[clang][Sema] Fix a clang crash with btf_type_tag

[yonghong-song]

Summary

For the following program,

$ cat t.c 
struct t { 
 int (__attribute__((btf_type_tag("rcu"))) *f)();
 int a;
};  
int foo(struct t *arg) {
  return arg->a;
}

Compiling with 'clang -g -O2 -S t.c' will cause a failure like below:

clang: /home/yhs/work/llvm-project/clang/lib/Sema/SemaType.cpp:6391: void {anonymous}::DeclaratorLocFiller::VisitParenTypeLoc(clang::ParenTypeLoc):
       Assertion `Chunk.Kind == DeclaratorChunk::Paren' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
......
#5 0x00007f89e4280ea5 abort (/lib64/libc.so.6+0x21ea5)
#6 0x00007f89e4280d79 _nl_load_domain.cold.0 (/lib64/libc.so.6+0x21d79)
#7 0x00007f89e42a6456 (/lib64/libc.so.6+0x47456)
#8 0x00000000045c2596 GetTypeSourceInfoForDeclarator((anonymous namespace)::TypeProcessingState&, clang::QualType, clang::TypeSourceInfo*) SemaType.cpp:0:0
#9 0x00000000045ccfa5 GetFullTypeForDeclarator((anonymous namespace)::TypeProcessingState&, clang::QualType, clang::TypeSourceInfo*) SemaType.cpp:0:0
......

The reason of the failure is due to the mismatch of TypeLoc and D.getTypeObject().Kind. For example,
the TypeLoc is

BTFTagAttributedType 0x88614e0 'int  btf_type_tag(rcu)()' sugar
|-ParenType 0x8861480 'int ()' sugar
| `-FunctionNoProtoType 0x8861450 'int ()' cdecl
|   `-BuiltinType 0x87fd500 'int'

while corresponding D.getTypeObject().Kind points to DeclaratorChunk::Paren, and
this will cause later assertion.

To fix the issue, similar to AttributedTypeLoc, let us skip BTFTagAttributedTypeLoc in
GetTypeSourceInfoForDeclarator().

[aaron.ballman]

The changes generally look good to me, but can you add a release note for the fix as well?

clang/test/Sema/attr-btf_type_tag-func-ptr.c

1

Does the dwarf version actually matter or can that be removed as well?

[dblaikie]

Could the test be expanded to test more specifically than "does not crash"? Like is there some part of the output that can't be observed in any other test (that didn't/doesn't crash without this patch) - like the location emitted in some debug info, etc?

[yonghong-song]

In D136807#3888317, @aaron.ballman wrote:

The changes generally look good to me, but can you add a release note for the fix as well?

Yes, will add the bug fix brief description to clang/docs/ReleaseNotes.rst

clang/test/Sema/attr-btf_type_tag-func-ptr.c

1

I will move the test to CodeGen directory and actually check dwarf output for btf_type_tag in debuginfo which will address David's suggestion as well.

[yonghong-song]

• Add the bug fix description in Release Note
• Actually compare debuginfo btf_type_tag output instead of marking 'expected-no-diagnostics'.

[yonghong-song]

@aaron.ballman or @dblaikie I have addressed the comments, could you take a look again?

[aaron.ballman]

LGTM!

clang/docs/ReleaseNotes.rst

261 ↗

(On Diff #471216)

[yonghong-song]

• improve the bug description in release note.

clang/lib/Sema/SemaType.cpp

while (MacroQualifiedTypeLoc TL = CurrTL.getAs<MacroQualifiedTypeLoc>()) {
       CurrTL = TL.getNextTypeLoc().getUnqualifiedLoc();
     }
 
     while (AttributedTypeLoc TL = CurrTL.getAs<AttributedTypeLoc>()) {
       fillAttributedTypeLoc(TL, State);
       CurrTL = TL.getNextTypeLoc().getUnqualifiedLoc();
     }
 
+    while (BTFTagAttributedTypeLoc TL = CurrTL.getAs<BTFTagAttributedTypeLoc>())
+      CurrTL = TL.getNextTypeLoc().getUnqualifiedLoc();
+
     while (DependentAddressSpaceTypeLoc TL =
                CurrTL.getAs<DependentAddressSpaceTypeLoc>()) {
       fillDependentAddressSpaceTypeLoc(TL, D.getTypeObject(i).getAttrs());
       CurrTL = TL.getPointeeTypeLoc().getUnqualifiedLoc();
     }
 
     if (MatrixTypeLoc TL = CurrTL.getAs<MatrixTypeLoc>())
       fillMatrixTypeLoc(TL, D.getTypeObject(i).getAttrs());

clang/test/Sema/attr-btf_type_tag-func-ptr.c

+// RUN: %clang_cc1 -x c -triple x86_64-pc-linux-gnu -dwarf-version=4 -fsyntax-only -verify %s
+
+// expected-no-diagnostics
+
+struct t {
+ int (__attribute__((btf_type_tag("rcu"))) *f)();
+ int a;
+};
+int foo(struct t *arg) {
+  return arg->a;
+}