[clang] [LifetimeSafety] Fix crash on ternary operator when one of the expressions is `throw` (PR #190345)
Gábor Horváth via cfe-commits
cfe-commits at lists.llvm.org
Tue Apr 7 03:07:40 PDT 2026
Xazax-hun wrote:
Yeah, pushing the code somewhere would be helpful.
But this is what I had in mind:
CFG block corresponding to the ternary AST node (Let's call it A)
CFG block corresponding to the true branch's AST node (B)
CFG block corresponding to the false branch's AST node (C)
And in most cases it should look like:
```
B C
\ /
A
```
So you need to check if `B` is in the preds of `A` before doing the flow, same for `C`.
If I look at the CFG for some code like `int *p = cond ? nullptr : throw i;`
I see:
```
[B5 (ENTRY)]
Succs (1): B4
[B1]
1: [B4.3] ? [B2.1] : [B3.4]
2: [B1.1] (ImplicitCastExpr, NullToPointer, int *)
3: int *p = cond ? nullptr : throw i;
Preds (1): B2
Succs (1): B0
[B2]
1: nullptr
Preds (1): B4
Succs (1): B1
[B3]
1: i
2: [B3.1] (ImplicitCastExpr, NoOp, int)
3: [B3.2] (ImplicitCastExpr, LValueToRValue, int)
4: throw [B3.3]
Preds (1): B4
Succs (1): B0
[B4]
1: int i;
2: cond
3: [B4.2] (ImplicitCastExpr, LValueToRValue, _Bool)
T: [B4.3] ? ... : ...
Preds (1): B5
Succs (2): B2 B3
[B0 (EXIT)]
Preds (2): B1 B3
```
You can see that `B1` here has only one predecessor. This is what we want to detect.
https://github.com/llvm/llvm-project/pull/190345
More information about the cfe-commits
mailing list