[clang] [Sema] Fix crash on arithmetic on _Atomic function pointer (PR #228255)

Krisitan Erik Olsen via cfe-commits cfe-commits at lists.llvm.org
Fri Oct 9 13:50:47 PDT 2026


================
@@ -11541,30 +11541,33 @@ static void diagnoseSubtractionOnNullPointer(Sema &S, SourceLocation Loc,
 
 /// Diagnose invalid arithmetic on two function pointers.
 static void diagnoseArithmeticOnTwoFunctionPointers(Sema &S, SourceLocation Loc,
-                                                    Expr *LHS, Expr *RHS) {
-  assert(LHS->getType()->isAnyPointerType());
-  assert(RHS->getType()->isAnyPointerType());
+                                                    Expr *LHS, Expr *RHS,
+                                                    QualType LHSType,
+                                                    QualType RHSType) {
----------------
Kristianerik wrote:

Thank you for the follow up I agree that the structural separation is the right approach. I'd like to help on the refactor. I want to make sure I understand the scope correctly. 

Is the goal is to restructure the pointer arithmetic checking so that:

Pre-conversion checks run on the original expression (diagnostics that need the original type, like "this is an _Atomic function pointer")
DefaultFunctionArrayLvalueConversion runs, stripping _Atomic, decaying arrays/functions
Post-conversion checks run on the clean expression (assertions, type queries that expect a plain pointer)

Is this scoped to checkArithmeticOpPointerOperand, checkArithmeticBinOpPointerOperands, and their callers (CheckIncrementDecrementOperand, the additive operator paths at lines ~11875 and ~12010)? Or do you see this extending to the diagnoseArithmeticOn* functions as well?

Also, should the conversion move into the check functions themselves (as in your example), or should the callers do the conversion and pass the converted expression?

https://github.com/llvm/llvm-project/pull/228255


More information about the cfe-commits mailing list