Fix a bug with clang with object destructor, while skipping object initialization - make clang crash

[ykfre]

Summary

The following code crashes clang:

extern int g;

class A
{
public:
A() {};
~A() {};
};

void b()
{
if(g)
{

		goto clean_up;

}
A a;

int i = 0;

clean_up:
return;
}

with

1> #0 0x00007ff6e6716a72 C:\Program Files\LLVM\bin\clang-cl.exe 0x2e96a72 C:\Program Files\LLVM\bin\clang-cl.exe 0x2e8c649
1> #1 0x00007ff6e6716a72 C:\Program Files\LLVM\bin\clang-cl.exe 0x2e95c08 C:\Program Files\LLVM\bin\clang-cl.exe 0x2e92890
1> #2 0x00007ff6e6716a72 C:\Program Files\LLVM\bin\clang-cl.exe 0x2e95c08 C:\Program Files\LLVM\bin\clang-cl.exe 0x2e848f1
1> #3 0x00007ff6e6716a72 C:\Program Files\LLVM\bin\clang-cl.exe 0x2e78c88 C:\Program Files\LLVM\bin\clang-cl.exe 0x2d55688
1> #4 0x00007ff6e6716a72 C:\Program Files\LLVM\bin\clang-cl.exe 0x284c373 C:\Program Files\LLVM\bin\clang-cl.exe 0x29b2353
1> #5 0x00007ff6e6716a72 C:\Program Files\LLVM\bin\clang-cl.exe 0x27e0271 C:\Program Files\LLVM\bin\clang-cl.exe 0x276351e
1> #6 0x00007ff6e6716a72 C:\Program Files\LLVM\bin\clang-cl.exe 0x27a6c62 C:\Program Files\LLVM\bin\clang-cl.exe 0x276289b
1> #7 0x00007ff6e6716a72 C:\Program Files\LLVM\bin\clang-cl.exe 0x276222c C:\Program Files\LLVM\bin\clang-cl.exe 0x27610c3
1> #8 0x00007ff6e6716a72 C:\Program Files\LLVM\bin\clang-cl.exe 0x275f602 C:\Program Files\LLVM\bin\clang-cl.exe 0x275b44e
1> #9 0x00007ff6e6716a72 C:\Program Files\LLVM\bin\clang-cl.exe 0x1cb3492 C:\Program Files\LLVM\bin\clang-cl.exe 0x1c771cf
1>#10 0x00007ff6e6716a72 C:\Program Files\LLVM\bin\clang-cl.exe 0x1d09c87 C:\Program Files\LLVM\bin\clang-cl.exe 0x6e87
1>#11 0x00007ff6e6716a72 C:\Program Files\LLVM\bin\clang-cl.exe 0x4564 C:\Program Files\LLVM\bin\clang-cl.exe 0x33dda20
1>#12 0x00007ff6e6716a72 (C:\Program Files\LLVM\bin\clang-cl.exe+0x2e96a72)
1>#13 0x00007ff6e670c649 (C:\Program Files\LLVM\bin\clang-cl.exe+0x2e8c649)
1>0x00007FF6E6716A72 (0x00007FF6E6709BA1 0x000000000000001E 0x000002A9CC1695B0 0x000002A9CC1665E8)
1>0x00007FF6E670C649 (0x000002A9CC047FA0 0x00007FF6E6794E62 0x000002A9CC1762B0 0x00003A857DAE5EDC)
1>0x00007FF6E6715C08 (0x0000000000000000 0x000002A9CC168780 0x0000000000000001 0x00007FF6E6703CAF)
1>0x00007FF6E6712890 (0x000002A9CC176060 0x00007FF6E6703A01 0x0000000000000050 0x00003A857DAE5B9C)
