Crash with 1:18~++20230930042448+d222c5ec47a0-1~exp1~20230930162603.353 amd64

[andrew-aitchison]

[ 32%] Building CXX object frmts/pds/CMakeFiles/gdal_PDS.dir/pds4vector.cpp.o
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: /usr/lib/llvm-18/bin/clang++ -DDONT_DEPRECATE_SPRINTF -DGDAL_COMPILATION -DHAVE_AVX_AT_COMPILE_TIME -DHAVE_SSE_AT_COMPILE_TIME -DHAVE_SSSE3_AT_COMPILE_TIME -DRENAME_INTERNAL_LIBGEOTIFF_SYMBOLS -DRENAME_INTERNAL_LIBTIFF_SYMBOLS -I/home/werdna/git/gdal/apps -I/home/werdna/git/gdal/alg -I/home/werdna/git/gdal/gcore -I/home/werdna/git/gdal.llvm/gcore -I/home/werdna/git/gdal/port -I/home/werdna/git/gdal.llvm/port -I/home/werdna/git/gdal/ogr -I/home/werdna/git/gdal/ogr/ogrsf_frmts -I/home/werdna/git/gdal/frmts -I/home/werdna/git/gdal/ogr/ogrsf_frmts/generic -I/home/werdna/git/gdal/frmts/raw -I/home/werdna/git/gdal/frmts/vrt -I/home/werdna/git/gdal/ogr/ogrsf_frmts/geojson -I/home/werdna/git/gdal/ogr/ogrsf_frmts/vrt -I/home/werdna/git/gdal/frmts/gtiff -I/home/werdna/git/gdal/frmts/gtiff/libgeotiff -I/home/werdna/git/gdal/frmts/gtiff/libtiff -I/usr/include/json-c -fno-finite-math-only -fvisibility=hidden -g -fPIC -Wall -Wextra -Winit-self -Wunused-parameter -Wmissing-declarations -Wshorten-64-to-32 -Wshadow -Wshadow-field -Wmissing-include-dirs -Wformat -Werror=format-security -Wno-format-nonliteral -Werror=vla -Wdate-time -Wnull-dereference -Wextra-semi -Wcomma -Wfloat-conversion -Wdocumentation -Wno-documentation-deprecated-sync -Wunused-private-field -Wnon-virtual-dtor -Woverloaded-virtual -Wsuggest-override -fno-operator-names -Wzero-as-null-pointer-constant -std=gnu++11 -MD -MT frmts/pds/CMakeFiles/gdal_PDS.dir/pds4vector.cpp.o -MF CMakeFiles/gdal_PDS.dir/pds4vector.cpp.o.d -o CMakeFiles/gdal_PDS.dir/pds4vector.cpp.o -c /home/werdna/git/gdal/frmts/pds/pds4vector.cpp
1.      <eof> parser at end of file
2.      /home/werdna/git/gdal/frmts/pds/pds4vector.cpp:2578:30: instantiating function definition 'PDS4EditableSynchronizer<PDS4FixedWidthTable>::EditableSyncToDisk'
 #0 0x00007f9c3cf34956 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm-18/bin/../lib/libLLVM-18.so.1+0xd34956)
 #1 0x00007f9c3cf32980 llvm::sys::RunSignalHandlers() (/usr/lib/llvm-18/bin/../lib/libLLVM-18.so.1+0xd32980)
 #2 0x00007f9c3ce834a0 (/usr/lib/llvm-18/bin/../lib/libLLVM-18.so.1+0xc834a0)
 #3 0x00007f9c3ba3c4b0 (/lib/x86_64-linux-gnu/libc.so.6+0x3c4b0)
 #4 0x00007f9c3cedc7b6 llvm::StringRef::find_last_of(llvm::StringRef, unsigned long) const (/usr/lib/llvm-18/bin/../lib/libLLVM-18.so.1+0xcdc7b6)
 #5 0x00007f9c44750b4e clang::ASTContext::getRawCommentForDeclNoCacheImpl(clang::Decl const*, clang::SourceLocation, std::map<unsigned int, clang::RawComment*, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, clang::RawComment*>>> const&) const (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0xb50b4e)
 #6 0x00007f9c4475179e clang::ASTContext::attachCommentsToJustParsedDecls(llvm::
ArrayRef<clang::Decl*>, clang::Preprocessor const*) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0xb5179e)
 #7 0x00007f9c4500fae7 clang::Sema::ActOnStartOfFunctionDef(clang::Scope*, clang::Decl*, clang::Sema::SkipBodyInfo*, clang::Sema::FnBodyKind) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x140fae7)
 #8 0x00007f9c455ea719 clang::Sema::InstantiateFunctionDefinition(clang::SourceLocation, clang::FunctionDecl*, bool, bool, bool) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x19ea719)
 #9 0x00007f9c455ed0c7 clang::Sema::PerformPendingInstantiations(bool) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x19ed0c7)
#10 0x00007f9c44e62c3f clang::Sema::ActOnEndOfTranslationUnitFragment(clang::Sema::TUFragmentKind) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x1262c3f)
#11 0x00007f9c44e63291 clang::Sema::ActOnEndOfTranslationUnit() (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x1263291)
