[clang-fuzzer] Crash in `llvm::APInt::APInt`

[gal1ium]

Hi, while testing clang by the fuzzing driver clang-fuzzer, it found a crashing case:

Version: 531fd45

Flags:

mkdir build
cd build
cmake -GNinja -DCMAKE_BUILD_TYPE=Release -DLLVM_ENABLE_PROJECTS="lld;clang;compiler-rt" ../llvm -DLLVM_ENABLE_ASSERTIONS=ON -DLLVM_BUILD_RUNTIME=Off -DLLVM_BUILD_INSTRUMENTED_COVERAGE=On -DCLANG_ENABLE_PROTO_FUZZER=ON
ninja clang-fuzzer

PoC:

nstexpr ool e(in0){switch(0)0=0:eturn t(

Reproduction:
./bin/clang-fuzzer ./poc

Crashing thread backtrace:

#0  0x00007ffff7a51e10 in __memmove_avx512_unaligned_erms (/lib/x86_64-linux-gnu/libc.so.6)
                       at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:873

#1  0x000055555d390b44 in llvm::APInt::APInt (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/llvm/include/llvm/ADT/APInt.h:180

#2  0x000055555d390b44 in llvm::APSInt::APSInt (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/llvm/include/llvm/ADT/APSInt.h:24

#3  0x000055555d390b44 in clang::Expr::EvaluateKnownConstInt (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/AST/ExprConstant.cpp:19018

#4  0x000055555d3de9eb in EvaluateSwitch (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/include/clang/AST/Stmt.h:1945

#5  0x000055555d3de9eb in EvaluateStmt (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/AST/ExprConstant.cpp:5941

#6  0x000055555d3db543 in EvaluateStmt (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/AST/ExprConstant.cpp:5700

#7  0x000055555d3ee388 in HandleFunctionCall (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/AST/ExprConstant.cpp:6745

#8  0x000055555d481909 in clang::Expr::isPotentialConstantExpr (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/AST/ExprConstant.cpp:19757

#9  0x000055555b14224a in CheckConstexprFunctionBody (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Sema/SemaDeclCXX.cpp:2545

#10 0x000055555b14224a in clang::Sema::CheckConstexprFunctionDefinition (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Sema/SemaDeclCXX.cpp:2001

#11 0x000055555af5eeff in clang::Sema::ActOnFinishFunctionBody (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Sema/SemaDecl.cpp:16803

#12 0x000055555a166d18 in clang::Parser::ParseFunctionStatementBody (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/include/clang/Sema/Ownership.h:204

#13 0x0000555559ffe009 in clang::Parser::ParseFunctionDefinition (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/Parser.cpp:1448

#14 0x000055555a05f588 in clang::Parser::ParseDeclGroup (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/ParseDecl.cpp:2265

#15 0x0000555559fea9b0 in clang::Parser::ParseDeclOrFunctionDefInternal (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/Parser.cpp:1187

#16 0x0000555559fec23b in clang::Parser::ParseDeclarationOrFunctionDefinition (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/Parser.cpp:1209

#17 0x000055555a0024f0 in clang::Parser::ParseExternalDeclaration (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/Parser.cpp:1032

#18 0x000055555a006d15 in clang::Parser::ParseTopLevelDecl (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/Parser.cpp:745

#19 0x000055555a0079a0 in clang::Parser::ParseFirstTopLevelDecl (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/Parser.cpp:601

#20 0x0000555559fbff86 in clang::ParseAST (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/ParseAST.cpp:169

#21 0x0000555559ec1b28 in clang::ASTFrontendAction::ExecuteAction (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Frontend/FrontendAction.cpp:1432

#22 0x00005555564f8aa2 in clang::CodeGenAction::ExecuteAction (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/CodeGen/CodeGenAction.cpp:1109

#23 0x0000555559ed30d2 in clang::FrontendAction::Execute (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Frontend/FrontendAction.cpp:1312

#24 0x0000555559da3af8 in clang::CompilerInstance::ExecuteAction (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Frontend/CompilerInstance.cpp:1003

