ziglang/zig
262
5.9k
Fork
You've already forked zig
756

LLVM codegen emits bool params without zeroext leading to UB in foreign functions #35373

Closed
opened 2026年05月20日 20:35:23 +02:00 by vyivel · 2 comments

Zig Version

0.16.0

Steps to Reproduce and Observed Behavior

Somewhat related: https://github.com/ziglang/zig/issues/7639


  1. Build a shared library using GCC (not clang), then build and run a Zig program linked to it using the LLVM codegen backend:

func.c:

// gcc func.c -o libfunc.so -fpic -shared

#include <stdbool.h>#include <stdio.h>#include <inttypes.h>
void func(bool v) {
 printf("func: %" PRIu32 "\n", (uint32_t)v);
}

main.zig:

// zig run main.zig -L. -lfunc -lc -fllvmconststd=@import("std");externfnfunc(v:bool)void;pubconstEdges=packedstruct(u32){top:bool=false,bottom:bool=false,left:bool=false,right:bool=false,_:u28=0,};pubfnmain(init:std.process.Init)void{// avoid comptime shenanigansconstn=init.minimal.args.vector.len;constedges:Edges=.{.top=n!=10,.bottom=n!=11,.left=n!=12,.right=n!=13,};func(edges.top);func(edges.bottom);func(edges.left);func(edges.right);}
  1. Observe that func() reports invalid bool values, which is UB in C:
func: 15
func: 7
func: 3
func: 1

The emitted IR declares and calls func() without any parameter attributes:

 $ rg 'call void @func' < main.ll
declare void @func(i1) #0 align 1
 call void @func(i1 %54), !dbg !82391
 call void @func(i1 %57), !dbg !82393
 call void @func(i1 %60), !dbg !82395
 call void @func(i1 %63), !dbg !82397

In comparison, clang uses zeroext when emitting IR for a C program equivalent to main.zig:

$ rg 'void @func' < main.ll
 call void @func(i1 noundef zeroext %39)
 call void @func(i1 noundef zeroext %43)
 call void @func(i1 noundef zeroext %47)
 call void @func(i1 noundef zeroext %51)
declare void @func(i1 noundef zeroext) #1

Expected Behavior

Expected output:

func: 1
func: 1
func: 1
func: 1
### Zig Version 0.16.0 ### Steps to Reproduce and Observed Behavior Somewhat related: https://github.com/ziglang/zig/issues/7639 --- 1. Build a shared library using GCC (not clang), then build and run a Zig program linked to it using the LLVM codegen backend: `func.c`: ```c // gcc func.c -o libfunc.so -fpic -shared #include <stdbool.h> #include <stdio.h> #include <inttypes.h> void func(bool v) { printf("func: %" PRIu32 "\n", (uint32_t)v); } ``` `main.zig`: ```zig // zig run main.zig -L. -lfunc -lc -fllvm const std = @import("std"); extern fn func(v: bool) void; pub const Edges = packed struct(u32) { top: bool = false, bottom: bool = false, left: bool = false, right: bool = false, _: u28 = 0, }; pub fn main(init: std.process.Init) void { // avoid comptime shenanigans const n = init.minimal.args.vector.len; const edges: Edges = .{ .top = n != 10, .bottom = n != 11, .left = n != 12, .right = n != 13, }; func(edges.top); func(edges.bottom); func(edges.left); func(edges.right); } ``` 2. Observe that `func()` reports invalid `bool` values, which is UB in C: ```plain func: 15 func: 7 func: 3 func: 1 ``` The emitted IR declares and calls `func()` without any parameter attributes: ```plain $ rg 'call void @func' < main.ll declare void @func(i1) #0 align 1 call void @func(i1 %54), !dbg !82391 call void @func(i1 %57), !dbg !82393 call void @func(i1 %60), !dbg !82395 call void @func(i1 %63), !dbg !82397 ``` In comparison, clang uses `zeroext` when emitting IR for a C program equivalent to `main.zig`: ```plain $ rg 'void @func' < main.ll call void @func(i1 noundef zeroext %39) call void @func(i1 noundef zeroext %43) call void @func(i1 noundef zeroext %47) call void @func(i1 noundef zeroext %51) declare void @func(i1 noundef zeroext) #1 ``` ### Expected Behavior Expected output: ```plain func: 1 func: 1 func: 1 func: 1 ```
Contributor
Copy link

Updated my project to 0.16 and hit this too. Seems to affect any extern call. Wasm for example here.

