PR23057: Fix assertion `Val && "isa<> used on a null pointer"' on invalid for-range...

Fix the issue discovered by fuzzing (PR23057, comment 18) by handling nullptr in Sema::ActOnCXXForRangeDecl
and correct delayed typos in for-range expression before calling Sema::ActOnCXXForRangeStmt. Also fixes PR26288.

Differential Revision: http://reviews.llvm.org/D16630

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@259532 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/Parse/ParseStmt.cpp b/lib/Parse/ParseStmt.cpp
index 6c27b271388c56a6a5b9ff726c8152d18c67c9e4..71904f0cc22267954860351acb3fcc7e6e489829 100644 (file)
--- a/lib/Parse/ParseStmt.cpp
+++ b/lib/Parse/ParseStmt.cpp
@@ -1716,9 +1716,11 @@ StmtResult Parser::ParseForStatement(SourceLocation *TrailingElseLoc) {
   StmtResult ForEachStmt;
 
   if (ForRange) {
+    ExprResult CorrectedRange =
+        Actions.CorrectDelayedTyposInExpr(ForRangeInit.RangeExpr.get());
     ForRangeStmt = Actions.ActOnCXXForRangeStmt(
         getCurScope(), ForLoc, CoawaitLoc, FirstPart.get(),
-        ForRangeInit.ColonLoc, ForRangeInit.RangeExpr.get(),
+        ForRangeInit.ColonLoc, CorrectedRange.get(),
         T.getCloseLocation(), Sema::BFRK_Build);
 
   // Similarly, we need to do the semantic analysis for a for-range

diff --git a/lib/Sema/SemaDecl.cpp b/lib/Sema/SemaDecl.cpp
index 11d51a0979487630079e01ff9b54282793e129d0..5db2c374aed55f59c7feac0abaeb8ac093b9c9a8 100644 (file)
--- a/lib/Sema/SemaDecl.cpp
+++ b/lib/Sema/SemaDecl.cpp
@@ -9928,6 +9928,10 @@ void Sema::ActOnUninitializedDecl(Decl *RealDecl,
 }
 
 void Sema::ActOnCXXForRangeDecl(Decl *D) {
+  // If there is no declaration, there was an error parsing it. Ignore it.
+  if (!D)
+    return;
+
   VarDecl *VD = dyn_cast<VarDecl>(D);
   if (!VD) {
     Diag(D->getLocation(), diag::err_for_range_decl_must_be_var);

diff --git a/test/CXX/dcl.dcl/dcl.spec/dcl.type/p3-0x.cpp b/test/CXX/dcl.dcl/dcl.spec/dcl.type/p3-0x.cpp
index 39d6e706b6c1c3c101c005ca81548d79ba81c058..447f7c5d6cf387bacd73eb175a4becd4dbf32664 100644 (file)
--- a/test/CXX/dcl.dcl/dcl.spec/dcl.type/p3-0x.cpp
+++ b/test/CXX/dcl.dcl/dcl.spec/dcl.type/p3-0x.cpp
@@ -18,6 +18,9 @@ void f() {
   for (struct S { S(int) {} } s : arr) { // expected-error {{types may not be defined in a for range declaration}}
   }
 
+  for (struct S { S(int) {} } s : Undeclared); // expected-error{{types may not be defined in a for range declaration}}
+                                               // expected-error@-1{{use of undeclared identifier 'Undeclared'}}
+
   new struct T {}; // expected-error {{'T' cannot be defined in a type specifier}}
   new struct A {}; // expected-error {{'A' cannot be defined in a type specifier}}
 

diff --git a/test/Parser/cxx-invalid-for-range.cpp b/test/Parser/cxx-invalid-for-range.cpp
new file mode 100644 (file)
index 0000000..557c1da
--- /dev/null
+++ b/test/Parser/cxx-invalid-for-range.cpp
@@ -0,0 +1,18 @@
+// RUN: %clang_cc1 -std=c++11 -fsyntax-only -verify %s
+
+// From PR23057 comment #18 (https://llvm.org/bugs/show_bug.cgi?id=23057#c18).
+
+namespace N {
+  int X[10]; // expected-note{{declared here}}}}
+}
+
+void f1() {
+  for (auto operator new : X); // expected-error{{'operator new' cannot be the name of a variable or data member}}
+                               // expected-error@-1{{use of undeclared identifier 'X'; did you mean 'N::X'?}}
+}
+
+void f2() {
+  for (a operator== :) // expected-error{{'operator==' cannot be the name of a variable or data member}}
+                       // expected-error@-1{{expected expression}}
+                       // expected-error@-2{{unknown type name 'a'}}
+} // expected-error{{expected statement}}