#25 0x0000555559d46f8e in clang::tooling::FrontendActionFactory::runInvocation (fuzz-binaries/clang-fuzzer)
                       443: bool clang::tooling::FrontendActionFactory::runInvocation(this = (clang::tooling::FrontendActionFactory * const)0x5555617751b0, Invocation = (std::shared_ptr<clang::CompilerInvocation>)std::shared_ptr<clang::CompilerInvocation> (empty) = {get() = 0x0}, Files = (clang::FileManager *)0x5555617715d0, PCHContainerOps = (std::shared_ptr<clang::PCHContainerOperations>)std::shared_ptr<clang::PCHContainerOperations> (empty) = {get() = 0x0}, DiagConsumer = (clang::DiagnosticConsumer *)0x7fffffff9990) {
                       |||:
                       ---: }
                       at /usr/include/c++/9/bits/unique_ptr.h:154

#26 0x00005555564db128 in clang_fuzzer::HandleCXX (fuzz-binaries/clang-fuzzer)
                         23: void clang_fuzzer::HandleCXX(S = (const std::string &)"nstexpr ool e(in0){switch(0)0=0:eturn t(", FileName = (const char *)0x5555558e74b7 "./test.cc", ExtraArgs = (const std::vector<char const*, std::allocator<char const*> > &)std::vector of length 1, capacity 1 = {0x5555559613a3 "-O2"}) {
                       ||||:
                       1386:       template<typename _Yp, typename _Yp2 = typename remove_cv<_Yp>::type>
                       1387: 	typename enable_if<!__has_esft_base<_Yp2>::value>::type
                       1388: 	_M_enable_shared_from_this_with(_Yp*) noexcept
                       ||||:
                       ----: }
                       at /usr/include/c++/9/bits/shared_ptr_base.h:1388

#27 0x00005555564d3832 in LLVMFuzzerTestOneInput (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/tools/clang-fuzzer/ClangFuzzer.cpp:23

[tbaederr]

This asserts in EvaluateKnownConstInt:

clang: /home/tbaeder/code/llvm-project/clang/lib/AST/ExprConstant.cpp:19089: APSInt clang::Expr::EvaluateKnownConstInt(const ASTContext &) const: Assertion `!isValueDependent() && "Expression evaluator can't be called on a dependent expression."' failed.
    frame #5: 0x00007fffdbd422ce libclang-cpp.so.22.0git`clang::Expr::EvaluateKnownConstInt(this=0x00007e0f6ca57688, Ctx=0x00007e9f6c9e0200) const at ExprConstant.cpp:19088:3
    frame #6: 0x00007fffdbde95da libclang-cpp.so.22.0git`EvaluateSwitch(Result=0x00007bff6b9396c0, Info=0x00007bff6ba848e0, SS=0x00007e0f6ca57608) at ExprConstant.cpp:5455:32
    frame #7: 0x00007fffdbdd7b91 libclang-cpp.so.22.0git`EvaluateStmt(Result=0x00007bff6b9396c0, Info=0x00007bff6ba848e0, S=0x00007e0f6ca57608, Case=0x0000000000000000) at ExprConstant.cpp:5941:12
    frame #8: 0x00007fffdbdd450c libclang-cpp.so.22.0git`EvaluateStmt(Result=0x00007bff6b9396c0, Info=0x00007bff6ba848e0, S=0x00007e0f6ca577e8, Case=0x0000000000000000) at ExprConstant.cpp:5700:28
    frame #9: 0x00007fffdbd5107e libclang-cpp.so.22.0git`HandleFunctionCall(CallLoc=(ID = 3798), Callee=0x00007e0f6ca574d0, ObjectArg=0x0000000000000000, E=0x00007bff6ba84e50, Args=ArrayRef<const clang::Expr *> @ 0x00007bff6b939440, Call=CallRef @ 0x00007bff6b939420, Body=0x00007e0f6ca577e8, Info=0x00007bff6ba848e0, Result=0x00007bff6ba84ed0, ResultSlot=0x0000000000000000) at ExprConstant.cpp:6745:24
    frame #10: 0x00007fffdbd4f99f libclang-cpp.so.22.0git`clang::Expr::isPotentialConstantExpr(FD=0x00007e0f6ca574d0, Diags=0x00007bff6bbb7990) at ExprConstant.cpp:19840:5
    frame #11: 0x00007fffdf956848 libclang-cpp.so.22.0git`CheckConstexprFunctionBody(SemaRef=0x00007e8f6c9e5200, Dcl=0x00007e0f6ca574d0, Body=0x00007e0f6ca577e8, Kind=Diagnose) at SemaDeclCXX.cpp:2545:8
    frame #12: 0x00007fffdf952790 libclang-cpp.so.22.0git`clang::Sema::CheckConstexprFunctionDefinition(this=0x00007e8f6c9e5200, NewFD=0x00007e0f6ca574d0, Kind=Diagnose) at SemaDeclCXX.cpp:2001:10
    frame #13: 0x00007fffdf6b4837 libclang-cpp.so.22.0git`clang::Sema::ActOnFinishFunctionBody(this=0x00007e8f6c9e5200, dcl=0x00007e0f6ca574d0, Body=0x00007e0f6ca577e8, IsInstantiation=false, RetainFunctionScopeInfo=false) at SemaDecl.cpp:16803:12
    frame #14: 0x00007fffda18c409 libclang-cpp.so.22.0git`clang::Parser::ParseFunctionStatementBody(this=0x00007def6c9e2a80, Decl=0x00007e0f6ca574d0, BodyScope=0x00007bff6ba74ca0) at ParseStmt.cpp:2445:18
    frame #15: 0x00007fffda20b1ae libclang-cpp.so.22.0git`clang::Parser::ParseFunctionDefinition(this=0x00007def6c9e2a80, D=0x00007bff6bcfc0b0, TemplateInfo=0x00007bff6b979460, LateParsedAttrs=0x00007bff6bcfcee0) at Parser.cpp:1448:10
    frame #16: 0x00007fffd9e30475 libclang-cpp.so.22.0git`clang::Parser::ParseDeclGroup(this=0x00007def6c9e2a80, DS=0x00007bff6b9790a0, Context=File, Attrs=0x00007bff6b9789d0, TemplateInfo=0x00007bff6b979460, DeclEnd=0x0000000000000000, FRI=0x0000000000000000) at ParseDecl.cpp:2266:17

