[clang] [clang][analyzer] Fix for `security.ArrayBound` assertion failure on incomplete types (PR #231925)

[via cfe-commits]

https://github.com/matthew-j-code created https://github.com/llvm/llvm-project/pull/231925

When the check clang-analyzer-security.ArrayBound is enabled, for a forward declaration, or any incomplete types, it tries to calculate the offset, which is unknown, therefore can not be calculated, causing the assertion ElemType cannot be incomplete.

>From a2ffa678a6ca38cb5cfeffd58a9fa821f8b19aa7 Mon Sep 17 00:00:00 2001
From: "Jones, Matthew (DI SW SIM FRWK PLAT SIMFW HPC)"
 <jones.matthew at siemens.com>
Date: Tue, 13 Oct 2026 04:11:46 -0700
Subject: [PATCH] fix for ArrayBound check for incomplete types

---
 clang/docs/ReleaseNotes.md                              | 2 ++
 clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp | 6 ++++++
 clang/test/Analysis/ArrayBound/cplusplus.cpp            | 8 ++++++++
 3 files changed, 16 insertions(+)

diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md
index 1dc1764978ea27..32281e5ad67508 100644
--- a/clang/docs/ReleaseNotes.md
+++ b/clang/docs/ReleaseNotes.md
@@ -1188,6 +1188,8 @@ features cannot lower the translation-unit ABI level;
 %   - Moved checkers
 %   - Diagnostic changes
 
+- Fixed an assertion failure in the `alpha.security.ArrayBound` checker when analyzing incomplete types.
+
 #### Improvements
 
 - The lock-order-reversal check in ``alpha.unix.PthreadLock`` is now disabled by default.
diff --git a/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp
index 3acbf7cd75ab88..e75d43801864a1 100644
--- a/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp
@@ -230,6 +230,12 @@ computeOffset(ProgramStateRef State, SValBuilder &SVB,
     if (!Index)
       return std::nullopt;
 
+    // The size of an incomplete type (e.g forward declaration) is unknown, so
+    // the offset cannot be calculated.
+    QualType ElemType = CurRegion->getElementType();
+    if (ElemType->isIncompleteType())
+      return std::nullopt;
+
     // Calculate Delta = Index * sizeof(ElemType).
     NonLoc Size = SVB.makeArrayIndex(getElementSize(CurRegion, SVB));
     auto Delta = EvalBinOp(BO_Mul, *Index, Size);
diff --git a/clang/test/Analysis/ArrayBound/cplusplus.cpp b/clang/test/Analysis/ArrayBound/cplusplus.cpp
index 680fbf4817c301..457da1f15307ea 100644
--- a/clang/test/Analysis/ArrayBound/cplusplus.cpp
+++ b/clang/test/Analysis/ArrayBound/cplusplus.cpp
@@ -179,3 +179,11 @@ int test_reference_that_might_be_after_the_end(int idx) {
     return -1;
   return ref;
 }
+
+//The size of an incomplete type (e.g., a forward declaration) is unknown, so you cannot calculate the offset.
+struct Incomplete;
+void useIncomplete(Incomplete &);
+
+void test_incomplete(void *p) {
+  useIncomplete(*static_cast<Incomplete *>(p));
+}