Bitfield followed by byte generates incorrect layout

[fitzgen]

This bug was found with csmith and driver.py.

Input Header

#include "csmith.h"
struct S0 {
  unsigned a : 18;
  uint8_t b
};

bindgen Invocation

$ './predicate.py' '--bindgen-args' '--with-derive-partialeq --with-derive-eq --with-derive-partialord --with-derive-ord --with-derive-hash --with-derive-default --  -I/home/fitzgen/rust-bindgen/csmith-fuzzing' '/tmp/input-xv0syy_e.h'

Actual Results

Running: ['cargo', 'run', '--manifest-path', '/home/fitzgen/rust-bindgen/Cargo.toml', '--', '/tmp/input-xv0syy_e.h', '-o', '/tmp/bindings-7114vw_z.rs', '--with-derive-partialeq', '--with-derive-eq', '--with-derive-partialord', '--with-derive-ord', '--with-derive-hash', '--with-derive-default', '--', '-I/home/fitzgen/rust-bindgen/csmith-fuzzing']
Running: ['rustc', '--crate-type', 'lib', '--test', '-o', '/tmp/layout-tests-8b6cwat7', '/tmp/bindings-7114vw_z.rs']
Running: ['/tmp/layout-tests-8b6cwat7']
Error: running the compiled bindings' layout tests failed
+
+running 1 test
+test bindgen_test_layout_S0 ... FAILED
+
+failures:
+
+---- bindgen_test_layout_S0 stdout ----
+	thread 'bindgen_test_layout_S0' panicked at 'assertion failed: `(left == right)`
+  left: `28`,
+ right: `27`: Alignment of field: S0::f7', /tmp/bindings-7114vw_z.rs:63:4
+stack backtrace:
+   0:     0x5621c247b3f3 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::h01d72f0a62d8a293
+                               at /checkout/src/libstd/sys/unix/backtrace/tracing/gcc_s.rs:49
+   1:     0x5621c2477890 - std::sys_common::backtrace::_print::ha5c244343953c306
+                               at /checkout/src/libstd/sys_common/backtrace.rs:69
+   2:     0x5621c247d5c3 - std::panicking::default_hook::{{closure}}::ha507f7ee3f268654
+                               at /checkout/src/libstd/sys_common/backtrace.rs:58
+                               at /checkout/src/libstd/panicking.rs:381
+   3:     0x5621c247d2cd - std::panicking::default_hook::h0bd1e90db74e51c1
+                               at /checkout/src/libstd/panicking.rs:391
+   4:     0x5621c247da57 - std::panicking::rust_panic_with_hook::h8827707ea7fb4f2e
+                               at /checkout/src/libstd/panicking.rs:577
+   5:     0x5621c247d92c - std::panicking::begin_panic::hae4d57af0eb0970f
+                               at /checkout/src/libstd/panicking.rs:538
+   6:     0x5621c247d849 - std::panicking::begin_panic_fmt::hce3f0595cc6d59b5
+                               at /checkout/src/libstd/panicking.rs:522
+   7:     0x5621c2433cb5 - bindings_7114vw_z::bindgen_test_layout_S0::he307c8ad0667cfe5
+   8:     0x5621c2436281 - _ZN42_$LT$F$u20$as$u20$test..FnBox$LT$T$GT$$GT$8call_box17hba13966348d214c1E.llvm.28ED763B
+                               at /checkout/src/libtest/lib.rs:1480
+                               at /checkout/src/libcore/ops/function.rs:223
+                               at /checkout/src/libtest/lib.rs:141
+   9:     0x5621c24862ee - __rust_maybe_catch_panic
+                               at /checkout/src/libpanic_unwind/lib.rs:99
+  10:     0x5621c244e002 - std::sys_common::backtrace::__rust_begin_short_backtrace::h2db8fe1321f974b8
+                               at /checkout/src/libstd/panicking.rs:459
+                               at /checkout/src/libstd/sys_common/backtrace.rs:134
+  11:     0x5621c2456822 - _ZN3std9panicking3try7do_call17h46a5a639dc80bfafE.llvm.5969E65D
+                               at /checkout/src/libstd/thread/mod.rs:402
+                               at /checkout/src/libstd/panic.rs:296
+                               at /checkout/src/libstd/panicking.rs:480
+  12:     0x5621c24862ee - __rust_maybe_catch_panic
+                               at /checkout/src/libpanic_unwind/lib.rs:99
+  13:     0x5621c2441eed - _ZN50_$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$8call_box17h922dfa2107d2042fE.llvm.353AA57A
+                               at /checkout/src/libstd/panicking.rs:459
+                               at /checkout/src/liballoc/boxed.rs:762
+  14:     0x5621c247c9fb - std::sys::imp::thread::Thread::new::thread_start::h895f63ee95e34b51
+                               at /checkout/src/liballoc/boxed.rs:772
+                               at /checkout/src/libstd/sys_common/thread.rs:24
+                               at /checkout/src/libstd/sys/unix/thread.rs:90
+  15:     0x7f673c2c16d9 - start_thread
+  16:     0x7f673bde4d7e - __clone
+  17:                0x0 - <unknown>
+
+
+failures:
+    bindgen_test_layout_S0
+
+test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out
+

Expected Results

bindgen emits bindings OK, then rustc compiles those bindings OK, then the
compiled bindings' layout tests pass OK.

