Clang 18 llvm::report_bad_alloc_error in Sema::CheckConstraintSatisfaction

[danakj]

This happened in the last few days, showed up on my CI run today.

/usr/bin/clang++-18  -I/home/runner/work/subspace/subspace -I/home/runner/work/subspace/subspace/third_party/fmt/include -isystem /usr/include/c++/12 -isystem /usr/include/x86_64-linux-gnu/c++/12 -isystem /usr/include/c++/12/backward -isystem /usr/lib/llvm-18/lib/clang/18/include -isystem /usr/local/include -isystem /usr/include/x86_64-linux-gnu -isystem /usr/include -O3 -DNDEBUG -std=c++20 -fno-rtti -Wno-nullability-completeness -MD -MT sus/CMakeFiles/subspace.dir/lib/lib.cc.o -MF sus/CMakeFiles/subspace.dir/lib/lib.cc.o.d -o sus/CMakeFiles/subspace.dir/lib/lib.cc.o -c /home/runner/work/subspace/subspace/sus/lib/lib.cc
LLVM ERROR: out of memory
Allocation failed
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /usr/bin/clang++-18 -I/home/runner/work/subspace/subspace -I/home/runner/work/subspace/subspace/third_party/fmt/include -isystem /usr/include/c++/12 -isystem /usr/include/x86_64-linux-gnu/c++/12 -isystem /usr/include/c++/12/backward -isystem /usr/lib/llvm-18/lib/clang/18/include -isystem /usr/local/include -isystem /usr/include/x86_64-linux-gnu -isystem /usr/include -O3 -DNDEBUG -std=c++20 -fno-rtti -Wno-nullability-completeness -MD -MT sus/CMakeFiles/subspace.dir/lib/lib.cc.o -MF sus/CMakeFiles/subspace.dir/lib/lib.cc.o.d -o sus/CMakeFiles/subspace.dir/lib/lib.cc.o -c /home/runner/work/subspace/subspace/sus/lib/lib.cc
1.	/home/runner/work/subspace/subspace/sus/num/__private/unsigned_integer_methods.inc:473:33: current parser token ';'
2.	/home/runner/work/subspace/subspace/sus/num/unsigned_integer.h:44:1: parsing namespace 'sus'
3.	/home/runner/work/subspace/subspace/sus/num/unsigned_integer.h:51:1: parsing struct/union/class body 'sus::num::u32'
4.	/home/runner/work/subspace/subspace/sus/num/__private/unsigned_integer_methods.inc:472:1: parsing function body 'sus::num::u32::from_product'
5.	/home/runner/work/subspace/subspace/sus/num/__private/unsigned_integer_methods.inc:472:1: in compound statement ('{}')
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0  libLLVM-18.so.1    0x00007f1fc2f[26](https://github.com/chromium/subspace/actions/runs/6252318951/job/16975334258#step:7:27)cd6 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) + 54
1  libLLVM-18.so.1    0x00007f1fc2f24c90 llvm::sys::RunSignalHandlers() + 80
2  libLLVM-18.so.1    0x00007f1fc2e77470
3  libc.so.6          0x00007f1fc1a42520
4  libc.so.6          0x00007f1fc1a96a7c pthread_kill + 300
5  libc.so.6          0x00007f1fc1a42476 raise + 22
6  libc.so.6          0x00007f1fc1a287f3 abort + 211
7  libLLVM-18.so.1    0x00007f1fc2e853c4 llvm::report_bad_alloc_error(char const*, bool) + 132
8  libLLVM-18.so.1    0x00007f1fc2ec21f0 llvm::SmallVectorBase<unsigned int>::size() const + 0
9  libclang-cpp.so.18 0x00007f1fcaf98a74 llvm::SmallVectorImpl<std::pair<clang::Expr const*, llvm::PointerUnion<clang::Expr*, std::pair<clang::SourceLocation, llvm::StringRef>*>>>::operator=(llvm::SmallVectorImpl<std::pair<clang::Expr const*, llvm::PointerUnion<clang::Expr*, std::pair<clang::SourceLocation, llvm::StringRef>*>>> const&) + 68
10 libclang-cpp.so.18 0x00007f1fcaf917cb clang::Sema::CheckConstraintSatisfaction(clang::NamedDecl const*, llvm::ArrayRef<clang::Expr const*>, llvm::SmallVectorImpl<clang::Expr*>&, clang::MultiLevelTemplateArgumentList const&, clang::SourceRange, clang::ConstraintSatisfaction&) + 1995
11 libclang-cpp.so.18 0x00007f1fcb49bff7 clang::Sema::CheckConceptTemplateId(clang::CXXScopeSpec const&, clang::SourceLocation, clang::DeclarationNameInfo const&, clang::NamedDecl*, clang::ConceptDecl*, clang::TemplateArgumentListInfo const*) + 7[27](https://github.com/chromium/subspace/actions/runs/6252318951/job/16975334258#step:7:28)
12 libclang-cpp.so.18 0x00007f1fcb5a91b2
63 clang++-18         0x000055e22988d545
64 libclang-cpp.so.18 0x00007f1fcc060609
65 libLLVM-18.so.1    0x00007f1fc2e7720c llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) + 140
66 libclang-cpp.so.18 0x00007f1fcc05ff7e clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const + 366
67 libclang-cpp.so.18 0x00007f1fcc0[28](https://github.com/chromium/subspace/actions/runs/6252318951/job/16975334258#step:7:29)c51 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const + 897
68 libclang-cpp.so.18 0x00007f1fcc028e9e clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const + 142
69 libclang-cpp.so.18 0x00007f1fcc04477c clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) + 332
70 clang++-18         0x000055e2[29](https://github.com/chromium/subspace/actions/runs/6252318951/job/16975334258#step:7:30)88cea4 clang_main(int, char**, llvm::ToolContext const&) + 11252
71 clang++-18         0x000055e229899aa2 main + 50
72 libc.so.6          0x00007f1fc1a29d90
73 libc.so.6          0x00007f1fc1a29e40 __libc_start_main + 128
74 clang++-18         0x000055e229889f55 _start + 37
clang++-18: error: clang frontend command failed with exit code 134 (use -v to see invocation)
Ubuntu clang version 18.0.0 (++202[30](https://github.com/chromium/subspace/actions/runs/6252318951/job/16975334258#step:7:31)920042413+678c1f142c06-1~exp1~202309200425[33](https://github.com/chromium/subspace/actions/runs/6252318951/job/16975334258#step:7:34).1196)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
clang++-18: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang++-18: note: diagnostic msg: /tmp/lib-6aff51.cpp
clang++-18: note: diagnostic msg: /tmp/lib-6aff51.sh
clang++-18: note: diagnostic msg: 

