Prevent ICE in dllexport class with _Atomic() data member

[wristow]

Summary

Guard against a null pointer dereference that caused Clang to crash
when processing a class containing an _Atomic(<typ>) data member,
and that is tagged with 'dllexport'.

[wristow]

When a class that has been tagged as dllexport (for an MSVC target) contains an atomic data member via the C11 '_Atomic' approach, the front end crashes with a null pointer dereference.
This patch fixes it by guarding the null dereference with the approach used by similar code in the same method.

[rjmccall]

lib/CodeGen/CGClass.cpp

1135 ↗

(On Diff #85998)

I would prefer:

if (MemberExpr *ME2 = dyn_cast<MemberExpr>(RHS)) {
  if (ME2->getMemberDecl() == Field)
    return Field;
}
return nullptr;

[wristow]

lib/CodeGen/CGClass.cpp

1135 ↗

(On Diff #85998)

I see that change removes the dyn_cast<FieldDecl>. Was that intended, or an oversight?

In terms of changing the code-structure, in code on it's own, I do like the approach you described. But in this case, there is a sequence of if (<condition1>) return nullptr; ... if (conditionN) return nullptr; return Field;. Then after the block containing that set of guarded nullptr returns with a final return Field;, there is a similar block. And then there is a third block with a similar set. So changing the structure in that way breaks that pattern. With that in mind, do you still want that change done?

[rjmccall]

lib/CodeGen/CGClass.cpp

1135 ↗

(On Diff #85998)

The dyn_cast has no effect. There is no situation in which the declarations would compare equal without it where they would not with it, because Field is already known to be a FieldDecl.

The structure of the existing code is unlikely to stay the same. Actually, that code is quite worrying — it's making a lot of assumptions about how Sema synthesizes defaulted assignment operator bodies. But I didn't want to ask you to fix it when it's not the subject of your bug.

[wristow]

Code restructured.

[wristow]

lib/CodeGen/CGClass.cpp

1135 ↗

(On Diff #85998)

Got it. Posted updated patch.

[rjmccall]

Thanks, looks good.

cfe/trunk/lib/CodeGen/CGClass.cpp

FieldDecl *getMemcpyableField(Stmt *S) {
         FieldDecl *Field = dyn_cast<FieldDecl>(ME->getMemberDecl());
         if (!Field || !isMemcpyableField(Field))
           return nullptr;
         Stmt *RHS = BO->getRHS();
         if (ImplicitCastExpr *EC = dyn_cast<ImplicitCastExpr>(RHS))
           RHS = EC->getSubExpr();
         if (!RHS)
           return nullptr;
-        MemberExpr *ME2 = dyn_cast<MemberExpr>(RHS);
-        if (dyn_cast<FieldDecl>(ME2->getMemberDecl()) != Field)
-          return nullptr;
+        if (MemberExpr *ME2 = dyn_cast<MemberExpr>(RHS)) {
+          if (ME2->getMemberDecl() == Field)
             return Field;
+        }
+        return nullptr;
       } else if (CXXMemberCallExpr *MCE = dyn_cast<CXXMemberCallExpr>(S)) {
         CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(MCE->getCalleeDecl());
         if (!(MD && isMemcpyEquivalentSpecialMember(MD)))
           return nullptr;
         MemberExpr *IOA = dyn_cast<MemberExpr>(MCE->getImplicitObjectArgument());
         if (!IOA)
           return nullptr;
         FieldDecl *Field = dyn_cast<FieldDecl>(IOA->getMemberDecl());

cfe/trunk/test/CodeGenCXX/atomic-dllexport.cpp

+// RUN: %clang_cc1 -triple i686-windows-msvc -emit-llvm -std=c++11 -fms-extensions -O0 -o - %s | FileCheck --check-prefix=M32 %s
+// RUN: %clang_cc1 -triple x86_64-windows-msvc -emit-llvm -std=c++11 -fms-extensions -O0 -o - %s | FileCheck --check-prefix=M64 %s
+
+struct __declspec(dllexport) SomeStruct {
+  // Copy assignment operator should be produced, and exported:
+  // M32: define weak_odr dllexport x86_thiscallcc dereferenceable({{[0-9]+}}) %struct.SomeStruct* @"\01??4SomeStruct@@QAEAAU0@ABU0@@Z"
+  // M64: define weak_odr dllexport                dereferenceable({{[0-9]+}}) %struct.SomeStruct* @"\01??4SomeStruct@@QEAAAEAU0@AEBU0@@Z"
+  _Atomic(int) mData;
+};