1>0x00007FF6E6715C08 (0x7A696C616974696E 0x0000026E6F697461 0x000002A9CC028820 0x00007FF6E7D6A2E0)
1>0x00007FF6E67048F1 (0x000002A9CC1665E8 0x000002A9CC0BBCE0 0x0000000000000001 0x00007FF60000005C)
1>0x00007FF6E66F8C88 (0x00003A857DAE50AC 0x000002A9CC166AF0 0x0000000000000000 0x000002A9CC029710)
1>0x00007FF6E65D5688 (0x00003A857DAE2FDC 0x000000C804D8C360 0x000000C804D8C310 0x0000000400000000)
1>0x00007FF6E60CC373 (0x000002A9CC1648E8 0x000002A9CC0BDDF0 0xFFFFFFFFFFFFFFFF 0x000002A9CC1665E8)
1>0x00007FF6E6232353 (0x000002A9CC1665E8 0x00007FF6E6273AEC 0x0000000000000000 0x000002A9CC0B97E0)
1>0x00007FF6E6060271 (0x0000000000000000 0x00007FF6E600C3FA 0x00007FF6E6A61724 0x000002A900000000)
1>0x00007FF6E5FE351E (0x000002A9CC03E658 0x000000C804D8CB28 0x0000000000000041 0x000000C804D8CB20)
1>0x00007FF6E6026C62 (0x000002A9CC0C02B4 0x0000000000000000 0x0000000000000050 0x000002A9CC0C0CC0)
1>0x00007FF6E5FE289B (0x000002A9CC143DD0 0x000002A9CC03A330 0x0000000000000001 0x00007FF6E679978F)
1>0x00007FF6E5FE222C (0x00003A857DAE3BAC 0x000000C804D8D918 0x000002A9CC0377B0 0x0000000000000001)
1>0x00007FF6E5FE10C3 (0x000002A9CBFE5FD0 0x00007FF6E6C4974E 0x000000C804D8F960 0x000000C804D8DA30)
1>0x00007FF6E5FDF602 (0x000000C804D8DB38 0x000000C804D8DB48 0x000000C804D8DB78 0x00007FF6E54F42AA)
1>0x00007FF6E5FDB44E (0x000002A9CC023500 0x00003A857DAE3BFC 0x0000000000000000 0x000000000000000F)
1>0x00007FF6E5533492 (0x000002A9CBFF7990 0x00007FF600000000 0x00000000000000C0 0x0000003404D8DB68)
1>0x00007FF6E54F71CF (0x00007FF6E6C61901 0x000002A900000000 0x000000C804D8EA01 0x0000000000000000)
1>0x00007FF6E5589C87 (0x0000000000000200 0x000002A9CC021FA0 0x000002A9CBFCEE40 0x0000000000000101)
1>0x00007FF6E3886E87 (0x0000000000000000 0x00000000000000A8 0x00000000000006B0 0x0000000000000000)
1>0x00007FF6E3884564 (0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000)
1>0x00007FF6E6C5DA20 (0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000)
1>0x00007FFCF9027BD4 (0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000), BaseThreadInitThunk() + 0x14 bytes(s)
1>0x00007FFCF992CED1 (0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000), RtlUserThreadStart() + 0x21 bytes(s)
1>clang-cl : error : clang frontend command failed due to signal (use -v to see invocation)