********************

cc: @cor3ntin

[danakj]

I can try to bisect tomorrow but suspecting the recent consteval fix in sema.

[llvmbot]

@llvm/issue-subscribers-clang-frontend

This happened in the last few days, showed up on my [CI run](https://github.com/chromium/subspace/actions/runs/6252318951/job/16975334258) today.

/usr/bin/clang++-18  -I/home/runner/work/subspace/subspace -I/home/runner/work/subspace/subspace/third_party/fmt/include -isystem /usr/include/c++/12 -isystem /usr/include/x86_64-linux-gnu/c++/12 -isystem /usr/include/c++/12/backward -isystem /usr/lib/llvm-18/lib/clang/18/include -isystem /usr/local/include -isystem /usr/include/x86_64-linux-gnu -isystem /usr/include -O3 -DNDEBUG -std=c++20 -fno-rtti -Wno-nullability-completeness -MD -MT sus/CMakeFiles/subspace.dir/lib/lib.cc.o -MF sus/CMakeFiles/subspace.dir/lib/lib.cc.o.d -o sus/CMakeFiles/subspace.dir/lib/lib.cc.o -c /home/runner/work/subspace/subspace/sus/lib/lib.cc
LLVM ERROR: out of memory
Allocation failed
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /usr/bin/clang++-18 -I/home/runner/work/subspace/subspace -I/home/runner/work/subspace/subspace/third_party/fmt/include -isystem /usr/include/c++/12 -isystem /usr/include/x86_64-linux-gnu/c++/12 -isystem /usr/include/c++/12/backward -isystem /usr/lib/llvm-18/lib/clang/18/include -isystem /usr/local/include -isystem /usr/include/x86_64-linux-gnu -isystem /usr/include -O3 -DNDEBUG -std=c++20 -fno-rtti -Wno-nullability-completeness -MD -MT sus/CMakeFiles/subspace.dir/lib/lib.cc.o -MF sus/CMakeFiles/subspace.dir/lib/lib.cc.o.d -o sus/CMakeFiles/subspace.dir/lib/lib.cc.o -c /home/runner/work/subspace/subspace/sus/lib/lib.cc
1.	/home/runner/work/subspace/subspace/sus/num/__private/unsigned_integer_methods.inc:473:33: current parser token ';'
2.	/home/runner/work/subspace/subspace/sus/num/unsigned_integer.h:44:1: parsing namespace 'sus'
3.	/home/runner/work/subspace/subspace/sus/num/unsigned_integer.h:51:1: parsing struct/union/class body 'sus::num::u32'
4.	/home/runner/work/subspace/subspace/sus/num/__private/unsigned_integer_methods.inc:472:1: parsing function body 'sus::num::u32::from_product'
5.	/home/runner/work/subspace/subspace/sus/num/__private/unsigned_integer_methods.inc:472:1: in compound statement ('{}')
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0  libLLVM-18.so.1    0x00007f1fc2f[26](https://github.com/chromium/subspace/actions/runs/6252318951/job/16975334258#step:7:27)cd6 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) + 54
1  libLLVM-18.so.1    0x00007f1fc2f24c90 llvm::sys::RunSignalHandlers() + 80
2  libLLVM-18.so.1    0x00007f1fc2e77470
3  libc.so.6          0x00007f1fc1a42520
4  libc.so.6          0x00007f1fc1a96a7c pthread_kill + 300
5  libc.so.6          0x00007f1fc1a42476 raise + 22
6  libc.so.6          0x00007f1fc1a287f3 abort + 211
