https://github.com/ahatanak created https://github.com/llvm/llvm-project/pull/220139
TypeProcessingState::takeAttrForAttributedType assumed every AttributedType encountered while filling a declarator's TypeLoc had an (AttributedType*, Attr*) pair registered earlier in the same TypeProcessingState's AttrsForTypes. That assumption doesn't hold when the AttributedType is inherited from another declarator, for example when __typeof__ reuses a type built for a different declaration. In that case, TypeProcessingState::getAttributedType, the function that registers the pair, is never called. Return a null Attr* instead of calling llvm_unreachable when no entry is found. This is the Attr* that AttributedTypeLoc uses for the current declarator's TypeLoc, and null is right here because the current declarator never spelled the attribute itself. Fixes #217489 rdar://184781693 >From 438200ecffe0b3bcbf0f8f7f041831df2a3f9572 Mon Sep 17 00:00:00 2001 From: Akira Hatanaka <[email protected]> Date: Mon, 31 Aug 2026 18:47:01 -0700 Subject: [PATCH] [Sema] Don't crash filling TypeLoc for a reused AttributedType TypeProcessingState::takeAttrForAttributedType assumed every AttributedType encountered while filling a declarator's TypeLoc had an (AttributedType*, Attr*) pair registered earlier in the same TypeProcessingState's AttrsForTypes. That assumption doesn't hold when the AttributedType is inherited from another declarator, for example when __typeof__ reuses a type built for a different declaration. In that case, TypeProcessingState::getAttributedType, the function that registers the pair, is never called. Return a null Attr* instead of calling llvm_unreachable when no entry is found. This is the Attr* that AttributedTypeLoc uses for the current declarator's TypeLoc, and null is right here because the current declarator never spelled the attribute itself. Fixes #217489 rdar://184781693 --- clang/lib/Sema/SemaType.cpp | 6 +++++- clang/test/Sema/nullability.c | 8 ++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/clang/lib/Sema/SemaType.cpp b/clang/lib/Sema/SemaType.cpp index 27197f36bcc5a..5eb346e0c7c93 100644 --- a/clang/lib/Sema/SemaType.cpp +++ b/clang/lib/Sema/SemaType.cpp @@ -343,7 +343,11 @@ namespace { } } - llvm_unreachable("no Attr* for AttributedType*"); + // The AttributedType can be inherited from another declarator, for + // example when __typeof__ reuses a type built for a different + // declaration, in which case there is no entry for it in this + // TypeProcessingState. Return null in that case. + return nullptr; } SourceLocation diff --git a/clang/test/Sema/nullability.c b/clang/test/Sema/nullability.c index 5af473ecc41b5..26ff74cb5ff5c 100644 --- a/clang/test/Sema/nullability.c +++ b/clang/test/Sema/nullability.c @@ -250,3 +250,11 @@ void arraysInBlocks(void) { } struct _Nullable NotCplusplusClass {}; // expected-error {{'_Nullable' attribute only applies to classes}} + +// This code used to crash in TypeProcessingState::takeAttrForAttributedType. +struct NullabilityAtomicTypeofS { + int * _Nonnull f1; +}; +void nullabilityAtomicTypeof(const struct NullabilityAtomicTypeofS *s) { + (void)(__typeof__(s->f1) _Atomic *)(&s->f1); +} _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
