https://github.com/anuragGupta08 created
https://github.com/llvm/llvm-project/pull/219769
Fixes #213948
`IdentifierNamingCheck::findStyleKind()` calls `CXXRecordDecl::hasMemberName()`
on each base class of a method's enclosing class, to detect same-named
methods in bases (e.g. for CRTP). If a base class is only
forward-declared (incomplete) at that point — which can legitimately
happen for nested classes of a class template, since base-class
completeness isn't required until instantiation — `hasMemberName()`'s
underlying `CXXBasePaths::lookupInBases()` assumes the base is complete
and segfaults.
This adds a check for `RD->hasDefinition()` before calling
`hasMemberName()`, matching the existing pattern already used in this
file (`HungarianNotation::getClassPrefix()`).
Repro from the fuzzer-reported issue:
```cpp
template<class T>
struct X {
struct B;
struct A : public B {
virtual void foo() { }
};
};
```
Added a regression test (`identifier-naming-crash-incomplete-base.cpp`),
verified with `llvm-lit`.
>From 43db0d2368e229faec8f5ee78d37fb0e176f0eb7 Mon Sep 17 00:00:00 2001
From: Anurag <[email protected]>
Date: Sun, 30 Aug 2026 11:13:55 +0530
Subject: [PATCH] [clang-tidy] Fix crash in readability-identifier-naming with
forward-declared base
IdentifierNamingCheck::findStyleKind() calls
CXXRecordDecl::hasMemberName() on each base class of a method's
enclosing class to detect same-named base methods (e.g. CRTP). If a
base class is only forward-declared and not yet defined -- which can
happen for nested classes of a class template, since base-class
completeness isn't required until instantiation -- hasMemberName()'s
underlying CXXBasePaths::lookupInBases() assumes the base is complete
Fixes #213948
---
.../readability/IdentifierNamingCheck.cpp | 2 +-
.../identifier-naming-crash-incomplete-base.cpp | 16 ++++++++++++++++
2 files changed, 17 insertions(+), 1 deletion(-)
create mode 100644
clang-tools-extra/test/clang-tidy/checkers/readability/identifier-naming-crash-incomplete-base.cpp
diff --git a/clang-tools-extra/clang-tidy/readability/IdentifierNamingCheck.cpp
b/clang-tools-extra/clang-tidy/readability/IdentifierNamingCheck.cpp
index 4ac23948c5e01..b8df914743889 100644
--- a/clang-tools-extra/clang-tidy/readability/IdentifierNamingCheck.cpp
+++ b/clang-tools-extra/clang-tidy/readability/IdentifierNamingCheck.cpp
@@ -1259,7 +1259,7 @@ StyleKind IdentifierNamingCheck::findStyleKind(
// necessary even if it's not an override. e.g. CRTP.
for (const CXXBaseSpecifier &Base : Decl->getParent()->bases())
if (const auto *RD = Base.getType()->getAsCXXRecordDecl();
- RD && RD->hasMemberName(Decl->getDeclName()))
+ RD && RD->hasDefinition() && RD->hasMemberName(Decl->getDeclName()))
return SK_Invalid;
if (Decl->isConstexpr() && NamingStyles[SK_ConstexprMethod])
diff --git
a/clang-tools-extra/test/clang-tidy/checkers/readability/identifier-naming-crash-incomplete-base.cpp
b/clang-tools-extra/test/clang-tidy/checkers/readability/identifier-naming-crash-incomplete-base.cpp
new file mode 100644
index 0000000000000..2862e661e354a
--- /dev/null
+++
b/clang-tools-extra/test/clang-tidy/checkers/readability/identifier-naming-crash-incomplete-base.cpp
@@ -0,0 +1,16 @@
+// RUN: %check_clang_tidy %s readability-identifier-naming %t
+
+// Regression test for https://github.com/llvm/llvm-project/issues/213948
+//
+// A class inheriting from a forward-declared (incomplete) base class used
+// to crash IdentifierNamingCheck::findStyleKind(), because it called
+// CXXRecordDecl::hasMemberName() on an incomplete base, which segfaults
+// inside CXXBasePaths::lookupInBases(). No diagnostics are expected here;
+// this test only verifies that clang-tidy does not crash.
+template<class T>
+struct X {
+ struct B;
+ struct A : public B {
+ virtual void foo() { }
+ };
+};
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