7  libLLVM-18.so.1    0x00007f1fc2e853c4 llvm::report_bad_alloc_error(char const*, bool) + 132
8  libLLVM-18.so.1    0x00007f1fc2ec21f0 llvm::SmallVectorBase<unsigned int>::size() const + 0
9  libclang-cpp.so.18 0x00007f1fcaf98a74 llvm::SmallVectorImpl<std::pair<clang::Expr const*, llvm::PointerUnion<clang::Expr*, std::pair<clang::SourceLocation, llvm::StringRef>*>>>::operator=(llvm::SmallVectorImpl<std::pair<clang::Expr const*, llvm::PointerUnion<clang::Expr*, std::pair<clang::SourceLocation, llvm::StringRef>*>>> const&) + 68
10 libclang-cpp.so.18 0x00007f1fcaf917cb clang::Sema::CheckConstraintSatisfaction(clang::NamedDecl const*, llvm::ArrayRef<clang::Expr const*>, llvm::SmallVectorImpl<clang::Expr*>&, clang::MultiLevelTemplateArgumentList const&, clang::SourceRange, clang::ConstraintSatisfaction&) + 1995
11 libclang-cpp.so.18 0x00007f1fcb49bff7 clang::Sema::CheckConceptTemplateId(clang::CXXScopeSpec const&, clang::SourceLocation, clang::DeclarationNameInfo const&, clang::NamedDecl*, clang::ConceptDecl*, clang::TemplateArgumentListInfo const*) + 7[27](https://github.com/chromium/subspace/actions/runs/6252318951/job/16975334258#step:7:28)
12 libclang-cpp.so.18 0x00007f1fcb5a91b2
63 clang++-18         0x000055e22988d545
64 libclang-cpp.so.18 0x00007f1fcc060609
65 libLLVM-18.so.1    0x00007f1fc2e7720c llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) + 140
66 libclang-cpp.so.18 0x00007f1fcc05ff7e clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const + 366
67 libclang-cpp.so.18 0x00007f1fcc0[28](https://github.com/chromium/subspace/actions/runs/6252318951/job/16975334258#step:7:29)c51 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const + 897
68 libclang-cpp.so.18 0x00007f1fcc028e9e clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const + 142
69 libclang-cpp.so.18 0x00007f1fcc04477c clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) + 332
70 clang++-18         0x000055e2[29](https://github.com/chromium/subspace/actions/runs/6252318951/job/16975334258#step:7:30)88cea4 clang_main(int, char**, llvm::ToolContext const&) + 11252
71 clang++-18         0x000055e229899aa2 main + 50
72 libc.so.6          0x00007f1fc1a29d90
73 libc.so.6          0x00007f1fc1a29e40 __libc_start_main + 128
74 clang++-18         0x000055e229889f55 _start + 37
clang++-18: error: clang frontend command failed with exit code 134 (use -v to see invocation)
Ubuntu clang version 18.0.0 (++202[30](https://github.com/chromium/subspace/actions/runs/6252318951/job/16975334258#step:7:31)920042413+678c1f142c06-1~exp1~202309200425[33](https://github.com/chromium/subspace/actions/runs/6252318951/job/16975334258#step:7:34).1196)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
clang++-18: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang++-18: note: diagnostic msg: /tmp/lib-6aff51.cpp
clang++-18: note: diagnostic msg: /tmp/lib-6aff51.sh
clang++-18: note: diagnostic msg: 

