CFGBuilder: Fix crash when visiting delete expression on dependent type

[mboehme]

Summary

CXXDeleteExpr::getDestroyedType() can return a null QualType if the destroyed
type is a dependent type. This patch protects against this.

[klimek]

lg

cfe/trunk/lib/Analysis/CFG.cpp

CFGBlock *CFGBuilder::VisitCXXNewExpr(CXXNewExpr *NE,
   return Block;
 }
 
 CFGBlock *CFGBuilder::VisitCXXDeleteExpr(CXXDeleteExpr *DE,
                                          AddStmtChoice asc) {
   autoCreateBlock();
   appendStmt(Block, DE);
   QualType DTy = DE->getDestroyedType();
+  if (!DTy.isNull()) {
     DTy = DTy.getNonReferenceType();
     CXXRecordDecl *RD = Context->getBaseElementType(DTy)->getAsCXXRecordDecl();
     if (RD) {
       if (RD->isCompleteDefinition() && !RD->hasTrivialDestructor())
         appendDeleteDtor(Block, RD, DE);
     }
+  }
 
   return VisitChildren(DE);
 }
 
 CFGBlock *CFGBuilder::VisitCXXFunctionalCastExpr(CXXFunctionalCastExpr *E,
                                                  AddStmtChoice asc) {
   if (asc.alwaysAdd(*this, E)) {
     autoCreateBlock();

cfe/trunk/unittests/Analysis/CFGTest.cpp

 #include "gtest/gtest.h"
 #include <string>
 #include <vector>
 
 namespace clang {
 namespace analysis {
 namespace {
 
-// Constructing a CFG for a range-based for over a dependent type fails (but
-// should not crash).
-TEST(CFG, RangeBasedForOverDependentType) {
-  const char *Code = "class Foo;\n"
-                     "template <typename T>\n"
-                     "void f(const T &Range) {\n"
-                     "  for (const Foo *TheFoo : Range) {\n"
-                     "  }\n"
-                     "}\n";
+enum BuildResult {
+  ToolFailed,
+  ToolRan,
+  SawFunctionBody,
+  BuiltCFG,
+};
 
-  class CFGCallback : public ast_matchers::MatchFinder::MatchCallback {
-  public:
-    bool SawFunctionBody = false;
+  BuildResult TheBuildResult = ToolRan;
 
-    void run(const ast_matchers::MatchFinder::MatchResult &Result) override {
-      const auto *Func = Result.Nodes.getNodeAs<FunctionDecl>("func");
-      Stmt *Body = Func->getBody();
-      if (!Body)
-        return;
-      SawFunctionBody = true;
-      std::unique_ptr<CFG> cfg =
-          CFG::buildCFG(nullptr, Body, Result.Context, CFG::BuildOptions());
-      EXPECT_EQ(nullptr, cfg);
-    }
-  } Callback;
+    TheBuildResult = SawFunctionBody;
+    if (CFG::buildCFG(nullptr, Body, Result.Context, CFG::BuildOptions()))
+        TheBuildResult = BuiltCFG;
+};
+
+BuildResult BuildCFG(const char *Code) {
+  CFGCallback Callback;
 
   ast_matchers::MatchFinder Finder;
   Finder.addMatcher(ast_matchers::functionDecl().bind("func"), &Callback);
   std::unique_ptr<tooling::FrontendActionFactory> Factory(
       tooling::newFrontendActionFactory(&Finder));
   std::vector<std::string> Args = {"-std=c++11", "-fno-delayed-template-parsing"};
-  ASSERT_TRUE(tooling::runToolOnCodeWithArgs(Factory->create(), Code, Args));
-  EXPECT_TRUE(Callback.SawFunctionBody);
+  if (!tooling::runToolOnCodeWithArgs(Factory->create(), Code, Args))
+    return ToolFailed;
+  return Callback.TheBuildResult;
+}
+
+// Constructing a CFG for a range-based for over a dependent type fails (but
+// should not crash).
+TEST(CFG, RangeBasedForOverDependentType) {
+  const char *Code = "class Foo;\n"
+                     "template <typename T>\n"
+                     "void f(const T &Range) {\n"
+                     "  for (const Foo *TheFoo : Range) {\n"
+                     "  }\n"
+                     "}\n";
+  EXPECT_EQ(SawFunctionBody, BuildCFG(Code));
+}
+
+// Constructing a CFG containing a delete expression on a dependent type should
+// not crash.
+TEST(CFG, DeleteExpressionOnDependentType) {
+  const char *Code = "template<class T>\n"
+                     "void f(T t) {\n"
+                     "  delete t;\n"
+                     "}\n";
+  EXPECT_EQ(BuiltCFG, BuildCFG(Code));
 }
 
 } // namespace
 } // namespace analysis
 } // namespace clang