[clang] d94a828 - [clang][bytecode] Don't crash on a null Descriptor (#160506)

[via cfe-commits]

Author: Timm Baeder
Date: 2025-09-24T14:48:38+02:00
New Revision: d94a8282fbc60bcbb94732f06c98b93a7b09a35f

URL: https://github.com/llvm/llvm-project/commit/d94a8282fbc60bcbb94732f06c98b93a7b09a35f
DIFF: https://github.com/llvm/llvm-project/commit/d94a8282fbc60bcbb94732f06c98b93a7b09a35f.diff

LOG: [clang][bytecode] Don't crash on a null Descriptor (#160506)

... for dynamic memory allocation. This happens when the requested array
size is too large.

Fixes #152951

Added: 
    

Modified: 
    clang/lib/AST/ByteCode/Interp.h
    clang/test/AST/ByteCode/new-delete.cpp

Removed: 
    


################################################################################
diff  --git a/clang/lib/AST/ByteCode/Interp.h b/clang/lib/AST/ByteCode/Interp.h
index 3bc1a67feeba2..72288ed97db21 100644
--- a/clang/lib/AST/ByteCode/Interp.h
+++ b/clang/lib/AST/ByteCode/Interp.h
@@ -3534,6 +3534,9 @@ inline bool AllocCN(InterpState &S, CodePtr OpPC, const Descriptor *ElementDesc,
   if (!CheckDynamicMemoryAllocation(S, OpPC))
     return false;
 
+  if (!ElementDesc)
+    return false;
+
   SizeT NumElements = S.Stk.pop<SizeT>();
   if (!CheckArraySize(S, OpPC, &NumElements, ElementDesc->getSize(),
                       IsNoThrow)) {

diff  --git a/clang/test/AST/ByteCode/new-delete.cpp b/clang/test/AST/ByteCode/new-delete.cpp
index af747d7a15b12..f54854070573c 100644
--- a/clang/test/AST/ByteCode/new-delete.cpp
+++ b/clang/test/AST/ByteCode/new-delete.cpp
@@ -1091,6 +1091,19 @@ namespace NewNegSizeNothrow {
   static_assert(test_nothrow_neg_size(), "expected nullptr");
 } // namespace NewNegSizeNothrow
 
+#if __SIZEOF_SIZE_T == 8
+/// We can't allocate the array here as it is too big.
+/// Make sure we're not crashing by assuming an non-null
+/// Descriptor.
+namespace HugeAllocation {
+  void *p;
+  void foo ()
+  {
+    p = new char [256][256][256][256][256];
+  }
+}
+#endif
+
 #else
 /// Make sure we reject this prior to C++20
 constexpr int a() { // both-error {{never produces a constant expression}}