[clang] [analyzer] Fix crash in PaddingChecker on dependent field types (PR #232986)
Manuel Sainz de Baranda y Goñi via cfe-commits
cfe-commits at lists.llvm.org
Sat Oct 17 11:51:31 PDT 2026
https://github.com/redcode updated https://github.com/llvm/llvm-project/pull/232986
>From cf6bc51b6c05b752d249c32ceb6a066fa6daffad Mon Sep 17 00:00:00 2001
From: redcode <manuel at zxe.io>
Date: Sat, 17 Oct 2026 01:50:04 +0200
Subject: [PATCH 1/3] [analyzer] Fix crash in PaddingChecker on dependent field
types
---
clang/lib/StaticAnalyzer/Checkers/PaddingChecker.cpp | 6 ++++++
clang/test/Analysis/padding_dependent.cpp | 7 +++++++
2 files changed, 13 insertions(+)
create mode 100644 clang/test/Analysis/padding_dependent.cpp
diff --git a/clang/lib/StaticAnalyzer/Checkers/PaddingChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/PaddingChecker.cpp
index c8d7b6555f3f42..8fbd1831f91756 100644
--- a/clang/lib/StaticAnalyzer/Checkers/PaddingChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/PaddingChecker.cpp
@@ -178,6 +178,12 @@ class PaddingChecker : public Checker<check::ASTDecl<TranslationUnitDecl>> {
QualType Ty = FD->getType();
if (Ty->isIncompleteArrayType())
return true;
+ // Dependent field types have no known layout, so we can't compute the
+ // padding of the enclosing record. This can happen for lambda captures
+ // in a dependent context, e.g. an init-capture of a forwarding reference
+ // inside a noexcept specifier.
+ if (Ty->isDependentType())
+ return true;
return false;
};
diff --git a/clang/test/Analysis/padding_dependent.cpp b/clang/test/Analysis/padding_dependent.cpp
new file mode 100644
index 00000000000000..ea337d13379503
--- /dev/null
+++ b/clang/test/Analysis/padding_dependent.cpp
@@ -0,0 +1,7 @@
+// RUN: %clang_analyze_cc1 -std=c++20 -analyzer-checker=optin.performance -verify %s
+
+// The static analyzer must not crash when computing the layout of a lambda
+// closure type with a dependent init-capture inside a noexcept specifier.
+// https://github.com/llvm/llvm-project/issues/232874
+// expected-no-diagnostics
+void crasher(auto&& fn) noexcept(noexcept([_ = fn] {})) {}
>From 81cd7c09aca49ef26ca369734fb57d8b951a1723 Mon Sep 17 00:00:00 2001
From: redcode <manuel at zxe.io>
Date: Sat, 17 Oct 2026 17:51:57 +0200
Subject: [PATCH 2/3] Add FIXME to `Sema::ActOnLambdaExpressionAfterIntroducer`
and reword comment in `PaddingChecker::shouldSkipDecl`
---
clang/lib/Sema/SemaLambda.cpp | 8 ++++++++
clang/lib/StaticAnalyzer/Checkers/PaddingChecker.cpp | 9 +++++----
2 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/clang/lib/Sema/SemaLambda.cpp b/clang/lib/Sema/SemaLambda.cpp
index 0c9a92cdd0c320..3f77c57223a46a 100644
--- a/clang/lib/Sema/SemaLambda.cpp
+++ b/clang/lib/Sema/SemaLambda.cpp
@@ -1141,6 +1141,14 @@ void Sema::ActOnLambdaExpressionAfterIntroducer(LambdaIntroducer &Intro,
// Determine if we're within a context where we know that the lambda will
// be dependent, because there are template parameters in scope.
