Skip to content

Conversation

Mr-Anyone
Copy link
Contributor

Prevent a crash in __builtin_function_start by adding a check for an invalid first parameter.

fixes #113323

@llvmbot llvmbot added clang Clang issues not falling into any other category clang:frontend Language frontend issues, e.g. anything involving "Sema" labels Aug 26, 2025
@llvmbot
Copy link
Member

llvmbot commented Aug 26, 2025

@llvm/pr-subscribers-clang

Author: Vincent (Mr-Anyone)

Changes

Prevent a crash in __builtin_function_start by adding a check for an invalid first parameter.

fixes #113323


Full diff: https://github.com/llvm/llvm-project/pull/155506.diff

3 Files Affected:

  • (modified) clang/docs/ReleaseNotes.rst (+2)
  • (modified) clang/lib/Sema/SemaChecking.cpp (+3)
  • (added) clang/test/SemaCXX/gh113323.cpp (+5)
diff --git a/clang/docs/ReleaseNotes.rst b/clang/docs/ReleaseNotes.rst
index 9a05eea9de8ac..9cd8a10b72c36 100644
--- a/clang/docs/ReleaseNotes.rst
+++ b/clang/docs/ReleaseNotes.rst
@@ -258,6 +258,8 @@ Bug Fixes in This Version
   targets that treat ``_Float16``/``__fp16`` as native scalar types. Previously
   the warning was silently lost because the operands differed only by an implicit
   cast chain. (#GH149967).
+- Fix crash in ``__builtin_function_start`` by checking for invalid
+  first parameter. (#GH113323).
 - Fixed a crash with incompatible pointer to integer conversions in designated
   initializers involving string literals. (#GH154046)
 - Clang now emits a frontend error when a function marked with the `flatten` attribute
diff --git a/clang/lib/Sema/SemaChecking.cpp b/clang/lib/Sema/SemaChecking.cpp
index 6e777fb9aec8e..d137ccb95d295 100644
--- a/clang/lib/Sema/SemaChecking.cpp
+++ b/clang/lib/Sema/SemaChecking.cpp
@@ -286,6 +286,9 @@ static bool BuiltinFunctionStart(Sema &S, CallExpr *TheCall) {
   if (S.checkArgCount(TheCall, 1))
     return true;
 
+  if(TheCall->getArg(0)->containsErrors())
+      return true;
+
   ExprResult Arg = S.DefaultFunctionArrayLvalueConversion(TheCall->getArg(0));
   if (Arg.isInvalid())
     return true;
diff --git a/clang/test/SemaCXX/gh113323.cpp b/clang/test/SemaCXX/gh113323.cpp
new file mode 100644
index 0000000000000..c753407b6932b
--- /dev/null
+++ b/clang/test/SemaCXX/gh113323.cpp
@@ -0,0 +1,5 @@
+// RUN: %clang_cc1 -fsyntax-only -verify %s
+
+int a() {} // expected-warning {{non-void function does not return a value}}
+constexpr void (*d)() = a; // expected-error {{cannot initialize a variable of type}}
+const void *f = __builtin_function_start(d);

Copy link

github-actions bot commented Aug 26, 2025

✅ With the latest revision this PR passed the C/C++ code formatter.

…irst parameter

Prevent a crash in __builtin_function_start by adding a check for an invalid first parameter.

fixes llvm#113323
@Mr-Anyone Mr-Anyone force-pushed the builtin-function-start branch from 3bb8b9f to 09779d0 Compare August 26, 2025 21:58
@shafik shafik requested a review from erichkeane August 27, 2025 18:22
@@ -286,6 +286,9 @@ static bool BuiltinFunctionStart(Sema &S, CallExpr *TheCall) {
if (S.checkArgCount(TheCall, 1))
return true;

if (TheCall->getArg(0)->containsErrors())
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

containsErrors only works when we have error-recovery (RecoveryExprs) eanbled. Can you write a test/make sure the behavior is acceptable as well for -fno-recovery-ast

@Mr-Anyone
Copy link
Contributor Author

@erichkeane Thanks for the review. I don't have merge access. It would be nice if you could merge it for me.

@erichkeane erichkeane merged commit ceec2e9 into llvm:main Aug 28, 2025
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
clang:frontend Language frontend issues, e.g. anything involving "Sema" clang Clang issues not falling into any other category
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[clang] __builtin_function_start got Assertion `!isValueDependent() && "Expression evaluator can't be called on a dependent expression."' failed.
3 participants