[llvmbot]

@llvm/issue-subscribers-clang-frontend

Author: None (gal1ium)

Hi, while testing clang by the fuzzing driver `clang-fuzzer`, it found a crashing case:

Version: 531fd45

Flags:

mkdir build
cd build
cmake -GNinja -DCMAKE_BUILD_TYPE=Release -DLLVM_ENABLE_PROJECTS="lld;clang;compiler-rt" ../llvm -DLLVM_ENABLE_ASSERTIONS=ON -DLLVM_BUILD_RUNTIME=Off -DLLVM_BUILD_INSTRUMENTED_COVERAGE=On -DCLANG_ENABLE_PROTO_FUZZER=ON
ninja clang-fuzzer

PoC:

nstexpr ool e(in0){switch(0)0=0:eturn t(

Reproduction:
./bin/clang-fuzzer ./poc

Crashing thread backtrace:

#<!-- -->0  0x00007ffff7a51e10 in __memmove_avx512_unaligned_erms (/lib/x86_64-linux-gnu/libc.so.6)
                       at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:873

#<!-- -->1  0x000055555d390b44 in llvm::APInt::APInt (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/llvm/include/llvm/ADT/APInt.h:180

#<!-- -->2  0x000055555d390b44 in llvm::APSInt::APSInt (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/llvm/include/llvm/ADT/APSInt.h:24

#<!-- -->3  0x000055555d390b44 in clang::Expr::EvaluateKnownConstInt (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/AST/ExprConstant.cpp:19018

#<!-- -->4  0x000055555d3de9eb in EvaluateSwitch (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/include/clang/AST/Stmt.h:1945

#<!-- -->5  0x000055555d3de9eb in EvaluateStmt (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/AST/ExprConstant.cpp:5941

#<!-- -->6  0x000055555d3db543 in EvaluateStmt (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/AST/ExprConstant.cpp:5700

#<!-- -->7  0x000055555d3ee388 in HandleFunctionCall (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/AST/ExprConstant.cpp:6745

