[clang-tools-extra] [clang-tidy] Fix crash in readability-identifier-naming with forward-… (PR #219769)

[via cfe-commits]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-clang-tidy

Author: Anurag Gupta (anuragGupta08)

<details>
<summary>Changes</summary>

Fixes #<!-- -->213948

`IdentifierNamingCheck::findStyleKind()` calls `CXXRecordDecl::hasMemberName()`
on each base class of a method's enclosing class, to detect same-named
methods in bases (e.g. for CRTP). If a base class is only
forward-declared (incomplete) at that point — which can legitimately
happen for nested classes of a class template, since base-class
completeness isn't required until instantiation — `hasMemberName()`'s
underlying `CXXBasePaths::lookupInBases()` assumes the base is complete
and segfaults.

This adds a check for `RD-&gt;hasDefinition()` before calling
`hasMemberName()`, matching the existing pattern already used in this
file (`HungarianNotation::getClassPrefix()`).

Repro from the fuzzer-reported issue:

​```cpp
template&lt;class T&gt;
struct X {
  struct B;
  struct A : public B {
    virtual void foo() { }
  };
};
​```

Added a regression test (`identifier-naming-crash-incomplete-base.cpp`),
verified with `llvm-lit`.

---
Full diff: https://github.com/llvm/llvm-project/pull/219769.diff


2 Files Affected:

- (modified) clang-tools-extra/clang-tidy/readability/IdentifierNamingCheck.cpp 
(+1-1) 
- (added) 
clang-tools-extra/test/clang-tidy/checkers/readability/identifier-naming-crash-incomplete-base.cpp
 (+16) 


``````````diff
diff --git a/clang-tools-extra/clang-tidy/readability/IdentifierNamingCheck.cpp 
b/clang-tools-extra/clang-tidy/readability/IdentifierNamingCheck.cpp
index 4ac23948c5e01..b8df914743889 100644
--- a/clang-tools-extra/clang-tidy/readability/IdentifierNamingCheck.cpp
+++ b/clang-tools-extra/clang-tidy/readability/IdentifierNamingCheck.cpp
@@ -1259,7 +1259,7 @@ StyleKind IdentifierNamingCheck::findStyleKind(
     // necessary even if it's not an override. e.g. CRTP.
     for (const CXXBaseSpecifier &Base : Decl->getParent()->bases())
       if (const auto *RD = Base.getType()->getAsCXXRecordDecl();
-          RD && RD->hasMemberName(Decl->getDeclName()))
+          RD && RD->hasDefinition() && RD->hasMemberName(Decl->getDeclName()))
         return SK_Invalid;
 
     if (Decl->isConstexpr() && NamingStyles[SK_ConstexprMethod])
diff --git 
a/clang-tools-extra/test/clang-tidy/checkers/readability/identifier-naming-crash-incomplete-base.cpp
 
b/clang-tools-extra/test/clang-tidy/checkers/readability/identifier-naming-crash-incomplete-base.cpp
new file mode 100644
index 0000000000000..2862e661e354a
--- /dev/null
+++ 
b/clang-tools-extra/test/clang-tidy/checkers/readability/identifier-naming-crash-incomplete-base.cpp
@@ -0,0 +1,16 @@
+// RUN: %check_clang_tidy %s readability-identifier-naming %t
+
+// Regression test for https://github.com/llvm/llvm-project/issues/213948
+//
+// A class inheriting from a forward-declared (incomplete) base class used
+// to crash IdentifierNamingCheck::findStyleKind(), because it called
+// CXXRecordDecl::hasMemberName() on an incomplete base, which segfaults
+// inside CXXBasePaths::lookupInBases(). No diagnostics are expected here;
+// this test only verifies that clang-tidy does not crash.
+template<class T>
+struct X {
+  struct B;
+  struct A : public B {
+    virtual void foo() { }
+  };
+};

``````````

</details>


https://github.com/llvm/llvm-project/pull/219769
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits