[clang] [Clang] Reland: Diagnose invalid function types in dependent contexts (PR #139246)

via cfe-commits cfe-commits at lists.llvm.org
Fri May 9 04:40:35 PDT 2025


https://github.com/cor3ntin created https://github.com/llvm/llvm-project/pull/139246

When forming an invalid function type, we were not diagnosing it if the call was dependent.

However, we later rely on the function type to be sensible during argument deduction.

We now diagnose anything that is not a potential function type,
to avoid constructing bogus call expressions.

Fixes https://github.com/llvm/llvm-project/issues/138657
Fixes https://github.com/llvm/llvm-project/issues/115725
Fixes https://github.com/llvm/llvm-project/issues/68852

>From 6e17e8e048a3b75d08d17d4e30eb0daed447ab98 Mon Sep 17 00:00:00 2001
From: Corentin Jabot <corentinjabot at gmail.com>
Date: Tue, 6 May 2025 20:00:18 +0200
Subject: [PATCH 1/3] [Clang] Diagnose invalid function types in dependent
 contexts

When forming an invalid function type, we were not diagnosing
it if the call was dependent.

However, we later rely on the function type to be sensible
during argument deduction.

We now diagnose anything that is not a potential function type,
to avoid constructing bogus call expressions.

Fixes #138657
Fixes #115725
Fixes #68852
---
 clang/docs/ReleaseNotes.rst                  |  1 +
 clang/lib/Sema/SemaExpr.cpp                  | 19 ++++++++
 clang/test/SemaTemplate/fun-template-def.cpp | 51 +++++++++++++++++++-
 3 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/clang/docs/ReleaseNotes.rst b/clang/docs/ReleaseNotes.rst
index 203958dab7430..bdd54f6a52b05 100644
--- a/clang/docs/ReleaseNotes.rst
+++ b/clang/docs/ReleaseNotes.rst
@@ -655,6 +655,7 @@ Bug Fixes to C++ Support
 - Fixed an assertion when trying to constant-fold various builtins when the argument
   referred to a reference to an incomplete type. (#GH129397)
 - Fixed a crash when a cast involved a parenthesized aggregate initialization in dependent context. (#GH72880)
+- Fixed a crash when forming an invalid function type in a dependent context. (#GH138657) (#GH115725) (#GH68852)
 
 Bug Fixes to AST Handling
 ^^^^^^^^^^^^^^^^^^^^^^^^^
diff --git a/clang/lib/Sema/SemaExpr.cpp b/clang/lib/Sema/SemaExpr.cpp
index be3f145f3c5f1..f463bffa83545 100644
--- a/clang/lib/Sema/SemaExpr.cpp
+++ b/clang/lib/Sema/SemaExpr.cpp
@@ -6541,6 +6541,15 @@ ExprResult Sema::ActOnCallExpr(Scope *Scope, Expr *Fn, SourceLocation LParenLoc,
   return Call;
 }
 
+// Any type that could be used to form a callable expression
+static bool MayBeFunctionType(const ASTContext &Context, QualType T) {
+  return T == Context.BoundMemberTy || T == Context.UnknownAnyTy ||
+         T == Context.BuiltinFnTy || T == Context.OverloadTy ||
+         T->isFunctionType() || T->isFunctionReferenceType() ||
+         T->isMemberFunctionPointerType() || T->isFunctionPointerType() ||
+         T->isBlockPointerType() || T->isRecordType();
+}
+
 ExprResult Sema::BuildCallExpr(Scope *Scope, Expr *Fn, SourceLocation LParenLoc,
                                MultiExprArg ArgExprs, SourceLocation RParenLoc,
                                Expr *ExecConfig, bool IsExecConfig,
@@ -6594,6 +6603,16 @@ ExprResult Sema::BuildCallExpr(Scope *Scope, Expr *Fn, SourceLocation LParenLoc,
             *this, dyn_cast<UnresolvedMemberExpr>(Fn->IgnoreParens()),
             Fn->getBeginLoc());
 
+        if (!Fn->getType()->isDependentType()) {
+          // If the type of the function itself is not dependent
+          // check that it is a reasonable as a function, as type deduction
+          // later assume the CallExpr has a sensible TYPE.
+          if (!MayBeFunctionType(Context, Fn->getType()))
+            return ExprError(
+                Diag(LParenLoc, diag::err_typecheck_call_not_function)
+                << Fn->getType() << Fn->getSourceRange());
+        }
+
         return CallExpr::Create(Context, Fn, ArgExprs, Context.DependentTy,
                                 VK_PRValue, RParenLoc, CurFPFeatureOverrides());
       }
diff --git a/clang/test/SemaTemplate/fun-template-def.cpp b/clang/test/SemaTemplate/fun-template-def.cpp
index de77901b5b601..716296e72bc44 100644
--- a/clang/test/SemaTemplate/fun-template-def.cpp
+++ b/clang/test/SemaTemplate/fun-template-def.cpp
@@ -1,6 +1,7 @@
 // RUN: %clang_cc1 -fsyntax-only -verify %s
 // RUN: %clang_cc1 -fsyntax-only -verify -std=c++98 %s
 // RUN: %clang_cc1 -fsyntax-only -verify -std=c++11 %s
+// RUN: %clang_cc1 -fsyntax-only -verify -std=c++20 %s
 