#<!-- -->8  0x000055555d481909 in clang::Expr::isPotentialConstantExpr (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/AST/ExprConstant.cpp:19757

#<!-- -->9  0x000055555b14224a in CheckConstexprFunctionBody (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Sema/SemaDeclCXX.cpp:2545

#<!-- -->10 0x000055555b14224a in clang::Sema::CheckConstexprFunctionDefinition (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Sema/SemaDeclCXX.cpp:2001

#<!-- -->11 0x000055555af5eeff in clang::Sema::ActOnFinishFunctionBody (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Sema/SemaDecl.cpp:16803

#<!-- -->12 0x000055555a166d18 in clang::Parser::ParseFunctionStatementBody (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/include/clang/Sema/Ownership.h:204

#<!-- -->13 0x0000555559ffe009 in clang::Parser::ParseFunctionDefinition (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/Parser.cpp:1448

#<!-- -->14 0x000055555a05f588 in clang::Parser::ParseDeclGroup (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/ParseDecl.cpp:2265

#<!-- -->15 0x0000555559fea9b0 in clang::Parser::ParseDeclOrFunctionDefInternal (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/Parser.cpp:1187

#<!-- -->16 0x0000555559fec23b in clang::Parser::ParseDeclarationOrFunctionDefinition (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/Parser.cpp:1209

#<!-- -->17 0x000055555a0024f0 in clang::Parser::ParseExternalDeclaration (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/Parser.cpp:1032

#<!-- -->18 0x000055555a006d15 in clang::Parser::ParseTopLevelDecl (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/Parser.cpp:745

#<!-- -->19 0x000055555a0079a0 in clang::Parser::ParseFirstTopLevelDecl (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/Parser.cpp:601

#<!-- -->20 0x0000555559fbff86 in clang::ParseAST (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Parse/ParseAST.cpp:169

#<!-- -->21 0x0000555559ec1b28 in clang::ASTFrontendAction::ExecuteAction (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Frontend/FrontendAction.cpp:1432

#<!-- -->22 0x00005555564f8aa2 in clang::CodeGenAction::ExecuteAction (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/CodeGen/CodeGenAction.cpp:1109

#<!-- -->23 0x0000555559ed30d2 in clang::FrontendAction::Execute (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Frontend/FrontendAction.cpp:1312

#<!-- -->24 0x0000555559da3af8 in clang::CompilerInstance::ExecuteAction (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/lib/Frontend/CompilerInstance.cpp:1003

#<!-- -->25 0x0000555559d46f8e in clang::tooling::FrontendActionFactory::runInvocation (fuzz-binaries/clang-fuzzer)
                       443: bool clang::tooling::FrontendActionFactory::runInvocation(this = (clang::tooling::FrontendActionFactory * const)0x5555617751b0, Invocation = (std::shared_ptr&lt;clang::CompilerInvocation&gt;)std::shared_ptr&lt;clang::CompilerInvocation&gt; (empty) = {get() = 0x0}, Files = (clang::FileManager *)0x5555617715d0, PCHContainerOps = (std::shared_ptr&lt;clang::PCHContainerOperations&gt;)std::shared_ptr&lt;clang::PCHContainerOperations&gt; (empty) = {get() = 0x0}, DiagConsumer = (clang::DiagnosticConsumer *)0x7fffffff9990) {
                       |||:
                       ---: }
                       at /usr/include/c++/9/bits/unique_ptr.h:154

#<!-- -->26 0x00005555564db128 in clang_fuzzer::HandleCXX (fuzz-binaries/clang-fuzzer)
                         23: void clang_fuzzer::HandleCXX(S = (const std::string &amp;)"nstexpr ool e(in0){switch(0)0=0:eturn t(", FileName = (const char *)0x5555558e74b7 "./test.cc", ExtraArgs = (const std::vector&lt;char const*, std::allocator&lt;char const*&gt; &gt; &amp;)std::vector of length 1, capacity 1 = {0x5555559613a3 "-O2"}) {
                       ||||:
                       1386:       template&lt;typename _Yp, typename _Yp2 = typename remove_cv&lt;_Yp&gt;::type&gt;
                       1387: 	typename enable_if&lt;!__has_esft_base&lt;_Yp2&gt;::value&gt;::type
                       1388: 	_M_enable_shared_from_this_with(_Yp*) noexcept
                       ||||:
                       ----: }
                       at /usr/include/c++/9/bits/shared_ptr_base.h:1388