conststd=@import("std");constPresentation=enum(u8){dont_care=0,fixed=1,fullscreen=2,_,};externfnset_fullscreen(bool)void;exportfnwasm_main()void{constcases:[]constPresentation=&.{.dont_care,.fixed,.fullscreen};for(cases)|presentation|{switch(presentation){.dont_care,.fixed=>set_fullscreen(false),.fullscreen=>set_fullscreen(true),_=>return,}}}
<!doctype html>
<html lang='en'>
 <head>
 <meta charset='utf-8'>
 <meta name='viewport' content='width=device-width, initial-scale=1.0'>
 <title>bug</title>
 </head>
 <body>
 <script type='module' defer>
 const mod = await WebAssembly.instantiateStreaming(fetch('bug.wasm'), {
 env: {
 set_fullscreen(toggle) {
 console.log(`set_fullscreen: ${toggle}`);
 }
 },
 });
 mod.instance.exports.wasm_main();
 </script>
 </body>
</html>
zig build-exe -target wasm32-freestanding -O ReleaseSmall -fno-entry -rdynamic bug.zig
nix run nixpkgs#webfs -- -4Fd

and open browser in http://localhost:8000/index.html and check your console

Updated my project to 0.16 and hit this too. Seems to affect any extern call. Wasm for example here. ```zig const std = @import("std"); const Presentation = enum(u8) { dont_care = 0, fixed = 1, fullscreen = 2, _, }; extern fn set_fullscreen(bool) void; export fn wasm_main() void { const cases: []const Presentation = &.{ .dont_care, .fixed, .fullscreen }; for (cases) |presentation| { switch (presentation) { .dont_care, .fixed => set_fullscreen(false), .fullscreen => set_fullscreen(true), _ => return, } } } ``` ```html <!doctype html> <html lang='en'> <head> <meta charset='utf-8'> <meta name='viewport' content='width=device-width, initial-scale=1.0'> <title>bug</title> </head> <body> <script type='module' defer> const mod = await WebAssembly.instantiateStreaming(fetch('bug.wasm'), { env: { set_fullscreen(toggle) { console.log(`set_fullscreen: ${toggle}`); } }, }); mod.instance.exports.wasm_main(); </script> </body> </html> ``` ```sh zig build-exe -target wasm32-freestanding -O ReleaseSmall -fno-entry -rdynamic bug.zig nix run nixpkgs#webfs -- -4Fd ``` and open browser in http://localhost:8000/index.html and check your console
ifreund added this to the 0.17.0 milestone 2026年05月21日 08:43:15 +02:00

I almost certainly regressed this in #31091. Will take a look.