 // Tests that dependent expressions are always allowed, whereas non-dependent
 // are checked as usual.
@@ -32,7 +33,7 @@ T f1(T t1, U u1, int i1, T** tpp)
   i1 = t1[u1];
   i1 *= t1;
 
-  i1(u1, t1); // error
+  i1(u1, t1); // expected-error {{called object type 'int' is not a function or function pointer}}
   u1(i1, t1);
 
   U u2 = (T)i1;
@@ -60,3 +61,51 @@ void f3() {
   f2<int*>(0);
   f2<int>(0); // expected-error {{no matching function for call to 'f2'}}
 }
+
+#if __cplusplus >= 202002L
+namespace GH138657 {
+template <auto V> // #gh138657-template-head
+class meta {};
+template<int N>
+class meta<N()> {}; // expected-error {{called object type 'int' is not a function or function point}}
+
+template<int N[1]>
+class meta<N()> {}; // expected-error {{called object type 'int *' is not a function or function point}}
+
+template<char* N>
+class meta<N()> {}; // expected-error {{called object type 'char *' is not a function or function point}}
+
+struct S {};
+template<S>
+class meta<S()> {}; // expected-error {{template argument for non-type template parameter is treated as function type 'S ()'}}
+                    // expected-note@#gh138657-template-head {{template parameter is declared here}}
+
+}
+
+namespace GH115725 {
+template<auto ...> struct X {};
+template<typename T, typename ...Ts> struct A {
+  template<Ts ...Ns, T *...Ps>
+  A(X<0(Ps)...>, Ts (*...qs)[Ns]);
+  // expected-error at -1{{called object type 'int' is not a function or function pointer}}
+
+};
+}
+
+namespace GH68852 {
+template <auto v>
+struct constexpr_value {
+  template <class... Ts>
+  constexpr constexpr_value<v(Ts::value...)> call(Ts...) {
+    //expected-error at -1 {{called object type 'int' is not a function or function pointer}}
+    return {};
+  }
+};
+
+template <auto v> constexpr static inline auto c_ = constexpr_value<v>{};
+// expected-note at -1 {{in instantiation of template}}
+auto k = c_<1>; // expected-note {{in instantiation of variable}}
+
+}
+
+#endif

>From 3f862874b7e709a0f31b0b4aadf2203d98c05eeb Mon Sep 17 00:00:00 2001
From: Corentin Jabot <corentinjabot at gmail.com>
Date: Tue, 6 May 2025 20:43:31 +0200
Subject: [PATCH 2/3] address feedback

---
 clang/lib/Sema/SemaExpr.cpp | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/clang/lib/Sema/SemaExpr.cpp b/clang/lib/Sema/SemaExpr.cpp
index f463bffa83545..6e8aa1a362c50 100644
--- a/clang/lib/Sema/SemaExpr.cpp
+++ b/clang/lib/Sema/SemaExpr.cpp
@@ -6603,15 +6603,14 @@ ExprResult Sema::BuildCallExpr(Scope *Scope, Expr *Fn, SourceLocation LParenLoc,
             *this, dyn_cast<UnresolvedMemberExpr>(Fn->IgnoreParens()),
             Fn->getBeginLoc());
 
-        if (!Fn->getType()->isDependentType()) {
-          // If the type of the function itself is not dependent
-          // check that it is a reasonable as a function, as type deduction
-          // later assume the CallExpr has a sensible TYPE.
-          if (!MayBeFunctionType(Context, Fn->getType()))
-            return ExprError(
-                Diag(LParenLoc, diag::err_typecheck_call_not_function)
-                << Fn->getType() << Fn->getSourceRange());
-        }
+        // If the type of the function itself is not dependent
+        // check that it is a reasonable as a function, as type deduction
+        // later assume the CallExpr has a sensible TYPE.
+        if (!Fn->getType()->isDependentType() &&
+            !MayBeFunctionType(Context, Fn->getType()))
+          return ExprError(
+              Diag(LParenLoc, diag::err_typecheck_call_not_function)
+              << Fn->getType() << Fn->getSourceRange());
 
         return CallExpr::Create(Context, Fn, ArgExprs, Context.DependentTy,
                                 VK_PRValue, RParenLoc, CurFPFeatureOverrides());

>From 0c43b5049a52ce7a65b2e9e5abef4ed5ccf61ebd Mon Sep 17 00:00:00 2001
From: Corentin Jabot <corentinjabot at gmail.com>
Date: Fri, 9 May 2025 13:37:00 +0200
Subject: [PATCH 3/3] Address post-review feedback/revert

https://github.com/llvm/llvm-project/pull/138731#issuecomment-2864298000

A call expression might have been partially constructed,
in which case it will be a call-expressions (and its type
will not be that of a function)