[dim]

Eh, no it does not crash clang, at least not here? Instead it gives you a compile error, as it should:

cleanup.cpp:15:5: error: cannot jump from this goto statement to its label
                goto clean_up;
                ^
cleanup.cpp:20:7: note: jump bypasses variable initialization
  int i = 0;
      ^
cleanup.cpp:18:4: note: jump bypasses variable initialization
        A a;
          ^
1 error generated.

(This is with clang 9.0.1 on FreeBSD. I haven't tried on Windows.)

[ykfre]

In D72910#1826108, @dim wrote:

Eh, no it does not crash clang, at least not here? Instead it gives you a compile error, as it should:

cleanup.cpp:15:5: error: cannot jump from this goto statement to its label
                goto clean_up;
                ^
cleanup.cpp:20:7: note: jump bypasses variable initialization
  int i = 0;
      ^
cleanup.cpp:18:4: note: jump bypasses variable initialization
        A a;
          ^
1 error generated.

(This is with clang 9.0.1 on FreeBSD. I haven't tried on Windows.)

Actually I see it only crashes clang-cl, and not clang, probably clang-cl fucks something up.
The command line is -

1. Original command: "C:\\Program Files\\LLVM\\bin\\clang-cl.exe" "-cc1" "-triple" "i386-pc-windows-msvc19.24.28314" "-emit-obj" "-mrelax-all" "-mincremental-linker-compatible" "-disable-free" "-disable-llvm-verifier" "-discard-value-names" "-main-file-name" "main2.cpp" "-mrelocation-model" "static" "-mthread-model" "posix" "-mdisable-fp-elim" "-relaxed-aliasing" "-fmath-errno" "-masm-verbose" "-mconstructor-aliases" "-target-cpu" "pentium4" "-mllvm" "-x86-asm-syntax=intel" "-D_DEBUG" "-D_MT" "-D_DLL" "--dependent-lib=msvcrtd" "--dependent-lib=oldnames" "-fms-volatile" "-fdefault-calling-conv=cdecl" "-fdiagnostics-format" "msvc" "-gcodeview" "-debug-info-kind=limited" "-v" "-coverage-notes-file" "C:\\Users\\IDO\\source\\repos\\Project11\\Project11\\main2.gcno" "-resource-dir" "C:\\Program Files\\LLVM\\lib\\clang\\9.0.0" "-D" "_DEBUG" "-D" "_CONSOLE" "-D" "_UNICODE" "-D" "UNICODE" "-internal-isystem" "C:\\Program Files\\LLVM\\lib\\clang\\9.0.0\\include" "-internal-isystem" "C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Enterprise\\VC\\Tools\\MSVC\\14.24.28314\\include" "-internal-isystem" "C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Enterprise\\VC\\Tools\\MSVC\\14.24.28314\\atlmfc\\include" "-internal-isystem" "C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Enterprise\\VC\\Auxiliary\\VS\\include" "-internal-isystem" "C:\\Program Files (x86)\\Windows Kits\\10\\Include\\10.0.18362.0\\ucrt" "-internal-isystem" "C:\\Program Files (x86)\\Windows Kits\\10\\Include\\10.0.18362.0\\um" "-internal-isystem" "C:\\Program Files (x86)\\Windows Kits\\10\\Include\\10.0.18362.0\\shared" "-internal-isystem" "C:\\Program Files (x86)\\Windows Kits\\10\\Include\\10.0.18362.0\\winrt" "-internal-isystem" "C:\\Program Files (x86)\\Windows Kits\\10\\Include\\10.0.18362.0\\cppwinrt" "-internal-isystem" "C:\\Program Files (x86)\\Windows Kits\\NETFXSDK\\4.8\\Include\\um" "-O0" "-WCL4" "-Werror" "-fdeprecated-macro" "-fdebug-compilation-dir" "C:\\Users\\IDO\\source\\repos\\Project11\\Project11" "-ferror-limit" "19" "-fmessage-length" "0" "-fno-use-cxa-atexit" "-fms-extensions" "-fms-compatibility" "-fms-compatibility-version=19.24.28314" "-std=c++14" "-fdelayed-template-parsing" "-fobjc-runtime=gcc" "-fno-caret-diagnostics" "-fdiagnostics-show-option" "-faddrsig" "-o" "Debug\\main2.obj" "-x" "c++" "main2.cpp"

[dim]

Aha, which version of clang-cl are you using? With the released version of clang-cl 9.0.1, I get a warning instead of an error:

cleanup.cpp(15,5): warning: jump from this goto statement to its label is a Microsoft extension [-Wmicrosoft-goto]
                goto clean_up;
                ^
cleanup.cpp(20,7): note: jump bypasses variable initialization
  int i = 0;
      ^
cleanup.cpp(18,4): note: jump bypasses variable initialization
        A a;
          ^
1 warning generated.

So apparently another code path is activated when the target is Microsoft.

[ykfre]

In D72910#1826293, @dim wrote:

Aha, which version of clang-cl are you using? With the released version of clang-cl 9.0.1, I get a warning instead of an error:

cleanup.cpp(15,5): warning: jump from this goto statement to its label is a Microsoft extension [-Wmicrosoft-goto]
                goto clean_up;
                ^
cleanup.cpp(20,7): note: jump bypasses variable initialization
  int i = 0;
      ^
cleanup.cpp(18,4): note: jump bypasses variable initialization
        A a;
          ^
1 warning generated.

So apparently another code path is activated when the target is Microsoft.

I succeeded to narrow it to the use of the flag -WCL4

clang/lib/Analysis/CFG.cpp

   // this sequence up and replay them in reverse order when appending onto the
   // CFGBlock(s).
   SmallVector<VarDecl*, 10> Decls;
+
+  // Handles the case where goto skips initialization, but there is a destructor to the object.
+  if (B == LocalScope::const_iterator())
+      return;
+  
   Decls.reserve(B.distance(E));
   for (LocalScope::const_iterator I = B; I != E; ++I)
     Decls.push_back(*I);