[clang] 14aebab - [analyzer] Fix crash destructing element of a sugared array type

[via cfe-commits]

Author: Arseniy Zaostrovnykh
Date: 2026-09-07T19:52:39Z
New Revision: 14aebab4c6fe5c9f937efcdf1ea184495de6b737

URL: https://github.com/llvm/llvm-project/commit/14aebab4c6fe5c9f937efcdf1ea184495de6b737
DIFF: https://github.com/llvm/llvm-project/commit/14aebab4c6fe5c9f937efcdf1ea184495de6b737.diff

LOG: [analyzer] Fix crash destructing element of a sugared array type

ExprEngine::makeElementRegion falls short trying to determine the
element type of an array that involves a type aliasing a static array
type.

This leads to a crash in ExprEngine::ProcessMemberDtor where it assumes
that element type is a CXXRecordDecl, while it is still a type alias to
a static array type.

getBaseElementType is the canonical way to desugar and peel off the
array dimensions.

Assisted by Claude Opus 5

--
CPP-8838

Added: 
    

Modified: 
    clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
    clang/test/Analysis/dtor-array.cpp

Removed: 
    


################################################################################
diff  --git a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
index 9fb167ee2ea4a..bb6deabba8a43 100644
--- a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
+++ b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
@@ -105,13 +105,9 @@ void ExprEngine::performTrivialCopy(ExplodedNodeSet &Dst, ExplodedNode *Pred,
 SVal ExprEngine::makeElementRegion(ProgramStateRef State, SVal LValue,
                                    QualType &Ty, bool &IsArray, unsigned Idx) {
   SValBuilder &SVB = State->getStateManager().getSValBuilder();
-  ASTContext &Ctx = SVB.getContext();
 
-  if (const ArrayType *AT = Ctx.getAsArrayType(Ty)) {
-    while (AT) {
-      Ty = AT->getElementType();
-      AT = dyn_cast<ArrayType>(AT->getElementType());
-    }
+  if (Ty->isArrayType()) {
+    Ty = SVB.getContext().getBaseElementType(Ty);
     LValue = State->getLValue(Ty, SVB.makeArrayIndex(Idx), LValue);
     IsArray = true;
   }

diff  --git a/clang/test/Analysis/dtor-array.cpp b/clang/test/Analysis/dtor-array.cpp
index 84a34af922516..1639c66c65869 100644
--- a/clang/test/Analysis/dtor-array.cpp
+++ b/clang/test/Analysis/dtor-array.cpp
@@ -326,6 +326,13 @@ void multidimensionalMember(){
   clang_analyzer_eval(EvalOrderArr[3] == 0); // expected-warning {{TRUE}}
 }
 
+void typedefMultidimensionalNoCrash(){
+  // The inner dimension is hidden behind a typedef, so the element type of the
+  // outer array is a TypedefType rather than a ConstantArrayType.
+  typedef EvalOrder EvalOrderRow[2];
+  EvalOrderRow arr[2]; // no-crash
+}
+
 void *memset(void *, int, size_t);
 void clang_analyzer_dumpElementCount(InlineDtor *);