To address that, we check that the expression might already be
a well-formed call
---
 clang/lib/Sema/SemaExpr.cpp                  | 28 +++++++----
 clang/test/SemaTemplate/fun-template-def.cpp | 49 +++++++++++++++++++-
 2 files changed, 68 insertions(+), 9 deletions(-)

diff --git a/clang/lib/Sema/SemaExpr.cpp b/clang/lib/Sema/SemaExpr.cpp
index 6e8aa1a362c50..abfc147045bbb 100644
--- a/clang/lib/Sema/SemaExpr.cpp
+++ b/clang/lib/Sema/SemaExpr.cpp
@@ -6542,12 +6542,25 @@ ExprResult Sema::ActOnCallExpr(Scope *Scope, Expr *Fn, SourceLocation LParenLoc,
 }
 
 // Any type that could be used to form a callable expression
-static bool MayBeFunctionType(const ASTContext &Context, QualType T) {
-  return T == Context.BoundMemberTy || T == Context.UnknownAnyTy ||
-         T == Context.BuiltinFnTy || T == Context.OverloadTy ||
-         T->isFunctionType() || T->isFunctionReferenceType() ||
-         T->isMemberFunctionPointerType() || T->isFunctionPointerType() ||
-         T->isBlockPointerType() || T->isRecordType();
+static bool MayBeFunctionType(const ASTContext &Context, const Expr* E) {
+    QualType T = E->getType();
+    if(T->isDependentType())
+        return true;
+
+    if( T == Context.BoundMemberTy || T == Context.UnknownAnyTy ||
+        T == Context.BuiltinFnTy || T == Context.OverloadTy ||
+        T->isFunctionType() || T->isFunctionReferenceType() ||
+        T->isMemberFunctionPointerType() || T->isFunctionPointerType() ||
+        T->isBlockPointerType() || T->isRecordType())
+        return true;
+
+    return isa<CallExpr,
+               DeclRefExpr,
+               MemberExpr,
+               CXXPseudoDestructorExpr,
+               OverloadExpr,
+               UnresolvedMemberExpr,
+               UnaryOperator>(E);
 }
 
 ExprResult Sema::BuildCallExpr(Scope *Scope, Expr *Fn, SourceLocation LParenLoc,
@@ -6606,8 +6619,7 @@ ExprResult Sema::BuildCallExpr(Scope *Scope, Expr *Fn, SourceLocation LParenLoc,
         // If the type of the function itself is not dependent
         // check that it is a reasonable as a function, as type deduction
         // later assume the CallExpr has a sensible TYPE.
-        if (!Fn->getType()->isDependentType() &&
-            !MayBeFunctionType(Context, Fn->getType()))
+        if (!MayBeFunctionType(Context, Fn))
           return ExprError(
               Diag(LParenLoc, diag::err_typecheck_call_not_function)
               << Fn->getType() << Fn->getSourceRange());
diff --git a/clang/test/SemaTemplate/fun-template-def.cpp b/clang/test/SemaTemplate/fun-template-def.cpp
index 716296e72bc44..e666326202521 100644
--- a/clang/test/SemaTemplate/fun-template-def.cpp
+++ b/clang/test/SemaTemplate/fun-template-def.cpp
@@ -33,7 +33,7 @@ T f1(T t1, U u1, int i1, T** tpp)
   i1 = t1[u1];
   i1 *= t1;
 
-  i1(u1, t1); // expected-error {{called object type 'int' is not a function or function pointer}}
+  i1(u1, t1);
   u1(i1, t1);
 
   U u2 = (T)i1;
@@ -108,4 +108,51 @@ auto k = c_<1>; // expected-note {{in instantiation of variable}}
 
 }
 
+namespace GH138731 {
+template <class...>
+using void_t = void;
+template <class...>
+using void_t = void;
+
+template <class T>
+T&& declval();
+
+struct S {
+  S();
+  static int f();
+  static int var;
+};
+
+namespace invoke_detail {
+
+template <typename F>
+struct traits {
+  template <typename... A>
+  using result = decltype(declval<F>()(declval<A>()...));
+};
+
+template <typename F, typename... A>
+using invoke_result_t = typename traits<F>::template result<A...>;
+
+template <typename Void, typename F, typename... A>
+inline constexpr bool is_invocable_v = false;
+
+template <typename F, typename... A>
+inline constexpr bool
+    is_invocable_v<void_t<invoke_result_t<F, A...>>, F, A...> = true;
+
+}
+
+template <typename F, typename... A>
+inline constexpr bool is_invocable_v =
+    invoke_detail::is_invocable_v<void, F, A...>;
+
+static_assert(!is_invocable_v<int>);
+static_assert(!is_invocable_v<int, int>);
+static_assert(!is_invocable_v<S>);
+static_assert(is_invocable_v<decltype(&S::f)>);
+static_assert(!is_invocable_v<decltype(&S::var)>);
+
+}
+
 #endif



More information about the cfe-commits mailing list