[clang] Fix Variable Length Array `_Countof` Crash #154627

Mr-Anyone · 2025-08-20T21:47:36Z

Check for missing VLA size expressions (e.g. in int a[*][10]) before evaluation to avoid crashes in _Countof and constant expression checks.

fixes #152826

llvmbot · 2025-08-20T21:48:11Z

@llvm/pr-subscribers-clang

Author: Vincent (Mr-Anyone)

Changes

Check for missing VLA size expressions (e.g. in int a[*][10]) before evaluation to avoid crashes in _Countof and constant expression checks.

fixes #152826

Full diff: https://github.com/llvm/llvm-project/pull/154627.diff

4 Files Affected:

(modified) clang/docs/ReleaseNotes.rst (+2)
(modified) clang/lib/AST/ByteCode/Compiler.cpp (+3-1)
(modified) clang/lib/AST/ExprConstant.cpp (+11-1)
(added) clang/test/Sema/gh152826.c (+6)

diff --git a/clang/docs/ReleaseNotes.rst b/clang/docs/ReleaseNotes.rst
index e88d68fa99664..df738db771e33 100644
--- a/clang/docs/ReleaseNotes.rst
+++ b/clang/docs/ReleaseNotes.rst
@@ -200,6 +200,8 @@ Bug Fixes in This Version
 -------------------------
 - Fix a crash when marco name is empty in ``#pragma push_macro("")`` or
   ``#pragma pop_macro("")``. (#GH149762).
+- Fix a crash in variable length array (e.g. int a[*]) function parameter type 
+  being used in `_Countof` expression. (#GH152826)
 - `-Wunreachable-code`` now diagnoses tautological or contradictory
   comparisons such as ``x != 0 || x != 1.0`` and ``x == 0 && x == 1.0`` on
   targets that treat ``_Float16``/``__fp16`` as native scalar types. Previously
diff --git a/clang/lib/AST/ByteCode/Compiler.cpp b/clang/lib/AST/ByteCode/Compiler.cpp
index e3235d34e230e..7881afc4bb6f5 100644
--- a/clang/lib/AST/ByteCode/Compiler.cpp
+++ b/clang/lib/AST/ByteCode/Compiler.cpp
@@ -2248,7 +2248,9 @@ bool Compiler<Emitter>::VisitUnaryExprOrTypeTraitExpr(
     assert(VAT);
     if (VAT->getElementType()->isArrayType()) {
       std::optional<APSInt> Res =
-          VAT->getSizeExpr()->getIntegerConstantExpr(ASTCtx);
+          VAT->getSizeExpr()
+              ? VAT->getSizeExpr()->getIntegerConstantExpr(ASTCtx)
+              : std::nullopt;
       if (Res) {
         if (DiscardResult)
           return true;
diff --git a/clang/lib/AST/ExprConstant.cpp b/clang/lib/AST/ExprConstant.cpp
index 9c87a88899647..1d939cf9655d4 100644
--- a/clang/lib/AST/ExprConstant.cpp
+++ b/clang/lib/AST/ExprConstant.cpp
@@ -15345,6 +15345,13 @@ bool IntExprEvaluator::VisitUnaryExprOrTypeTraitExpr(
     const auto *VAT = Info.Ctx.getAsVariableArrayType(Ty);
     assert(VAT);
     if (VAT->getElementType()->isArrayType()) {
+      // Variable array size expression could be missing (e.g. int a[*][10]) In
+      // that case, it can't be a constant expression
+      if (!VAT->getSizeExpr()) {
+        Info.FFDiag(E->getBeginLoc());
+        return false;
+      }
+
       std::optional<APSInt> Res =
           VAT->getSizeExpr()->getIntegerConstantExpr(Info.Ctx);
       if (Res) {
@@ -17867,7 +17874,10 @@ static ICEDiag CheckICE(const Expr* E, const ASTContext &Ctx) {
         // it is an ICE or not.
         const auto *VAT = Ctx.getAsVariableArrayType(ArgTy);
         if (VAT->getElementType()->isArrayType())
-          return CheckICE(VAT->getSizeExpr(), Ctx);
+          // Variable array size expression could be missing (e.g. int a[*][10])
+          // In that case, it can't be a constant expression
+          return VAT->getSizeExpr() ? CheckICE(VAT->getSizeExpr(), Ctx)
+                                    : ICEDiag(IK_NotICE, E->getBeginLoc());
 
