From: Bruno Ricci <riccibrun@gmail.com>
Date: Tue, 8 Jan 2019 13:52:54 +0000 (+0000)
Subject: [Sema] Diagnose array access preceding the array bounds even when the base type is... 
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1ad54e198af85c779c11a265af0737772300051d;p=clang

[Sema] Diagnose array access preceding the array bounds even when the base type is incomplete.

When the type of the base expression after IgnoreParenCasts is incomplete,
it is still possible to diagnose an array access which precedes the array
bounds.

This is a follow-up on D55862 which added an early return when the type of
the base expression after IgnoreParenCasts was incomplete.

Differential Revision: https://reviews.llvm.org/D56050

Reviewed By: efriedma



git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@350622 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/lib/Sema/SemaChecking.cpp b/lib/Sema/SemaChecking.cpp
index b9284a5b46..cd96200b81 100644
--- a/lib/Sema/SemaChecking.cpp
+++ b/lib/Sema/SemaChecking.cpp
@@ -12383,12 +12383,6 @@ void Sema::CheckArrayAccess(const Expr *BaseExpr, const Expr *IndexExpr,
     return;
 
   const Type *BaseType = ArrayTy->getElementType().getTypePtr();
-  // It is possible that the type of the base expression after IgnoreParenCasts
-  // is incomplete, even though the type of the base expression before
-  // IgnoreParenCasts is complete (see PR39746 for an example). In this case we
-  // have no information about whether the array access is out-of-bounds.
-  if (BaseType->isIncompleteType())
-    return;
 
   Expr::EvalResult Result;
   if (!IndexExpr->EvaluateAsInt(Result, Context, Expr::SE_AllowSideEffects))
@@ -12405,6 +12399,15 @@ void Sema::CheckArrayAccess(const Expr *BaseExpr, const Expr *IndexExpr,
     ND = ME->getMemberDecl();
 
   if (index.isUnsigned() || !index.isNegative()) {
+    // It is possible that the type of the base expression after
+    // IgnoreParenCasts is incomplete, even though the type of the base
+    // expression before IgnoreParenCasts is complete (see PR39746 for an
+    // example). In this case we have no information about whether the array
+    // access exceeds the array bounds. However we can still diagnose an array
+    // access which precedes the array bounds.
+    if (BaseType->isIncompleteType())
+      return;
+
     llvm::APInt size = ArrayTy->getSize();
     if (!size.isStrictlyPositive())
       return;
diff --git a/test/SemaCXX/array-bounds.cpp b/test/SemaCXX/array-bounds.cpp
index 3eb929b93e..6ebff8c992 100644
--- a/test/SemaCXX/array-bounds.cpp
+++ b/test/SemaCXX/array-bounds.cpp
@@ -287,9 +287,12 @@ int test_struct_multiarray() {
 
 namespace PR39746 {
   struct S;
-  extern S xxx[2];
+  extern S xxx[2]; // expected-note {{array 'xxx' declared here}}
   class C {};
 
   C &f() { return reinterpret_cast<C *>(xxx)[1]; } // no-warning
+  // We have no info on whether this is out-of-bounds.
   C &g() { return reinterpret_cast<C *>(xxx)[2]; } // no-warning
+  // We can still diagnose this.
+  C &h() { return reinterpret_cast<C *>(xxx)[-1]; } // expected-warning {{array index -1 is before the beginning of the array}}
 }