[PATCH] D134180: [clang] Fix a nullptr-access crash in CheckTemplateArgument.

[Haojian Wu via Phabricator via cfe-commits]

hokein created this revision.
hokein added reviewers: kadircet, adamcz.
Herald added a project: All.
hokein requested review of this revision.
Herald added a project: clang.

It is possible that we can pass a null ParamType to
CheckNonTypeTemplateParameter -- the ParamType var can be reset to a null
type on Line 6940, and the followed bailout if is not entered.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D134180

Files:
  clang/lib/Sema/SemaTemplate.cpp
  clang/test/SemaTemplate/temp_arg_nontype_cxx1z.cpp


Index: clang/test/SemaTemplate/temp_arg_nontype_cxx1z.cpp
===================================================================
--- clang/test/SemaTemplate/temp_arg_nontype_cxx1z.cpp
+++ clang/test/SemaTemplate/temp_arg_nontype_cxx1z.cpp
@@ -558,3 +558,24 @@
   X<1, 1u>::type y; // expected-error {{no type named 'type' in 'TypeSuffix::X<1, 1U>'}}
   X<1, 1>::type z; // expected-error {{no type named 'type' in 'TypeSuffix::X<1, 1>'}}
 }
+
+namespace no_crash {
+template <class T>
+class Base {
+public:
+  template <class> class EntryPointSpec {};
+  template <auto Method>
+  using EntryPoint = EntryPointSpec<T>;
+};
+
+class Derived : Base<Derived>{
+  template <class...> class Spec {};
+
+  void Invalid(Undefined) const; // expected-error {{unknown type name 'Undefined'}}
+  void crash() {
+    return Spec{
+        EntryPoint<&Invalid>()
+    };
+  }
+};
+} // no_crash
Index: clang/lib/Sema/SemaTemplate.cpp
===================================================================
--- clang/lib/Sema/SemaTemplate.cpp
+++ clang/lib/Sema/SemaTemplate.cpp
@@ -6934,8 +6934,6 @@
       Expr *Inits[1] = {DeductionArg};
       ParamType =
           DeduceTemplateSpecializationFromInitializer(TSI, Entity, Kind, Inits);
-      if (ParamType.isNull())
-        return ExprError();
     } else {
       TemplateDeductionInfo Info(DeductionArg->getExprLoc(),
                                  Param->getDepth() + 1);
@@ -6958,6 +6956,8 @@
         return ExprError();
       }
     }
+    if (ParamType.isNull())
+      return ExprError();
     // CheckNonTypeTemplateParameterType will produce a diagnostic if there's
     // an error. The error message normally references the parameter
     // declaration, but here we'll pass the argument location because that's


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D134180.461195.patch
Type: text/x-patch
Size: 1767 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20220919/4a5a1407/attachment.bin>