[Sema] Don't check bounds for function pointer

[ArcsinX]

Summary

Currently, clang crashes with i386 target on the following code:

void f() {
  f + 0xdead000000000000UL;
}

This problem is similar to the problem fixed in D104424, but that fix can't handle function pointer case, because getTypeSizeInCharsIfKnown() says that size is known and equal to 0 for function type.

This patch prevents bounds checking for function pointer, thus fixes the crash.

Fixes https://github.com/llvm/llvm-project/issues/50463

[erichkeane]

It seems like this entire section of code was added here: https://github.com/llvm/llvm-project/commit/ce44fe199bbfd4b5a44764b678c431fdc117116a

@chrish_ericsson_atx should probably take a look at this. That said, we might not want to early-exist here, I think we can just skip the IsUnboundedArray branch? This example worked correctly in the 12.0 branch, so I think it was fine before then.

[ArcsinX]

Check for function type only if IsUnboundedArray is true

[ArcsinX]

In D122748#3417240, @erichkeane wrote:

That said, we might not want to early-exist here, I think we can just skip the IsUnboundedArray branch?

It seems you are right, thanks, fixed.

[erichkeane]

I think I'm generally in favor, would still like to see the feedback from the original submitter here to see if there is more work to do in here that would be valuable.

clang/lib/Sema/SemaChecking.cpp

15498

Ah, I see... I originally made the comment thinking that we wanted to be able to get to ~15540 (which this 'return' would seem to undo), but I see this block ends in 'return' anyway. I'm happy with this change the way it is.

[ArcsinX]

Friendly ping.

In D122748#3417500, @erichkeane wrote:

would still like to see the feedback from the original submitter here to see if there is more work to do in here that would be valuable.

Unsure, maybe we can process without him? It seems his last activity here was more than six months ago.

[ArcsinX]

Friendly ping

[erichkeane]

Friendly ping

Unfriendly LGTM.

clang/lib/Sema/SemaChecking.cpp

void Sema::CheckArrayAccess(const Expr *BaseExpr, const Expr *IndexExpr,
 
   const NamedDecl *ND = nullptr;
   if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(BaseExpr))
     ND = DRE->getDecl();
   if (const MemberExpr *ME = dyn_cast<MemberExpr>(BaseExpr))
     ND = ME->getMemberDecl();
 
   if (IsUnboundedArray) {
+    if (EffectiveType->isFunctionType())
+      return;
     if (index.isUnsigned() || !index.isNegative()) {
       const auto &ASTC = getASTContext();
       unsigned AddrBits =
           ASTC.getTargetInfo().getPointerWidth(ASTC.getTargetAddressSpace(
               EffectiveType->getCanonicalTypeInternal()));
       if (index.getBitWidth() < AddrBits)
         index = index.zext(AddrBits);
       Optional<CharUnits> ElemCharUnits =

clang/test/Sema/unbounded-array-bounds.c

void f6(void) {
   // Should NOT produce a warning.
   *(middle + 5 - N) = 22;
 }
 
 void pr50741(void) {
   (void *)0 + 0xdead000000000000UL;
   // no array-bounds warning, and no crash
 }
+
+void func() {
+  func + 0xdead000000000000UL; // no crash
+}