87fd500 'int'

while corresponding D.getTypeObject().Kind points to DeclaratorChunk::Paren, and
this will cause later assertion.

To fix the issue, similar to AttributedTypeLoc, let us skip BTFTagAttributedTypeLoc in

Diff Detail

Event Timeline

yonghong-song created this revision.Oct 26 2022, 5:57 PM
Herald added a project: Restricted Project. · View Herald TranscriptOct 26 2022, 5:57 PM
yonghong-song requested review of this revision.Oct 26 2022, 5:57 PM

The changes generally look good to me, but can you add a release note for the fix as well?

1 ↗(On Diff #470982)

Does the dwarf version actually matter or can that be removed as well?

Could the test be expanded to test more specifically than "does not crash"? Like is there some part of the output that can't be observed in any other test (that didn't/doesn't crash without this patch) - like the location emitted in some debug info, etc?

The changes generally look good to me, but can you add a release note for the fix as well?

Yes, will add the bug fix brief description to clang/docs/ReleaseNotes.rst

1 ↗(On Diff #470982)

I will move the test to CodeGen directory and actually check dwarf output for btf_type_tag in debuginfo which will address David's suggestion as well.

  • Add the bug fix description in Release Note
  • Actually compare debuginfo btf_type_tag output instead of marking 'expected-no-diagnostics'.

@aaron.ballman or @dblaikie I have addressed the comments, could you take a look again?

aaron.ballman accepted this revision.Nov 1 2022, 7:09 AM


This revision is now accepted and ready to land.Nov 1 2022, 7:09 AM
  • improve the bug description in release note.
This revision was landed with ongoing or failed builds.Nov 1 2022, 8:07 AM
This revision was automatically updated to reflect the committed changes.