#<!-- -->27 0x00005555564d3832 in LLVMFuzzerTestOneInput (fuzz-binaries/clang-fuzzer)
                       at /src/llvm/clang/tools/clang-fuzzer/ClangFuzzer.cpp:23

[ecnelises]

Canonicalized case:

constexpr bool e() {
  switch (false) {
  0==0: return false;
  }
}

After adding case before 0==0, the crash disappears. Difference:

0==0:
CaseStmt 0x122829620
|-BinaryOperator 0x122829600 '_Bool' '=='
| |-IntegerLiteral 0x1231167c0 'int' 0
| `-IntegerLiteral 0x1231167e0 'int' 0
`-ReturnStmt 0x122829658
  `-CXXBoolLiteralExpr 0x122829648 '_Bool' false

case 0==0:
CaseStmt 0x13b132e58
|-ConstantExpr 0x13b132e38 'int'
| |-value: Int 1
| `-ImplicitCastExpr 0x13b132e20 'int' <IntegralCast>
|   `-BinaryOperator 0x13b132e00 '_Bool' '=='
|     |-IntegerLiteral 0x13b1167c0 'int' 0
|     `-IntegerLiteral 0x13b1167e0 'int' 0
`-ReturnStmt 0x13b132e90
  `-CXXBoolLiteralExpr 0x13b132e80 '_Bool' false

[tbaederr]

That's a different assertion though: https://godbolt.org/z/3cofanE34

clang++: /root/llvm-project/llvm/include/llvm/ADT/APSInt.h:176: bool llvm::APSInt::operator<=(const llvm::APSInt&) const: Assertion `IsUnsigned == RHS.IsUnsigned && "Signedness mismatch!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics -std=c++20 <source>
1.	<eof> parser at end of file
2.	<source>:1:20: parsing function body 'e'
 #0 0x0000000004239d18 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4239d18)
 #1 0x0000000004237144 llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4237144)
 #2 0x000000000417b398 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007ee083242520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007ee0832969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x00007ee083242476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007ee0832287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007ee08322871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #8 0x00007ee083239e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #9 0x0000000007c1575a EvaluateStmt((anonymous namespace)::StmtResult&, (anonymous namespace)::EvalInfo&, clang::Stmt const*, clang::SwitchCase const*) (.part.0) ExprConstant.cpp:0:0
#10 0x0000000007c14178 EvaluateStmt((anonymous namespace)::StmtResult&, (anonymous namespace)::EvalInfo&, clang::Stmt const*, clang::SwitchCase const*) (.part.0) ExprConstant.cpp:0:0
#11 0x0000000007c1ba0b HandleFunctionCall(clang::SourceLocation, clang::FunctionDecl const*, (anonymous namespace)::LValue const*, clang::Expr const*, llvm::ArrayRef<clang::Expr const*>, (anonymous namespace)::CallRef, clang::Stmt const*, (anonymous namespace)::EvalInfo&, clang::APValue&, (anonymous namespace)::LValue const*) ExprConstant.cpp:0:0
#12 0x0000000007c215d4 clang::Expr::isPotentialConstantExpr(clang::FunctionDecl const*, llvm::SmallVectorImpl<std::pair<clang::SourceLocation, clang::PartialDiagnostic>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7c215d4)
#13 0x0000000006da671e clang::Sema::CheckConstexprFunctionDefinition(clang::FunctionDecl const*, clang::Sema::CheckConstexprKind) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6da671e)
#14 0x0000000006d3177b clang::Sema::ActOnFinishFunctionBody(clang::Decl*, clang::Stmt*, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d3177b)
#15 0x0000000006a4c064 clang::Parser::ParseFunctionStatementBody(clang::Decl*, clang::Parser::ParseScope&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6a4c064)
#16 0x00000000069529fb clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::LateParsedAttrList*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x69529fb)
#17 0x0000000006988edd clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6988edd)
#18 0x00000000069461ae clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x69461ae)
#19 0x000000000694694f clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x694694f)