[clang-tools-extra] 627bb2a - [clang-tidy] Fix crash on pointer arithmetic with an incomplete type in bugprone-pointer-arithmetic-on-polymorphic-object (#215724)

[via cfe-commits]

Author: Hao-Chen2337
Date: 2026-08-22T15:02:58+08:00
New Revision: 627bb2a66b679ead5e58761248e4878d8b55fba0

URL: https://github.com/llvm/llvm-project/commit/627bb2a66b679ead5e58761248e4878d8b55fba0
DIFF: https://github.com/llvm/llvm-project/commit/627bb2a66b679ead5e58761248e4878d8b55fba0.diff

LOG: [clang-tidy] Fix crash on pointer arithmetic with an incomplete type in bugprone-pointer-arithmetic-on-polymorphic-object (#215724)

This commit fixes a crash in clangd / clang-tidy: running
the `bugprone-pointer-arithmetic-on-polymorphic-object` check on code
that does pointer arithmetic on a pointer to an **incomplete type** (a
type that is forward-declared but never defined) makes the matcher hit
an assertion and abort.

AI note: Used AI tools for code analysis and wording polish.

Added: 
    

Modified: 
    clang-tools-extra/clang-tidy/bugprone/PointerArithmeticOnPolymorphicObjectCheck.cpp
    clang-tools-extra/docs/ReleaseNotes.md
    clang-tools-extra/test/clang-tidy/checkers/bugprone/pointer-arithmetic-on-polymorphic-object-all.cpp
    clang-tools-extra/test/clang-tidy/checkers/bugprone/pointer-arithmetic-on-polymorphic-object-decl-only.cpp

Removed: 
    


################################################################################
diff  --git a/clang-tools-extra/clang-tidy/bugprone/PointerArithmeticOnPolymorphicObjectCheck.cpp b/clang-tools-extra/clang-tidy/bugprone/PointerArithmeticOnPolymorphicObjectCheck.cpp
index ef5fee9f3d2c3..e54a77953283a 100644
--- a/clang-tools-extra/clang-tidy/bugprone/PointerArithmeticOnPolymorphicObjectCheck.cpp
+++ b/clang-tools-extra/clang-tidy/bugprone/PointerArithmeticOnPolymorphicObjectCheck.cpp
@@ -15,8 +15,12 @@ using namespace clang::ast_matchers;
 namespace clang::tidy::bugprone {
 
 namespace {
-AST_MATCHER(CXXRecordDecl, isAbstract) { return Node.isAbstract(); }
-AST_MATCHER(CXXRecordDecl, isPolymorphic) { return Node.isPolymorphic(); }
+AST_MATCHER(CXXRecordDecl, isAbstract) {
+  return Node.hasDefinition() && Node.isAbstract();
+}
+AST_MATCHER(CXXRecordDecl, isPolymorphic) {
+  return Node.hasDefinition() && Node.isPolymorphic();
+}
 } // namespace
 
 PointerArithmeticOnPolymorphicObjectCheck::

diff  --git a/clang-tools-extra/docs/ReleaseNotes.md b/clang-tools-extra/docs/ReleaseNotes.md
index d441867b2f7a7..f9565fd73b8b0 100644
--- a/clang-tools-extra/docs/ReleaseNotes.md
+++ b/clang-tools-extra/docs/ReleaseNotes.md
@@ -128,6 +128,10 @@ infrastructure are described first, followed by tool-specific sections.
   <clang-tidy/checks/bugprone/misplaced-operator-in-strlen-in-alloc>` when
   checking an array new expression without a size expression.
 
+- Fixed a crash in {doc}`bugprone-pointer-arithmetic-on-polymorphic-object
+  <clang-tidy/checks/bugprone/pointer-arithmetic-on-polymorphic-object>` when
+  the pointer points to an incomplete (forward-declared) type.
+
 - Fixed a crash in {doc}`bugprone-std-namespace-modification
   <clang-tidy/checks/bugprone/std-namespace-modification>` when checking
   lambda closure types used as template arguments.

diff  --git a/clang-tools-extra/test/clang-tidy/checkers/bugprone/pointer-arithmetic-on-polymorphic-object-all.cpp b/clang-tools-extra/test/clang-tidy/checkers/bugprone/pointer-arithmetic-on-polymorphic-object-all.cpp
index f8163a2fd3fb8..80be193a41535 100644
--- a/clang-tools-extra/test/clang-tidy/checkers/bugprone/pointer-arithmetic-on-polymorphic-object-all.cpp
+++ b/clang-tools-extra/test/clang-tidy/checkers/bugprone/pointer-arithmetic-on-polymorphic-object-all.cpp
@@ -150,3 +150,13 @@ struct TemplateHolder : Base {
     (void)x;
   }
 };
+
+// pointer arithmetic on an incomplete type must not crash the matcher.
+template <typename T>
+struct IncompletePointeeCrash {
+  struct Incomplete;
+  void f(Incomplete *p) {
+    p[0];
+    // no-warning
+  }
+};

diff  --git a/clang-tools-extra/test/clang-tidy/checkers/bugprone/pointer-arithmetic-on-polymorphic-object-decl-only.cpp b/clang-tools-extra/test/clang-tidy/checkers/bugprone/pointer-arithmetic-on-polymorphic-object-decl-only.cpp
index 48757bbc9b10e..f8a741cb5b174 100644
--- a/clang-tools-extra/test/clang-tidy/checkers/bugprone/pointer-arithmetic-on-polymorphic-object-decl-only.cpp
+++ b/clang-tools-extra/test/clang-tidy/checkers/bugprone/pointer-arithmetic-on-polymorphic-object-decl-only.cpp
@@ -139,3 +139,13 @@ void typeAliases(BaseAlias *b, DerivedAlias *d, FinalDerivedAlias *fd,
   fdp += 1;
   // no-warning
 }
+
+// pointer arithmetic on an incomplete type must not crash the matcher.
+template <typename T>
+struct IncompletePointeeCrash {
+  struct Incomplete;
+  void f(Incomplete *p) {
+    p[0];
+    // no-warning
+  }
+};