https://github.com/necto updated https://github.com/llvm/llvm-project/pull/221220
>From bf5df7f4fa8f3b6721bbc1af95d46feb780556f0 Mon Sep 17 00:00:00 2001 From: Arseniy Zaostrovnykh <[email protected]> Date: Fri, 4 Sep 2026 15:13:27 +0200 Subject: [PATCH] [analyzer] Fix crash destructuring element of a sugared array type ExprEngine::makeElementRegion falls short trying to determine the element type of an array that involves a type aliasing a static array type. This leads to a crash in ExprEngine::ProcessMemberDtor where it assumes that element type is a CXXRecordDecl, while it is still a type alias to a static array type. getBaseElementType is the canonical way to desugar and peel off the array dimensions. -- CPP-8838 --- clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp | 7 ++----- clang/test/Analysis/dtor-array.cpp | 7 +++++++ 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp index 9fb167ee2ea4a..bb1d98859e85e 100644 --- a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp +++ b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp @@ -107,11 +107,8 @@ SVal ExprEngine::makeElementRegion(ProgramStateRef State, SVal LValue, SValBuilder &SVB = State->getStateManager().getSValBuilder(); ASTContext &Ctx = SVB.getContext(); - if (const ArrayType *AT = Ctx.getAsArrayType(Ty)) { - while (AT) { - Ty = AT->getElementType(); - AT = dyn_cast<ArrayType>(AT->getElementType()); - } + if (Ctx.getAsArrayType(Ty)) { + Ty = Ctx.getBaseElementType(Ty); LValue = State->getLValue(Ty, SVB.makeArrayIndex(Idx), LValue); IsArray = true; } diff --git a/clang/test/Analysis/dtor-array.cpp b/clang/test/Analysis/dtor-array.cpp index 84a34af922516..a77918f3d43cf 100644 --- a/clang/test/Analysis/dtor-array.cpp +++ b/clang/test/Analysis/dtor-array.cpp @@ -326,6 +326,13 @@ void multidimensionalMember(){ clang_analyzer_eval(EvalOrderArr[3] == 0); // expected-warning {{TRUE}} } +void typedefMultidimensionalPrep(){ + // The inner dimension is hidden behind a typedef, so the element type of the + // outer array is a TypedefType rather than a ConstantArrayType. + typedef EvalOrder EvalOrderRow[2]; + EvalOrderRow arr[2]; // no-crash +} + void *memset(void *, int, size_t); void clang_analyzer_dumpElementCount(InlineDtor *); _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
