Author: Arseniy Zaostrovnykh Date: 2026-09-07T19:52:39Z New Revision: 14aebab4c6fe5c9f937efcdf1ea184495de6b737
URL: https://github.com/llvm/llvm-project/commit/14aebab4c6fe5c9f937efcdf1ea184495de6b737 DIFF: https://github.com/llvm/llvm-project/commit/14aebab4c6fe5c9f937efcdf1ea184495de6b737.diff LOG: [analyzer] Fix crash destructing element of a sugared array type ExprEngine::makeElementRegion falls short trying to determine the element type of an array that involves a type aliasing a static array type. This leads to a crash in ExprEngine::ProcessMemberDtor where it assumes that element type is a CXXRecordDecl, while it is still a type alias to a static array type. getBaseElementType is the canonical way to desugar and peel off the array dimensions. Assisted by Claude Opus 5 -- CPP-8838 Added: Modified: clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp clang/test/Analysis/dtor-array.cpp Removed: ################################################################################ diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp index 9fb167ee2ea4a..bb6deabba8a43 100644 --- a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp +++ b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp @@ -105,13 +105,9 @@ void ExprEngine::performTrivialCopy(ExplodedNodeSet &Dst, ExplodedNode *Pred, SVal ExprEngine::makeElementRegion(ProgramStateRef State, SVal LValue, QualType &Ty, bool &IsArray, unsigned Idx) { SValBuilder &SVB = State->getStateManager().getSValBuilder(); - ASTContext &Ctx = SVB.getContext(); - if (const ArrayType *AT = Ctx.getAsArrayType(Ty)) { - while (AT) { - Ty = AT->getElementType(); - AT = dyn_cast<ArrayType>(AT->getElementType()); - } + if (Ty->isArrayType()) { + Ty = SVB.getContext().getBaseElementType(Ty); LValue = State->getLValue(Ty, SVB.makeArrayIndex(Idx), LValue); IsArray = true; } diff --git a/clang/test/Analysis/dtor-array.cpp b/clang/test/Analysis/dtor-array.cpp index 84a34af922516..1639c66c65869 100644 --- a/clang/test/Analysis/dtor-array.cpp +++ b/clang/test/Analysis/dtor-array.cpp @@ -326,6 +326,13 @@ void multidimensionalMember(){ clang_analyzer_eval(EvalOrderArr[3] == 0); // expected-warning {{TRUE}} } +void typedefMultidimensionalNoCrash(){ + // The inner dimension is hidden behind a typedef, so the element type of the + // outer array is a TypedefType rather than a ConstantArrayType. + typedef EvalOrder EvalOrderRow[2]; + EvalOrderRow arr[2]; // no-crash +} + void *memset(void *, int, size_t); void clang_analyzer_dumpElementCount(InlineDtor *); _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
