[PATCH] D131423: [clang] fix frontend crash when evaluating type trait

[YingChi Long via Phabricator via cfe-commits]

inclyc updated this revision to Diff 451056.
inclyc added a comment.

check argument number before evaulating


Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D131423/new/

https://reviews.llvm.org/D131423

Files:
  clang/lib/Sema/SemaExprCXX.cpp
  clang/test/SemaCXX/type-trait-eval-crash-issue-57008.cpp


Index: clang/test/SemaCXX/type-trait-eval-crash-issue-57008.cpp
===================================================================
--- /dev/null
+++ clang/test/SemaCXX/type-trait-eval-crash-issue-57008.cpp
@@ -0,0 +1,6 @@
+// RUN: %clang_cc1 -fsyntax-only %s
+
+// Shouldn't crash here
+// Reported by https://github.com/llvm/llvm-project/issues/57008
+template<class... Ts> bool b = __is_constructible(Ts...);
+bool x = b<>;
Index: clang/lib/Sema/SemaExprCXX.cpp
===================================================================
--- clang/lib/Sema/SemaExprCXX.cpp
+++ clang/lib/Sema/SemaExprCXX.cpp
@@ -5427,11 +5427,31 @@
 }
 }
 
+static bool CheckTypeTraitArgNumber(TypeTrait Kind, size_t N) {
+  if (Kind <= UTT_Last)
+    return N == 1;
+  if (Kind <= BTT_Last && Kind != BTT_ReferenceBindsToTemporary)
+    return N == 2;
+  switch (Kind) {
+  case clang::BTT_ReferenceBindsToTemporary:
+  case clang::TT_IsConstructible:
+  case clang::TT_IsNothrowConstructible:
+  case clang::TT_IsTriviallyConstructible: {
+    return N >= 1;
+  }
+  default:
+    llvm_unreachable("not a TT");
+  }
+}
+
 ExprResult Sema::BuildTypeTrait(TypeTrait Kind, SourceLocation KWLoc,
                                 ArrayRef<TypeSourceInfo *> Args,
                                 SourceLocation RParenLoc) {
   QualType ResultType = Context.getLogicalOperationType();
 
+  if (!CheckTypeTraitArgNumber(Kind, Args.size()))
+    return ExprError();
+
   if (Kind <= UTT_Last && !CheckUnaryTypeTraitTypeCompleteness(
                                *this, Kind, KWLoc, Args[0]->getType()))
     return ExprError();


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D131423.451056.patch
Type: text/x-patch
Size: 1603 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20220809/afb8bee4/attachment.bin>