#12 0x00007f9c44744339 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr<clang::DeclGroupRef>&, clang::Sema::ModuleImportState&) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0xb44339)
#13 0x00007f9c4467e41e clang::ParseAST(clang::Sema&, bool, bool) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0xa7e41e)
#14 0x00007f9c4642a1f5 clang::FrontendAction::Execute() (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x282a1f5)
#15 0x00007f9c463a19d4 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x27a19d4)
#16 0x00007f9c464a3fb0 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x28a3fb0)
#17 0x000055e5ce7dd24b cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/usr/lib/llvm-18/bin/clang+++0x1324b)
#18 0x000055e5ce7da705 (/usr/lib/llvm-18/bin/clang+++0x10705)
#19 0x00007f9c460667d9 (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x24667d9)
#20 0x00007f9c3ce8323c llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/usr/lib/llvm-18/bin/../lib/libLLVM-18.so.1+0xc8323c)
#21 0x00007f9c4606614e clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x246614e)
#22 0x00007f9c4602ef51 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x242ef51)
#23 0x00007f9c4602f19e clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x242f19e)
#24 0x00007f9c4604a78c clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x244a78c)
#25 0x000055e5ce7da064 clang_main(int, char**, llvm::ToolContext const&) (/usr/lib/llvm-18/bin/clang+++0x10064)
#26 0x000055e5ce7e7482 main (/usr/lib/llvm-18/bin/clang+++0x1d482)
#27 0x00007f9c3ba23a90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#28 0x00007f9c3ba23b49 call_init ./csu/../csu/libc-start.c:128:20
#29 0x00007f9c3ba23b49 __libc_start_main ./csu/../csu/libc-start.c:347:5
#30 0x000055e5ce7d70d5 _start (/usr/lib/llvm-18/bin/clang+++0xd0d5)
clang++: error: clang frontend command failed with exit code 139 (use -v to see invocation)
Ubuntu clang version 18.0.0 (++20230930042448+d222c5ec47a0-1~exp1~20230930162603.353)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/lib/llvm-18/bin
clang++: note: diagnostic msg: 
********************

Firefox wont let me attach .ccp and .sh files here, so the files are at:

https://www.aitchison.me.uk/cppcheck/20231002/pds4vector-abdd70.cpp
https://www.aitchison.me.uk/cppcheck/20231002/pds4vector-abdd70.sh

[llvmbot]

@llvm/issue-subscribers-clang-frontend

``` [ 32%] Building CXX object frmts/pds/CMakeFiles/gdal_PDS.dir/pds4vector.cpp.o PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script. Stack dump: 0. Program arguments: /usr/lib/llvm-18/bin/clang++ -DDONT_DEPRECATE_SPRINTF -DGDAL_COMPILATION -DHAVE_AVX_AT_COMPILE_TIME -DHAVE_SSE_AT_COMPILE_TIME -DHAVE_SSSE3_AT_COMPILE_TIME -DRENAME_INTERNAL_LIBGEOTIFF_SYMBOLS -DRENAME_INTERNAL_LIBTIFF_SYMBOLS -I/home/werdna/git/gdal/apps -I/home/werdna/git/gdal/alg -I/home/werdna/git/gdal/gcore -I/home/werdna/git/gdal.llvm/gcore -I/home/werdna/git/gdal/port -I/home/werdna/git/gdal.llvm/port -I/home/werdna/git/gdal/ogr -I/home/werdna/git/gdal/ogr/ogrsf_frmts -I/home/werdna/git/gdal/frmts -I/home/werdna/git/gdal/ogr/ogrsf_frmts/generic -I/home/werdna/git/gdal/frmts/raw -I/home/werdna/git/gdal/frmts/vrt -I/home/werdna/git/gdal/ogr/ogrsf_frmts/geojson -I/home/werdna/git/gdal/ogr/ogrsf_frmts/vrt -I/home/werdna/git/gdal/frmts/gtiff -I/home/werdna/git/gdal/frmts/gtiff/libgeotiff -I/home/werdna/git/gdal/frmts/gtiff/libtiff -I/usr/include/json-c -fno-finite-math-only -fvisibility=hidden -g -fPIC -Wall -Wextra -Winit-self -Wunused-parameter -Wmissing-declarations -Wshorten-64-to-32 -Wshadow -Wshadow-field -Wmissing-include-dirs -Wformat -Werror=format-security -Wno-format-nonliteral -Werror=vla -Wdate-time -Wnull-dereference -Wextra-semi -Wcomma -Wfloat-conversion -Wdocumentation -Wno-documentation-deprecated-sync -Wunused-private-field -Wnon-virtual-dtor -Woverloaded-virtual -Wsuggest-override -fno-operator-names -Wzero-as-null-pointer-constant -std=gnu++11 -MD -MT frmts/pds/CMakeFiles/gdal_PDS.dir/pds4vector.cpp.o -MF CMakeFiles/gdal_PDS.dir/pds4vector.cpp.o.d -o CMakeFiles/gdal_PDS.dir/pds4vector.cpp.o -c /home/werdna/git/gdal/frmts/pds/pds4vector.cpp 1. <eof> parser at end of file 2. /home/werdna/git/gdal/frmts/pds/pds4vector.cpp:2578:30: instantiating function definition 'PDS4EditableSynchronizer<PDS4FixedWidthTable>::EditableSyncToDisk' #0 0x00007f9c3cf34956 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm-18/bin/../lib/libLLVM-18.so.1+0xd34956) #1 0x00007f9c3cf32980 llvm::sys::RunSignalHandlers() (/usr/lib/llvm-18/bin/../lib/libLLVM-18.so.1+0xd32980) #2 0x00007f9c3ce834a0 (/usr/lib/llvm-18/bin/../lib/libLLVM-18.so.1+0xc834a0) #3 0x00007f9c3ba3c4b0 (/lib/x86_64-linux-gnu/libc.so.6+0x3c4b0) #4 0x00007f9c3cedc7b6 llvm::StringRef::find_last_of(llvm::StringRef, unsigned long) const (/usr/lib/llvm-18/bin/../lib/libLLVM-18.so.1+0xcdc7b6) #5 0x00007f9c44750b4e clang::ASTContext::getRawCommentForDeclNoCacheImpl(clang::Decl const*, clang::SourceLocation, std::map<unsigned int, clang::RawComment*, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, clang::RawComment*>>> const&) const (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0xb50b4e) #6 0x00007f9c4475179e clang::ASTContext::attachCommentsToJustParsedDecls(llvm:: ArrayRef<clang::Decl*>, clang::Preprocessor const*) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0xb5179e) #7 0x00007f9c4500fae7 clang::Sema::ActOnStartOfFunctionDef(clang::Scope*, clang::Decl*, clang::Sema::SkipBodyInfo*, clang::Sema::FnBodyKind) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x140fae7) #8 0x00007f9c455ea719 clang::Sema::InstantiateFunctionDefinition(clang::SourceLocation, clang::FunctionDecl*, bool, bool, bool) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x19ea719) #9 0x00007f9c455ed0c7 clang::Sema::PerformPendingInstantiations(bool) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x19ed0c7) #10 0x00007f9c44e62c3f clang::Sema::ActOnEndOfTranslationUnitFragment(clang::Sema::TUFragmentKind) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x1262c3f) #11 0x00007f9c44e63291 clang::Sema::ActOnEndOfTranslationUnit() (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x1263291) #12 0x00007f9c44744339 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr<clang::DeclGroupRef>&, clang::Sema::ModuleImportState&) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0xb44339) #13 0x00007f9c4467e41e clang::ParseAST(clang::Sema&, bool, bool) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0xa7e41e) #14 0x00007f9c4642a1f5 clang::FrontendAction::Execute() (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x282a1f5) #15 0x00007f9c463a19d4 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x27a19d4) #16 0x00007f9c464a3fb0 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x28a3fb0) #17 0x000055e5ce7dd24b cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/usr/lib/llvm-18/bin/clang+++0x1324b) #18 0x000055e5ce7da705 (/usr/lib/llvm-18/bin/clang+++0x10705) #19 0x00007f9c460667d9 (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x24667d9) #20 0x00007f9c3ce8323c llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/usr/lib/llvm-18/bin/../lib/libLLVM-18.so.1+0xc8323c) #21 0x00007f9c4606614e clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x246614e) #22 0x00007f9c4602ef51 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x242ef51) #23 0x00007f9c4602f19e clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x242f19e) #24 0x00007f9c4604a78c clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/usr/lib/llvm-18/bin/../lib/libclang-cpp.so.18+0x244a78c) #25 0x000055e5ce7da064 clang_main(int, char**, llvm::ToolContext const&) (/usr/lib/llvm-18/bin/clang+++0x10064) #26 0x000055e5ce7e7482 main (/usr/lib/llvm-18/bin/clang+++0x1d482) #27 0x00007f9c3ba23a90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3 #28 0x00007f9c3ba23b49 call_init ./csu/../csu/libc-start.c:128:20 #29 0x00007f9c3ba23b49 __libc_start_main ./csu/../csu/libc-start.c:347:5 #30 0x000055e5ce7d70d5 _start (/usr/lib/llvm-18/bin/clang+++0xd0d5) clang++: error: clang frontend command failed with exit code 139 (use -v to see invocation) Ubuntu clang version 18.0.0 (++20230930042448+d222c5ec47a0-1~exp1~20230930162603.353) Target: x86_64-pc-linux-gnu Thread model: posix InstalledDir: /usr/lib/llvm-18/bin clang++: note: diagnostic msg: ******************** ``` Firefox wont let me attach .ccp and .sh files here, so the files are at:

https://www.aitchison.me.uk/cppcheck/20231002/pds4vector-abdd70.cpp
https://www.aitchison.me.uk/cppcheck/20231002/pds4vector-abdd70.sh

[andrew-aitchison]

I'll work on a smaller reproducer, but the first clue is that
unifdef -k pds4vector-abdd70.cpp
fails with
unifdef: pds4vector-abdd70.cpp: 61983: Inappropriate #else (#if line 61414 depth 41)

However, if I run the generated .sh the compile succeeds with no crash and generates the .o file.
Is there a recommended way to run the reproducer ?

[andrew-aitchison]

Hmm. I don't think we can make a reproducer this way. The bug appears to be at the cpp level (in GNU terms; I don't know my way around clang/llvm terminology).

This is a full cmake build of https://github.com/OSGeo/gdal con Ubuntu 23.04/lunar

I can make frmts/pds/pds4vector.cpp compile without crashing by adding pairs of '#if 1' and '#endif' inside the {} of most of the functions in this file.
Taking out one pair from one of several functions will bring the crash back.
Note that this is '#if 1' and not '#if 0', so logically I am not even changing the post-processed code.
Should I look for fixed size buffers or stacks in the preprocessor that might overflow ? Where ?

[andrew-aitchison]

git bisect shows that the regression appears with commit 256a0b2
[flang] Prioritize DATA object error messages a little better (#66258)
which appears to be fixing a fortran issue. Odd.

I don't expect to make further progress without help.

[andrew-aitchison]

Since I cannot reduce the reproducer I'll say that clang++ crashes while compiling
frmts/pds/pds4vector.cpp into frmts/pds/CMakeFiles/gdal_PDS.dir/pds4vector.cpp.o
as part of building gdal from
https://download.osgeo.org/gdal/3.7.2/gdal-3.7.2.tar.xz

[shafik]

git bisect shows that the regression appears with commit 256a0b2 [flang] Prioritize DATA object error messages a little better (#66258) which appears to be fixing a fortran issue. Odd.

I don't expect to make further progress without help.

The commit hash is not flang change, was that copy-pasta?

[andrew-aitchison]

Oops.
I've double checked and can confirm that
f89d2be works
256a0b2 crashes

I think it was something like that, probably confused by which commit hash is most prominent in 'git bisect visualize'

[shafik]

Oops. I've double checked and can confirm that f89d2be works 256a0b2 crashes

I think it was something like that, probably confused by which commit hash is most prominent in 'git bisect visualize'

CC @tahonermann so that commit was your PR but I don't see anything there that seems related to the crash but perhaps you have some insights.

[tahonermann]

Thanks, @shafik, I'll take a closer look.

[tahonermann]

I spent a little time looking at the reported stack trace and related code. I don't think the changes I made in 256a0b2 are a direct cause of the crash, but it does look like they might have exposed a latent bug. The crash is occurring in code that uses source locations to fetch comments from around a declaration in the source code and the changes I made modified the source locations associated with instantiated function definitions.

I tried reproducing using the linked .cpp and .sh file but they didn't reproduce the issue for me either.

I have not tried building gdal. @andrew-aitchison, do you think you could construct a smaller reproducer by starting with the gdal distribution and modifying its CMakeLists.txt file to reduce what is built to just the sources needed to reproduce the problem? If so, that would be helpful.