[clang] [Clang] Fix crash when type-name is combined with class specifier in template argument (PR #191689)
Oliver Hunt via cfe-commits
cfe-commits at lists.llvm.org
Sun Apr 19 18:03:25 PDT 2026
ojhunt wrote:
Ok, I spent some time looking through this. I don't think this is the correct fix. The problem is the TypeSpecLocFiller is using the generic tree walker interface. This means that it treats all tag types the same way, and the problem here is that the AST includes the qualifier as specified, which is an (incorrect) tag type, e.g
```T struct Scoped::Type```
looks like
TopLevel:TagDecl
Qualifier: (invalid) {"T"(some location), TagDecl(T), etc }
UnqualifiedType: {"Scoped::Type"(some location), TagDecl(Scoped::Type), etc}
We then walk the AST assigning the qualifier info on every tag decl we encounter.
This means we set the qualifier info for TopLevel to the location of `T` as expected. But we then continue traversing the tree and that means encountering the TagDecl in TopLevel.Qualifier. TopLevel.Qualifier is the unqualified type `T`, and so when we try to set the qualifier we assert that that is nonsense.
I'm not sure that the AST could get into this state in any other way, which means it might be a matter of `TypeSpecLocFiller::VisitTagTypeLoc` returning early when attempting to set qualifier info when a qualifier isn't present. But that feels super fragile.
@corentin I'm not sure how this is prevented with the AST walker model?
https://github.com/llvm/llvm-project/pull/191689
More information about the cfe-commits
mailing list