CGCollector segfaults in `addCalledDecl`, if caller is null

[sebastiankreutzer]

I ran into a segfault when trying to run CGCollector on a simple test case:

#include <vector>
#include <iostream>

int main(int argc, char** argv) {
  std::vector<int> v;
  v.push_back(argc);

  std::cout << "Hello world!" << std::endl;
  return 0;
}

Invocation: cgcollector --capture-ctors-dtors --extra-arg=-I/opt/modules/packages/llvm/devel-xray-dso/lib/clang/20/include --metacg-format-version=2 /home/sebastian/git/capi/test/selection/artificial/02_stdheader_incl.cpp

Here is the relevant part of the stack trace:

Program received signal SIGSEGV, Segmentation fault.
CGBuilder::addCalledDecl (this=this@entry=0x7fffffffc1b8, Caller=Caller@entry=0x0, Callee=0xe8ec90, C=C@entry=0x0) at /home/sebastian/git/MetaCG-Gitlab/cgcollector/lib/src/CallGraph.cpp:789
warning: Source file is more recent than executable.
789	    if (!CallGraph::includeInGraph(Caller) || !CallGraph::includeInGraph(Callee))
(gdb) bt
#0  CGBuilder::addCalledDecl (this=this@entry=0x7fffffffc1b8, Caller=Caller@entry=0x0, Callee=0xe8ec90, C=C@entry=0x0) at /home/sebastian/git/MetaCG-Gitlab/cgcollector/lib/src/CallGraph.cpp:789
#1  0x00007ffff4d97ca8 in CGBuilder::VisitLambdaExpr (this=0x7fffffffc1b8, LE=0xe8fa20) at /home/sebastian/git/MetaCG-Gitlab/cgcollector/lib/src/CallGraph.cpp:960

I should note that this is with Clang 20, which we don't officially support yet.
Putting this here so that we can fix it a later time. I haven't tried with CGC2 yet.

[jplehr]

Thank you for reporting. I wonder where/when that CGBuilder::VisitLambdaExpr gets triggered.

[sebastiankreutzer]

The offending function is in basic_string.h

_GLIBCXX_NODISCARD
   inline string
   to_string(int __val)
 #if _GLIBCXX_USE_CXX11_ABI && (__CHAR_BIT__ * __SIZEOF_INT__) <= 32
   noexcept // any 32-bit value fits in the SSO buffer
 #endif
   {
     const bool __neg = __val < 0;
     const unsigned __uval = __neg ? (unsigned)~__val + 1u : __val;
     const auto __len = __detail::__to_chars_len(__uval);
     string __str;
     __str.__resize_and_overwrite(__neg + __len, [=](char* __p, size_t __n) {
       __p[0] = '-';
       __detail::__to_chars_10_impl(__p + (int)__neg, __len, __uval);
       return __n;
     });
     return __str;
   }

[TimHeldmann]

This was fixed for CGC2 in PR 101.
The reproducer was added to CGC2's test suite.

[jplehr]

So this can be closed?

[TimHeldmann]

This was originally raised as a bugreport towards classic cgc, for which I don't think this is fixed yet.
If we decide, that we do not backport this fix to classic cgc, this can be closed.

[jplehr]

I think we should move forward with cgc2 only and not backport