+ //
+ // FIXME: A lambda in the noexcept specifier of an abbreviated function
+ // template (e.g. `auto&&`) is not marked dependent, even though it captures
+ // a dependent entity. Could this be because the implicit template parameter
+ // is not in scope while the specifier is parsed, leaving the lambda's
+ // dependency kind as LDK_Unknown? See:
+ // * https://github.com/llvm/llvm-project/issues/232874
+ // * https://github.com/llvm/llvm-project/issues/233102
CXXRecordDecl::LambdaDependencyKind LambdaDependencyKind =
CXXRecordDecl::LDK_Unknown;
if (CurScope->getTemplateParamParent() != nullptr) {
diff --git a/clang/lib/StaticAnalyzer/Checkers/PaddingChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/PaddingChecker.cpp
index 8fbd1831f91756..d444a039d39a77 100644
--- a/clang/lib/StaticAnalyzer/Checkers/PaddingChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/PaddingChecker.cpp
@@ -178,10 +178,11 @@ class PaddingChecker : public Checker<check::ASTDecl<TranslationUnitDecl>> {
QualType Ty = FD->getType();
if (Ty->isIncompleteArrayType())
return true;
- // Dependent field types have no known layout, so we can't compute the
- // padding of the enclosing record. This can happen for lambda captures
- // in a dependent context, e.g. an init-capture of a forwarding reference
- // inside a noexcept specifier.
+ // Defensive backstop: a lambda closure type can be left non-dependent
+ // due to a bug in Sema (see SemaLambda.cpp), leaving a field of a bare
+ // dependent type whose layout cannot be computed. See:
+ // * https://github.com/llvm/llvm-project/issues/232874
+ // * https://github.com/llvm/llvm-project/issues/233102
if (Ty->isDependentType())
return true;
return false;
>From cb4bfdcdf7491ed951ad6e4c1d00f16b7f9a5c12 Mon Sep 17 00:00:00 2001
From: redcode <manuel at zxe.io>
Date: Sat, 17 Oct 2026 20:51:09 +0200
Subject: [PATCH 3/3] Move `clang/test/Analysis/padding_dependent.cpp` into
`clang/test/Analysis/padding_cpp.cpp`
---
clang/test/Analysis/padding_cpp.cpp | 3 ++-
clang/test/Analysis/padding_dependent.cpp | 7 -------
2 files changed, 2 insertions(+), 8 deletions(-)
delete mode 100644 clang/test/Analysis/padding_dependent.cpp
diff --git a/clang/test/Analysis/padding_cpp.cpp b/clang/test/Analysis/padding_cpp.cpp
index f0e8beacda7630..603cb21c89ea35 100644
--- a/clang/test/Analysis/padding_cpp.cpp
+++ b/clang/test/Analysis/padding_cpp.cpp
@@ -1,4 +1,4 @@
-// RUN: %clang_analyze_cc1 -std=c++14 -analyzer-checker=optin.performance -analyzer-config optin.performance.Padding:AllowedPad=2 -verify %s
+// RUN: %clang_analyze_cc1 -std=c++20 -analyzer-checker=optin.performance -analyzer-config optin.performance.Padding:AllowedPad=2 -verify %s
// Make sure that the C cases still work fine, even when compiled as C++.
#include "padding_c.c"
@@ -200,3 +200,4 @@ struct GlobalsForLambda { // no-warning
// expected-warning at +1{{Excessive padding in 'class (lambda}}
auto lambda1 = [ c1 = G.c1, i = G.i, c2 = G.c2 ]{};
auto lambda2 = [ i = G.i, c1 = G.c1, c2 = G.c2 ]{}; // no-warning
+void crasher(auto&& fn) noexcept(noexcept([_ = fn] {})) {} // no-crash: gh #232874
diff --git a/clang/test/Analysis/padding_dependent.cpp b/clang/test/Analysis/padding_dependent.cpp
deleted file mode 100644
index ea337d13379503..00000000000000
--- a/clang/test/Analysis/padding_dependent.cpp
+++ /dev/null
@@ -1,7 +0,0 @@
-// RUN: %clang_analyze_cc1 -std=c++20 -analyzer-checker=optin.performance -verify %s
-
-// The static analyzer must not crash when computing the layout of a lambda
-// closure type with a dependent init-capture inside a noexcept specifier.
-// https://github.com/llvm/llvm-project/issues/232874
-// expected-no-diagnostics
-void crasher(auto&& fn) noexcept(noexcept([_ = fn] {})) {}
More information about the cfe-commits
mailing list