         // Otherwise, this is a regular VLA, which is definitely not an ICE.
         return ICEDiag(IK_NotICE, E->getBeginLoc());
diff --git a/clang/test/Sema/gh152826.c b/clang/test/Sema/gh152826.c
new file mode 100644
index 0000000000000..a7d5f0138ad5d
--- /dev/null
+++ b/clang/test/Sema/gh152826.c
@@ -0,0 +1,6 @@
+// RUN: %clang_cc1 -std=c2y -verify %s
+// RUN: %clang_cc1 -std=c2y -verify -fexperimental-new-constant-interpreter %s
+// expected-no-diagnostics
+
+void gh152826(char (*a)[*][5], int (*x)[_Countof (*a)]);
+void more_likely_in_practice(unsigned long size_one, int (*a)[*][5], int b[_Countof(*a)]);

Sirraide · 2025-08-21T03:37:00Z

clang/test/Sema/gh152826.c

+// RUN: %clang_cc1 -std=c2y -verify -fexperimental-new-constant-interpreter %s
+// expected-no-diagnostics
+
+void gh152826(char (*a)[*][5], int (*x)[_Countof (*a)]);


Can you add a test for e.g.

void f(int x[*][1][*][2][*][*][3][*], int q[_Countof(*x)]);

to make sure we handle nested VLAs properly.

We should also add a codegen test to verify that we emit the correct LLVM IR to runtime evaluate the _Countof

to make sure we handle nested VLAs properly.

Sure.

We should also add a codegen test to verify that we emit the correct LLVM IR to runtime evaluate the _Countof

I am not sure how you would go about doing that. Because [*] seems to only appear in function prototypes and not definitions. godbolt

C23 6.7.7.4: If the function declarator is not part of a definition of that function, parameters [...] may use the [*] notation in their sequences of declarator specifiers to specify variable length array types.

I thought there was a way we could end up having to evaluate here, but now I think you're right, that doesn't seem to be possible. So nevermind! :-)

Sirraide · 2025-08-21T03:38:32Z

clang/docs/ReleaseNotes.rst

+- Fix a crash in variable length array (e.g. int a[*]) function parameter type 
+  being used in `_Countof` expression. (#GH152826)


Suggested change

- Fix a crash in variable length array (e.g. int a[*]) function parameter type

being used in `_Countof` expression. (#GH152826)

- Fix a crash in variable length array (e.g. ``int a[*]``) function parameter type

being used in ``_Countof`` expression. (#GH152826)

Also, RST...

AaronBallman · 2025-08-21T11:16:44Z

clang/lib/AST/ExprConstant.cpp

@@ -15345,6 +15345,13 @@ bool IntExprEvaluator::VisitUnaryExprOrTypeTraitExpr(
    const auto *VAT = Info.Ctx.getAsVariableArrayType(Ty);
    assert(VAT);
    if (VAT->getElementType()->isArrayType()) {
+      // Variable array size expression could be missing (e.g. int a[*][10]) In
+      // that case, it can't be a constant expression


Suggested change

// that case, it can't be a constant expression

// that case, it can't be a constant expression.

AaronBallman · 2025-08-21T11:18:38Z

clang/test/Sema/gh152826.c

+// RUN: %clang_cc1 -std=c2y -verify -fexperimental-new-constant-interpreter %s
+// expected-no-diagnostics
+
+void gh152826(char (*a)[*][5], int (*x)[_Countof (*a)]);


We should also add a codegen test to verify that we emit the correct LLVM IR to runtime evaluate the _Countof

AaronBallman

LGTM!

AaronBallman · 2025-08-22T12:47:48Z

clang/test/Sema/gh152826.c

+// RUN: %clang_cc1 -std=c2y -verify -fexperimental-new-constant-interpreter %s
+// expected-no-diagnostics
+
+void gh152826(char (*a)[*][5], int (*x)[_Countof (*a)]);


I thought there was a way we could end up having to evaluate here, but now I think you're right, that doesn't seem to be possible. So nevermind! :-)

yronglin · 2025-08-22T15:25:56Z

clang/docs/ReleaseNotes.rst

@@ -222,6 +222,8 @@ Bug Fixes in This Version
 -------------------------
 - Fix a crash when marco name is empty in ``#pragma push_macro("")`` or
  ``#pragma pop_macro("")``. (#GH149762).
+- Fix a crash in variable length array (e.g. ``int a[*]``) function parameter type 
+  being used in ``_Countof`` expression. (#GH152826)