********************

cc: @cor3ntin

[danakj]

crash.zip

Here's the dump files for one compilation step.

[danakj]

Breadcrumbs for later:

Does reproduce on 266630cffceefbe3b00f34ba8efcfba62259335e.
Does not reproduce on 4b5366c9512aa273a5272af1d833961e1ed156e7.

[danakj]

b2cd9db589335d5885c04df83003a623cf2f05ff is the first bad commit
commit b2cd9db589335d5885c04df83003a623cf2f05ff
Author: Takuya Shimizu <shimizu2486@gmail.com>
Date:   Mon Sep 18 18:14:44 2023 +0900

    [clang][Sema] Remove irrelevant diagnostics from constraint satisfaction failure
    
    BEFORE this patch, when clang handles constraints like C1 || C2 where C1 evaluates to false and C2 evaluates to true, it emitted irrelevant diagnostics about the falsity of C1.
    This patch removes the irrelevant diagnostic information generated during the evaluation of C1 if C2 evaluates to true.
    
    Fixes https://github.com/llvm/llvm-project/issues/54678
    
    Reviewed By: erichkeane
    Differential Revision: https://reviews.llvm.org/D157526

 clang/docs/ReleaseNotes.rst          |  3 +++
 clang/lib/Sema/SemaConcept.cpp       | 14 ++++++++++++++
 clang/test/SemaTemplate/concepts.cpp | 37 ++++++++++++++++++++++++++++++++++++
 3 files changed, 54 insertions(+)

@hazohelet

The crash starts from the fix for #54678.

[cor3ntin]

OH. DOH.
ConstraintSatisfaction.Details is a SmallVector, and we do a bunch of emplace_back on it which invalidate the iterators with which we then try to partially erase the vector. UB.

We missed it.

@hazohelet are you willing to work on a fix? Storing the original size instead of the current end would work.

@erichkeane for visibility.

[cor3ntin]

Specifically
b2cd9db#diff-280dd868d0927369dbe3f86ce0bf15565cf8acd9643e22e475e0d9156dc5f4b5R188

[erichkeane]

OH. DOH. ConstraintSatisfaction.Details is a SmallVector, and we do a bunch of emplace_back on it which invalidate the iterators with which we then try to partially erase the vector. UB.

We missed it.

@hazohelet are you willing to work on a fix? Storing the original size instead of the current end would work.

@erichkeane for visibility.

Urgh, yucky! Nicely done on the analysis. Its probably as simple as just changing EffectiveDetailEnd to be Satisfaction.details.size() and doing the offset math later.

[hazohelet]

Oh, thanks for the comments, and sorry for the inconvenience.
I'll make PR soon.