[fitzgen]

For posterity, the pre-creduce test case:

/*
 * This is a RANDOMLY GENERATED PROGRAM.
 *
 * Generator: csmith 2.2.0
 * Git version: dcef523
 * Options:   -o /tmp/input-xv0syy_e.h --no-packed-struct --no-checksum --nomain --max-block-size 1 --max-block-depth 1
 * Seed:      3842921704
 */

#include "csmith.h"

volatile uint64_t csmith_sink_ = 0;

static long __undefined;

/* --- Struct/Union Declarations --- */
struct S0 {
   int64_t  f0;
   const int16_t  f1;
   uint16_t  f2;
   volatile uint32_t  f3;
   uint8_t  f4;
   volatile uint32_t  f5;
   unsigned f6 : 18;
   uint8_t  f7;
   uint16_t  f8;
};

/* --- GLOBAL VARIABLES --- */
static volatile int32_t g_2 = (-9L);/* VOLATILE GLOBAL g_2 */
static volatile int32_t g_3 = 6L;/* VOLATILE GLOBAL g_3 */
static volatile int32_t g_4[2][9] = {{9L,9L,9L,9L,9L,9L,9L,9L,9L},{0xBE56890CL,0xC407858FL,0xBE56890CL,0xC407858FL,0xBE56890CL,0xC407858FL,0xBE56890CL,0xC407858FL,0xBE56890CL}};
static int32_t g_5 = 0x74B28ED4L;
static struct S0 g_11 = {0xFD81438367457993LL,0x3C7DL,0x4B5EL,7UL,0x61L,0xE360DE57L,84,0x31L,0UL};/* VOLATILE GLOBAL g_11 */


/* --- FORWARD DECLARATIONS --- */
static struct S0  func_1(void);


/* --- FUNCTIONS --- */
/* ------------------------------------------ */
/* 
 * reads : g_5 g_11
 * writes: g_5
 */
static struct S0  func_1(void)
{ /* block id: 0 */
    for (g_5 = 0; (g_5 >= 7); g_5 = safe_add_func_uint32_t_u_u(g_5, 8))
    { /* block id: 3 */
        int32_t *l_8 = &g_5;
        int32_t **l_9 = (void*)0;
        int32_t **l_10 = &l_8;
        (*l_10) = l_8;
    }
    return g_11;
}



/************************ statistics *************************
XXX max struct depth: 1
breakdown:
   depth: 0, occurrence: 1
   depth: 1, occurrence: 1
XXX total union variables: 0

XXX non-zero bitfields defined in structs: 1
XXX zero bitfields defined in structs: 0
XXX const bitfields defined in structs: 0
XXX volatile bitfields defined in structs: 0
XXX structs with bitfields in the program: 1
breakdown:
   indirect level: 0, occurrence: 1
XXX full-bitfields structs in the program: 0
breakdown:
XXX times a bitfields struct's address is taken: 0
XXX times a bitfields struct on LHS: 0
XXX times a bitfields struct on RHS: 1
XXX times a single bitfield on LHS: 0
XXX times a single bitfield on RHS: 0

XXX max expression depth: 2
breakdown:
   depth: 1, occurrence: 3
   depth: 2, occurrence: 1

XXX total number of pointers: 3

XXX times a variable address is taken: 2
XXX times a pointer is dereferenced on RHS: 0
breakdown:
XXX times a pointer is dereferenced on LHS: 1
breakdown:
   depth: 1, occurrence: 1
XXX times a pointer is compared with null: 0
XXX times a pointer is compared with address of another variable: 0
XXX times a pointer is compared with another pointer: 0
XXX times a pointer is qualified to be dereferenced: 0

XXX max dereference level: 1
breakdown:
   level: 0, occurrence: 0
   level: 1, occurrence: 1
XXX number of pointers point to pointers: 2
XXX number of pointers point to scalars: 1
XXX number of pointers point to structs: 0
XXX percent of pointers has null in alias set: 33.3
XXX average alias set size: 1

XXX times a non-volatile is read: 3
XXX times a non-volatile is write: 3
XXX times a volatile is read: 0
XXX    times read thru a pointer: 0
XXX times a volatile is write: 0
XXX    times written thru a pointer: 0
XXX times a volatile is available for access: 3
XXX percentage of non-volatile access: 100

XXX forward jumps: 0
XXX backward jumps: 0

XXX stmts: 3
XXX max block depth: 1
breakdown:
   depth: 0, occurrence: 2
   depth: 1, occurrence: 1

XXX percentage a fresh-made variable is used: 100
XXX percentage an existing variable is used: 0
FYI: the random generator makes assumptions about the integer size. See platform.info for more details.
********************* end of statistics **********************/

[pvdrz]

both headers pass the layout tests in my machine. Could I be missing something @fitzgen?