Suggested change

being used in ``_Countof`` expression. (#GH152826)

being used in ``_Countof`` expression. (#GH152826).

yronglin · 2025-08-22T15:26:14Z

clang/test/Sema/gh152826.c

+// RUN: %clang_cc1 -std=c2y -verify -fexperimental-new-constant-interpreter %s
+// expected-no-diagnostics
+
+void gh152826(char (*a)[*][5], int (*x)[_Countof (*a)]);


Suggested change

void gh152826(char (*a)[*][5], int (*x)[_Countof (*a)]);

void gh152826(char (*a)[*][5], int (*x)[_Countof(*a)]);

Check for missing VLA size expressions (e.g. in int a[*][10]) before evaluation to avoid crashes in _Countof and constant expression checks. fixes llvm#152826

Mr-Anyone · 2025-08-25T17:05:59Z

LGTM!

Thanks for the review. I don't have merge access. It would be nice if you can merge this for me. Thanks

llvmbot added clang Clang issues not falling into any other category clang:frontend Language frontend issues, e.g. anything involving "Sema" clang:bytecode Issues for the clang bytecode constexpr interpreter labels Aug 20, 2025

Sirraide reviewed Aug 21, 2025

View reviewed changes

Sirraide requested a review from AaronBallman August 21, 2025 03:39

AaronBallman reviewed Aug 21, 2025

View reviewed changes

Mr-Anyone force-pushed the fix_ice_countof branch 2 times, most recently from a2064bc to cd9e0fb Compare August 21, 2025 19:24

Mr-Anyone requested review from AaronBallman and Sirraide August 21, 2025 19:53

AaronBallman approved these changes Aug 22, 2025

View reviewed changes

yronglin reviewed Aug 22, 2025

View reviewed changes

Mr-Anyone force-pushed the fix_ice_countof branch from d4190aa to 2c8b558 Compare August 25, 2025 15:43

Mr-Anyone added 3 commits August 25, 2025 12:21

[clang] Fix Variable Length Array _Countof Crash

e58c0ae

Check for missing VLA size expressions (e.g. in int a[*][10]) before evaluation to avoid crashes in _Countof and constant expression checks. fixes llvm#152826

Address Comments

e5430cb

Formatting

67afe21

Mr-Anyone force-pushed the fix_ice_countof branch from 18fe45c to 67afe21 Compare August 25, 2025 16:22

Sirraide merged commit fefdb49 into llvm:main Aug 25, 2025
10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[clang] Fix Variable Length Array `_Countof` Crash #154627

[clang] Fix Variable Length Array `_Countof` Crash #154627

Uh oh!

Mr-Anyone commented Aug 20, 2025

Uh oh!

llvmbot commented Aug 20, 2025

Uh oh!

Sirraide Aug 21, 2025

Uh oh!

AaronBallman Aug 21, 2025

Uh oh!

Mr-Anyone Aug 21, 2025

Uh oh!

AaronBallman Aug 22, 2025

Uh oh!

Sirraide Aug 21, 2025

Uh oh!

AaronBallman Aug 21, 2025

Uh oh!

AaronBallman Aug 21, 2025

Uh oh!

AaronBallman left a comment

Uh oh!

AaronBallman Aug 22, 2025

Uh oh!

yronglin Aug 22, 2025

Uh oh!

yronglin Aug 22, 2025

Uh oh!

Mr-Anyone commented Aug 25, 2025

Uh oh!

Uh oh!

Uh oh!

		- Fix a crash in variable length array (e.g. int a[*]) function parameter type
		being used in `_Countof` expression. (#GH152826)

	// that case, it can't be a constant expression
	// that case, it can't be a constant expression.

	being used in ``_Countof`` expression. (#GH152826)
	being used in ``_Countof`` expression. (#GH152826).

	void gh152826(char (a)[][5], int (x)[_Countof (a)]);
	void gh152826(char (a)[][5], int (x)[_Countof(a)]);

[clang] Fix Variable Length Array _Countof Crash #154627

[clang] Fix Variable Length Array _Countof Crash #154627

Uh oh!

Conversation

Mr-Anyone commented Aug 20, 2025

Uh oh!

llvmbot commented Aug 20, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AaronBallman left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mr-Anyone commented Aug 25, 2025

Uh oh!

Uh oh!

Uh oh!

[clang] Fix Variable Length Array `_Countof` Crash #154627

[clang] Fix Variable Length Array `_Countof` Crash #154627