[Clang] Fix unconditional access to Attr pointer when checking if _Nullable is applicable to a type

[shafik]

Summary

In TransformAttributedType(...) when checking if _Nullable can be applied to a type it dereferences TL.getAttr() unconditionally which we can see from the code earlier in the function is not correct since it is expected to be nullptr in some cases.

It looks like the correct course of action is to use TL.getModifiedLoc() over TL.getAttr()->getLocation() in the case that TL.getAttr() returns a nullptr.

Fixes: https://github.com/llvm/llvm-project/issues/60344

[gribozavr2]

Thank you for the fix!

[erichkeane]

Needs a release note, otherwise LGTM.

[shafik]

• Add release note

[gribozavr2]

clang/docs/ReleaseNotes.rst

60

[shafik]

• Fix up release notes

[shafik]

The build failures look unrelated to this change.

clang/docs/ReleaseNotes.rst

 Major New Features
 ------------------
 
 Bug Fixes
 ---------
 - Fix crash on invalid code when looking up a destructor in a templated class
   inside a namespace. This fixes
   `Issue 59446 <https://github.com/llvm/llvm-project/issues/59446>`_.
+- Fix crash when diagnosing incorrect usage of ``_Nullable`` involving alias
+  templates. This fixes
+  `Issue 60344 <https://github.com/llvm/llvm-project/issues/60344>`_.
 
 Improvements to Clang's diagnostics
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 Non-comprehensive list of changes in this release
 -------------------------------------------------
 
 New Compiler Flags

clang/lib/Sema/TreeTransform.h

QualType equivalentType
       = getDerived().TransformType(oldType->getEquivalentType());
     if (equivalentType.isNull())
       return QualType();
 
     // Check whether we can add nullability; it is only represented as
     // type sugar, and therefore cannot be diagnosed in any other way.
     if (auto nullability = oldType->getImmediateNullability()) {
       if (!modifiedType->canHaveNullability()) {
-        SemaRef.Diag(TL.getAttr()->getLocation(),
+        SemaRef.Diag((TL.getAttr() ? TL.getAttr()->getLocation()
+                                   : TL.getModifiedLoc().getBeginLoc()),
                      diag::err_nullability_nonpointer)
             << DiagNullabilityKind(*nullability, false) << modifiedType;
         return QualType();
       }
     }
 
     result = SemaRef.Context.getAttributedType(TL.getAttrKind(),
                                                modifiedType,

clang/test/SemaCXX/nullability.cpp

void arraysInLambdas() {
   auto withTypedef = [](INTS _Nonnull) {};
   withTypedef(nullptr); // expected-warning {{null passed to a callee that requires a non-null argument}}
   auto withTypedefBad = [](INTS _Nonnull[2]) {}; // expected-error {{nullability specifier '_Nonnull' cannot be applied to non-pointer type 'INTS' (aka 'int[4]')}}
 }
 
 void testNullabilityCompletenessWithTemplate() {
   Template<int*> tip;
 }
+
+namespace GH60344 {
+class a;
+template <typename b> using c = b _Nullable; // expected-error {{'_Nullable' cannot be applied to non-pointer type 'GH60344::a'}}
+c<a>;  // expected-note {{in instantiation of template type alias 'c' requested here}}
+}