[clang] ASTMatchers: Fix out-of-bounds access in foreachArgumentWithParamType.

[flx]

Summary

The matcher crashes when a variadic function pointer is invoked because the
FunctionProtoType has fewer parameters than arguments.

Matching of non-variadic arguments now works.

[mubarizafzal]

Hi, this patch is causing a build failure for clang-ppc64le-rhel, can this be reverted?

[flx]

In D114559#3195357, @mubarizafzal wrote:

Hi, this patch is causing a build failure for clang-ppc64le-rhel, can this be reverted?

Hi, I just submitted a forward fix with: https://reviews.llvm.org/D115809

Please let me know if this is not addressing the issue.

[mubarizafzal]

In D114559#3195423, @flx wrote:

In D114559#3195357, @mubarizafzal wrote:

Hi, this patch is causing a build failure for clang-ppc64le-rhel, can this be reverted?

Hi, I just submitted a forward fix with: https://reviews.llvm.org/D115809

Please let me know if this is not addressing the issue.

This looks to have resolved the issue, thanks!

clang/include/clang/ASTMatchers/ASTMatchers.h

AST_POLYMORPHIC_MATCHER_P2(forEachArgumentWithParamType,
   for (; ArgIndex < NumArgs; ++ArgIndex, ++ParamIndex) {
     BoundNodesTreeBuilder ArgMatches(*Builder);
     if (ArgMatcher.matches(*(Node.getArg(ArgIndex)->IgnoreParenCasts()), Finder,
                            &ArgMatches)) {
       BoundNodesTreeBuilder ParamMatches(ArgMatches);
 
       // This test is cheaper compared to the big matcher in the next if.
       // Therefore, please keep this order.
-      if (FProto) {
+      if (FProto && FProto->getNumParams() > ParamIndex) {
         QualType ParamType = FProto->getParamType(ParamIndex);
         if (ParamMatcher.matches(ParamType, Finder, &ParamMatches)) {
           Result.addMatch(ParamMatches);
           Matched = true;
           continue;
         }
       }
       if (expr(anyOf(cxxConstructExpr(hasDeclaration(cxxConstructorDecl(

clang/unittests/ASTMatchers/ASTMatchersTraversalTest.cpp

StringRef S = "struct A {\n"
                 "  (a.*(a.x))(y);\n"
                 "}";
   EXPECT_TRUE(matchAndVerifyResultTrue(
       S, CallExpr, std::make_unique<VerifyIdIsBoundTo<QualType>>("type")));
   EXPECT_TRUE(matchAndVerifyResultTrue(
       S, CallExpr, std::make_unique<VerifyIdIsBoundTo<DeclRefExpr>>("arg")));
 }
 
+TEST(ForEachArgumentWithParamType, MatchesVariadicFunctionPtrCalls) {
+  StatementMatcher ArgumentY =
+      declRefExpr(to(varDecl(hasName("y")))).bind("arg");
+  TypeMatcher IntType = qualType(builtinType()).bind("type");
+  StatementMatcher CallExpr =
+      callExpr(forEachArgumentWithParamType(ArgumentY, IntType));
+
+  StringRef S = R"cpp(
+    void fcntl(int fd, int cmd, ...) {}
+
+    template <typename Func>
+    void f(Func F) {
+      int y = 42;
+      F(y, 1, 3);
+    }
+
+    void g() { f(fcntl); }
+  )cpp";
+
+  EXPECT_TRUE(matchAndVerifyResultTrue(
+      S, CallExpr, std::make_unique<VerifyIdIsBoundTo<QualType>>("type")));
+  EXPECT_TRUE(matchAndVerifyResultTrue(
+      S, CallExpr, std::make_unique<VerifyIdIsBoundTo<DeclRefExpr>>("arg")));
+}
+
 TEST(QualType, hasCanonicalType) {
   EXPECT_TRUE(notMatches("typedef int &int_ref;"
                            "int a;"
                            "int_ref b = a;",
                          varDecl(hasType(qualType(referenceType())))));
   EXPECT_TRUE(
     matches("typedef int &int_ref;"
               "int a;"