PR23057: Fix assertion `Val && "isa<> used on a null pointer"' on invalid for-range expression

[• d.zobnin.bugzilla]

Summary

Fix the issue discovered by fuzzing (https://llvm.org/bugs/show_bug.cgi?id=23057#c18) by handling nullptr in Sema::ActOnCXXForRangeDecl and correct delayed typos in for-range expression before calling Sema::ActOnCXXForRangeStmt (fixes PR26288 as well).

[majnemer]

lib/Parse/ParseStmt.cpp

1719–1724

Does this change effect all of the test cases you've added? If not, I think it would make sense to split this change out.

[• d.zobnin.bugzilla]

lib/Parse/ParseStmt.cpp

1719–1724

Yes, this change is needed in all added test cases.
Without this we will have an assertion failure in ~Sema():

assert(DelayedTypos.empty() && "Uncorrected typos!");

[majnemer]

LGTM

lib/Parse/ParseStmt.cpp

StmtResult Parser::ParseForStatement(SourceLocation *TrailingElseLoc) {
 
   // We need to perform most of the semantic analysis for a C++0x for-range
   // statememt before parsing the body, in order to be able to deduce the type
   // of an auto-typed loop variable.
   StmtResult ForRangeStmt;
   StmtResult ForEachStmt;
 
   if (ForRange) {
+    ExprResult CorrectedRange =
+        Actions.CorrectDelayedTyposInExpr(ForRangeInit.RangeExpr.get());
     ForRangeStmt = Actions.ActOnCXXForRangeStmt(
         getCurScope(), ForLoc, CoawaitLoc, FirstPart.get(),
-        ForRangeInit.ColonLoc, ForRangeInit.RangeExpr.get(),
+        ForRangeInit.ColonLoc, CorrectedRange.get(),
         T.getCloseLocation(), Sema::BFRK_Build);
 
   // Similarly, we need to do the semantic analysis for a for-range
   // statement immediately in order to close over temporaries correctly.
   } else if (ForEach) {
     ForEachStmt = Actions.ActOnObjCForCollectionStmt(ForLoc,
                                                      FirstPart.get(),
                                                      Collection.get(),
                                                      T.getCloseLocation());

lib/Sema/SemaDecl.cpp

else if (Init.get()) {
       Var->setInitStyle(VarDecl::CallInit);
     }
 
     CheckCompleteVariableDeclaration(Var);
   }
 }
 
 void Sema::ActOnCXXForRangeDecl(Decl *D) {
+  // If there is no declaration, there was an error parsing it. Ignore it.
+  if (!D)
+    return;
+
   VarDecl *VD = dyn_cast<VarDecl>(D);
   if (!VD) {
     Diag(D->getLocation(), diag::err_for_range_decl_must_be_var);
     D->setInvalidDecl();
     return;
   }
 
   VD->setCXXForRangeDecl(true);

test/CXX/dcl.dcl/dcl.spec/dcl.type/p3-0x.cpp

 struct A {};
 
 void f() {
   int arr[3] = {1,2,3};
 
   for (struct S { S(int) {} } s : arr) { // expected-error {{types may not be defined in a for range declaration}}
   }
 
+  for (struct S { S(int) {} } s : Undeclared); // expected-error{{types may not be defined in a for range declaration}}
+                                               // expected-error@-1{{use of undeclared identifier 'Undeclared'}}
+
   new struct T {}; // expected-error {{'T' cannot be defined in a type specifier}}
   new struct A {}; // expected-error {{'A' cannot be defined in a type specifier}}
 
   try {} catch (struct U {}) {} // expected-error {{'U' cannot be defined in a type specifier}}
 
   (void)(struct V { V(int); })0; // expected-error {{'V' cannot be defined in a type specifier}}
 
   (void)dynamic_cast<struct W {}*>((K*)0); // expected-error {{'W' cannot be defined in a type specifier}}

test/Parser/cxx-invalid-for-range.cpp

+// RUN: %clang_cc1 -std=c++11 -fsyntax-only -verify %s
+
+// From PR23057 comment #18 (https://llvm.org/bugs/show_bug.cgi?id=23057#c18).
+
+namespace N {
+  int X[10]; // expected-note{{declared here}}}}
+}
+
+void f1() {
+  for (auto operator new : X); // expected-error{{'operator new' cannot be the name of a variable or data member}}
+                               // expected-error@-1{{use of undeclared identifier 'X'; did you mean 'N::X'?}}
+}
+
+void f2() {
+  for (a operator== :) // expected-error{{'operator==' cannot be the name of a variable or data member}}
+                       // expected-error@-1{{expected expression}}
+                       // expected-error@-2{{unknown type name 'a'}}
+} // expected-error{{expected statement}}