I almost certainly regressed this in https://codeberg.org/ziglang/zig/pulls/31091. Will take a look.
alexrp removed their assignment 2026年05月21日 23:04:19 +02:00
Sign in to join this conversation.
No Branch/Tag specified
master
elfv2
spork8
restricted
0.16.x
panic-rewrite
parking-futex-lockfree
windows-Io-cleanup
Io-watch
ParseCommandLineOptions
windows-async-files
poll-ring
debug-file-leaks-differently
debug-file-leaks
ProcessPrng
elfv2-dyn
jobserver
threadtheft
io-threaded-no-queue
0.15.x
Io.net
comptime-allocator
restricted-function-pointers
cli
wasm-linker-writer
wrangle-writer-buffering
sha1-stream
async-await-demo
fixes
0.14.x
ast-node-methods
macos-debug-info
make-vs-configure
fuzz-macos
sans-aro
ArrayList-reserve
incr-bug
llvm-ir-nosanitize-metadata
ci-tarballs
ci-scripts
threadpool
0.12.x
new-pkg-hash
json-diagnostics
more-doctests
rework-comptime-mutation
0.11.x
ci-perf-comment
stage2-async
0.10.x
autofix
0.9.x
aro
hcs
0.8.x
0.7.x
0.16.0
0.15.2
0.15.1
0.15.0
0.14.1
0.14.0
0.12.1
0.13.0
0.12.0
0.11.0
0.10.1
0.10.0
0.9.1
0.9.0
0.8.1
0.8.0
0.7.1
0.7.0
0.6.0
0.5.0
0.4.0
0.3.0
0.2.0
0.1.1
0.1.0
Labels
Clear labels
abi/f32
abi/ilp32
abi/sf
accepted
This proposal is planned.
arch/21k
arch/6502
arch/aarch64
arch/alpha
arch/amdgcn
arch/arc
arch/arc32
arch/arc64
arch/arm
arch/avr
arch/bfin
arch/bpf
arch/colossus
arch/cris
arch/csky
arch/dlx
arch/epiphany
arch/fr30
arch/frv
arch/hexagon
arch/hppa
arch/hppa64
arch/ia64
arch/kalimba
arch/kvx
arch/lanai
arch/lm32
arch/loongarch32
arch/loongarch64
arch/m32r
arch/m68k
arch/m88k
arch/mcore
arch/microblaze
arch/mips
arch/mips64
arch/mmix
arch/moxie
arch/mrisc32
arch/msp430
arch/nds32
arch/ns32k
arch/nvptx
arch/or1k
arch/powerpc
arch/powerpc64
arch/propeller
arch/riscv32
arch/riscv64
arch/rl78
arch/rx
arch/s390x
arch/sh
arch/sparc
arch/sparc64
arch/spirv
arch/spu
arch/tricore
arch/v850
arch/vax
arch/vc4
arch/ve
arch/wasm
arch/x86
arch/x86_64
arch/xcore
arch/xtensa
autodoc
The web application for interactive documentation and generation of its assets.
backend/c
The C backend outputs C source code.
backend/llvm
The LLVM backend outputs an LLVM bitcode module.
backend/self-hosted
The self-hosted backends produce machine code directly.
binutils
Zig's included binary utilities: zig ar, zig dlltool, zig lib, zig ranlib, zig objcopy, and zig rc.
breaking
Implementing this issue could cause existing code to no longer compile or have different behavior.
build system
The Zig build system - zig build, std.Build, the build runner, and package management.
debug info
An issue related to debug information (e.g. DWARF) produced by the Zig compiler.
docs
An issue with documentation, e.g. the language reference or standard library doc comments.
error message
This issue points out an error message that is unhelpful and should be improved.
frontend
Tokenization, parsing, AstGen, ZonGen, Sema, Legalize, and Liveness.
fuzzing
An issue related to Zig's integrated fuzz testing.
incremental
Reuse of internal compiler state for faster compilation.
lib/c
This issue relates to Zig's libc implementation and/or vendored libcs.
lib/compiler-rt
This issue relates to Zig's compiler-rt library.
lib/cxx
This issue relates to Zig's vendored libc++ and/or libc++abi.
lib/std
This issue relates to Zig's standard library.
lib/tsan
This issue relates to Zig's vendored libtsan.
lib/ubsan-rt
This issue relates to Zig's ubsan-rt library.
lib/unwind
This issue relates to Zig's vendored libunwind.
linking
Zig's integrated object file and incremental linker.
miscompilation
The compiler reports success but produces semantically incorrect code.
os/android
os/contiki
os/dragonfly
os/driverkit
os/emscripten
os/freebsd
os/fuchsia
os/haiku
os/hermit
os/hurd
os/illumos
os/ios
os/linux
os/maccatalyst
os/macos
os/managarm
os/netbsd
os/ohos
os/openbsd
os/plan9
os/redox
os/rtems
os/serenity
os/tvos
os/uefi
os/visionos
os/wasi
os/watchos
os/windows
proposal
This issue suggests language modifications. If it also has the "accepted" label then it is planned.
release notes
This issue or pull request should be mentioned in the release notes.
testing
This issue is related to testing the compiler, standard library, or other parts of Zig.
zig cc
Zig as a drop-in C-family compiler.
zig fmt
The Zig source code formatter.
zig reduce
The Zig source code reduction tool.
bounty
https://ziglang.org/news/announcing-donor-bounties
bug
Observed behavior contradicts documented or intended behavior.
contributor-friendly
This issue is limited in scope and/or knowledge of project internals.
downstream
An issue with a third-party project that uses this project.
enhancement
Solving this issue will likely involve adding new logic or components to the codebase.
infra
An issue related to project infrastructure, e.g. continuous integration.
optimization
A task to improve performance and/or resource usage.
question
No questions on the issue tracker; use a community space instead.
regression
Something that used to work in a previous version stopped working
upstream
An issue with a third-party project that this project uses.
use case
Describes a real use case that is difficult or impossible, but does not propose a solution.
No labels
abi/f32
abi/ilp32
abi/sf
accepted
arch/21k
arch/6502
arch/aarch64
arch/alpha
arch/amdgcn
arch/arc
arch/arc32
arch/arc64
arch/arm
arch/avr
arch/bfin
arch/bpf
arch/colossus
arch/cris
arch/csky
arch/dlx
arch/epiphany
arch/fr30
arch/frv
arch/hexagon
arch/hppa
arch/hppa64
arch/ia64
arch/kalimba
arch/kvx
arch/lanai
arch/lm32
arch/loongarch32
arch/loongarch64
arch/m32r
arch/m68k
arch/m88k
arch/mcore
arch/microblaze
arch/mips
arch/mips64
arch/mmix
arch/moxie
arch/mrisc32
arch/msp430
arch/nds32
arch/ns32k
arch/nvptx
arch/or1k
arch/powerpc
arch/powerpc64
arch/propeller
arch/riscv32
arch/riscv64
arch/rl78
arch/rx
arch/s390x
arch/sh
arch/sparc
arch/sparc64
arch/spirv
arch/spu
arch/tricore
arch/v850
arch/vax
arch/vc4
arch/ve
arch/wasm
arch/x86
arch/x86_64
arch/xcore
arch/xtensa
autodoc
backend/c
backend/llvm
backend/self-hosted
binutils
breaking
build system
debug info
docs
error message
frontend
fuzzing
incremental
lib/c
lib/compiler-rt
lib/cxx
lib/std
lib/tsan
lib/ubsan-rt
lib/unwind
linking
miscompilation
os/android
os/contiki
os/dragonfly
os/driverkit
os/emscripten
os/freebsd
os/fuchsia
os/haiku
os/hermit
os/hurd
os/illumos
os/ios
os/linux
os/maccatalyst
os/macos
os/managarm
os/netbsd
os/ohos
os/openbsd
os/plan9
os/redox
os/rtems
os/serenity
os/tvos
os/uefi
os/visionos
os/wasi
os/watchos
os/windows
proposal
release notes
testing
zig cc
zig fmt
zig reduce
bounty
bug
contributor-friendly
downstream
enhancement
infra
optimization
question
regression
upstream
use case
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
ziglang/zig#35373
Reference in a new issue
ziglang/zig
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?