https://github.com/matthew-j-code updated https://github.com/llvm/llvm-project/pull/231925
>From a2ffa678a6ca38cb5cfeffd58a9fa821f8b19aa7 Mon Sep 17 00:00:00 2001 From: "Jones, Matthew (DI SW SIM FRWK PLAT SIMFW HPC)" <[email protected]> Date: Tue, 13 Oct 2026 04:11:46 -0700 Subject: [PATCH 1/5] fix for ArrayBound check for incomplete types --- clang/docs/ReleaseNotes.md | 2 ++ clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp | 6 ++++++ clang/test/Analysis/ArrayBound/cplusplus.cpp | 8 ++++++++ 3 files changed, 16 insertions(+) diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md index 1dc1764978ea2..32281e5ad6750 100644 --- a/clang/docs/ReleaseNotes.md +++ b/clang/docs/ReleaseNotes.md @@ -1188,6 +1188,8 @@ features cannot lower the translation-unit ABI level; % - Moved checkers % - Diagnostic changes +- Fixed an assertion failure in the `alpha.security.ArrayBound` checker when analyzing incomplete types. + #### Improvements - The lock-order-reversal check in ``alpha.unix.PthreadLock`` is now disabled by default. diff --git a/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp index 3acbf7cd75ab8..e75d43801864a 100644 --- a/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp @@ -230,6 +230,12 @@ computeOffset(ProgramStateRef State, SValBuilder &SVB, if (!Index) return std::nullopt; + // The size of an incomplete type (e.g forward declaration) is unknown, so + // the offset cannot be calculated. + QualType ElemType = CurRegion->getElementType(); + if (ElemType->isIncompleteType()) + return std::nullopt; + // Calculate Delta = Index * sizeof(ElemType). NonLoc Size = SVB.makeArrayIndex(getElementSize(CurRegion, SVB)); auto Delta = EvalBinOp(BO_Mul, *Index, Size); diff --git a/clang/test/Analysis/ArrayBound/cplusplus.cpp b/clang/test/Analysis/ArrayBound/cplusplus.cpp index 680fbf4817c30..457da1f15307e 100644 --- a/clang/test/Analysis/ArrayBound/cplusplus.cpp +++ b/clang/test/Analysis/ArrayBound/cplusplus.cpp @@ -179,3 +179,11 @@ int test_reference_that_might_be_after_the_end(int idx) { return -1; return ref; } + +//The size of an incomplete type (e.g., a forward declaration) is unknown, so you cannot calculate the offset. +struct Incomplete; +void useIncomplete(Incomplete &); + +void test_incomplete(void *p) { + useIncomplete(*static_cast<Incomplete *>(p)); +} >From 804d7a25ae5b10b69a38ba1ac1413de3a1c12103 Mon Sep 17 00:00:00 2001 From: Matthew <[email protected]> Date: Wed, 14 Oct 2026 15:40:34 +0100 Subject: [PATCH 2/5] Update clang/docs/ReleaseNotes.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Donát Nagy <[email protected]> --- clang/docs/ReleaseNotes.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md index 32281e5ad6750..1dc1764978ea2 100644 --- a/clang/docs/ReleaseNotes.md +++ b/clang/docs/ReleaseNotes.md @@ -1188,8 +1188,6 @@ features cannot lower the translation-unit ABI level; % - Moved checkers % - Diagnostic changes -- Fixed an assertion failure in the `alpha.security.ArrayBound` checker when analyzing incomplete types. - #### Improvements - The lock-order-reversal check in ``alpha.unix.PthreadLock`` is now disabled by default. >From d68ec2594f6f67ed6e5d5b65b49514398284bdfa Mon Sep 17 00:00:00 2001 From: Matthew <[email protected]> Date: Wed, 14 Oct 2026 15:40:49 +0100 Subject: [PATCH 3/5] Update clang/test/Analysis/ArrayBound/cplusplus.cpp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Donát Nagy <[email protected]> --- clang/test/Analysis/ArrayBound/cplusplus.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clang/test/Analysis/ArrayBound/cplusplus.cpp b/clang/test/Analysis/ArrayBound/cplusplus.cpp index 457da1f15307e..6a5f52e0c45b7 100644 --- a/clang/test/Analysis/ArrayBound/cplusplus.cpp +++ b/clang/test/Analysis/ArrayBound/cplusplus.cpp @@ -185,5 +185,5 @@ struct Incomplete; void useIncomplete(Incomplete &); void test_incomplete(void *p) { - useIncomplete(*static_cast<Incomplete *>(p)); + useIncomplete(*static_cast<Incomplete *>(p)); // no-crash } >From 79e988ef40b06abe7a9a9772124d1c7fe1d00c20 Mon Sep 17 00:00:00 2001 From: "Jones, Matthew (DI SW SIM FRWK PLAT SIMFW HPC)" <[email protected]> Date: Wed, 14 Oct 2026 08:08:13 -0700 Subject: [PATCH 4/5] changed getElementSize to std::optional<int64_t> --- .../StaticAnalyzer/Checkers/ArrayBoundChecker.cpp | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp index e75d43801864a..25f44eebc9324 100644 --- a/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp @@ -200,10 +200,12 @@ static bool isDeterminedByInterestingSymbol(SVal SV, return false; } -static int64_t getElementSize(const ElementRegion *ER, SValBuilder &SVB) { +static std::optional<int64_t> getElementSize(const ElementRegion *ER, + SValBuilder &SVB) { QualType ElemType = ER->getElementType(); - assert(!ElemType->isIncompleteType() && "ElemType cannot be incomplete"); + if (ElemType->isIncompleteType()) + return std::nullopt; return SVB.getContext().getTypeSizeInChars(ElemType).getQuantity(); } @@ -232,13 +234,12 @@ computeOffset(ProgramStateRef State, SValBuilder &SVB, // The size of an incomplete type (e.g forward declaration) is unknown, so // the offset cannot be calculated. - QualType ElemType = CurRegion->getElementType(); - if (ElemType->isIncompleteType()) + std::optional<int64_t> ElemSize = getElementSize(CurRegion, SVB); + if (!ElemSize) return std::nullopt; // Calculate Delta = Index * sizeof(ElemType). - NonLoc Size = SVB.makeArrayIndex(getElementSize(CurRegion, SVB)); - auto Delta = EvalBinOp(BO_Mul, *Index, Size); + auto Delta = EvalBinOp(BO_Mul, *Index, SVB.makeArrayIndex(*ElemSize)); if (!Delta) return std::nullopt; >From 289f0eea8940440436d2e8758837347f745d0585 Mon Sep 17 00:00:00 2001 From: "Jones, Matthew (DI SW SIM FRWK PLAT SIMFW HPC)" <[email protected]> Date: Mon, 19 Oct 2026 01:22:50 -0700 Subject: [PATCH 5/5] [clang][analyzer] cleaned comment --- clang/test/Analysis/ArrayBound/cplusplus.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/clang/test/Analysis/ArrayBound/cplusplus.cpp b/clang/test/Analysis/ArrayBound/cplusplus.cpp index 6a5f52e0c45b7..7eff54c86189c 100644 --- a/clang/test/Analysis/ArrayBound/cplusplus.cpp +++ b/clang/test/Analysis/ArrayBound/cplusplus.cpp @@ -180,7 +180,8 @@ int test_reference_that_might_be_after_the_end(int idx) { return ref; } -//The size of an incomplete type (e.g., a forward declaration) is unknown, so you cannot calculate the offset. +// The size of an incomplete type (e.g., a forward declaration) +// is unknown, so you cannot calculate the offset. struct Incomplete; void useIncomplete(Incomplete &); _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
