Push a function scope when parsing function bodies without a declaration

[rnk]

Summary

This is PR36536.

There are a few ways to reach Sema::ActOnStartOfFunctionDef with a null
Decl. Currently, the parser continues on to attempt to parse the
statements in the function body without pushing a function scope or
declaration context. However, lots of statement parsing logic relies on
getCurFunction() returning something reasonable. It turns out that
getCurFunction() will never return null today because of an optimization
where Sema pre-allocates one FunctionScopeIfno and reuses it when
possible. This goes wrong when something inside the function body causes
us to push another function scope, such as requiring an implicit
definition of a special member function. Reusing the state clears it
out, which will lead to bugs. In PR36536, we found that the SwitchStack
gets unbalanced, because we push a switch, clear out the stack, and then
try to pop a switch that isn't there.

As a follow-up, I plan to move the pre-allocated FunctionScopeInfo out
of the FunctionScopes stack. This means the FunctionScopes stack will
often be empty, which will make getCurFunction() assert. That's a
high-risk change, so I want to separate it out.

[thakis]

Fix LGTM, one optional comment below.

clang/lib/Sema/SemaDecl.cpp

12412 ↗

(On Diff #136635)

Feels a bit long-term risky since ActOnStartOfFunctionDef() and ActOnFinishFunctionBody() both need to know about this special-case invariant. Maybe it's worth to add a FakeFunctionScopeCount member to sema in +assert builds, and to increment that here, assert it's > 0 in the other place and decrement it there, and then assert it's 0 at end of TU?

clang/test/SemaCXX/pr36536.cpp

19 ↗

(On Diff #136635)

Not 100% clear to me what the FIXME is here. Maybe "FIXME: We should improve our recovery to redeclare...." if that's what's meant.

[rnk]

Thanks!

John touched this code last in rL112038 in 2010, so maybe he has some thoughts on how to clean this and the follow-up. I think I'll land this as is since it fixes the crash and we can discuss more improvements in D44039.

clang/lib/Sema/SemaDecl.cpp

12412 ↗

(On Diff #136635)

Well, it's more like these early returns break the invariant that ActOnStartOfFunctionDef pushes a function scope. We could try to clean it up with an RAII helper or an layer of function call that ensures that we always push and pop on start and finish, but I'll leave that for the follow-up.

clang/test/SemaCXX/pr36536.cpp

19 ↗

(On Diff #136635)

I rewrote this to clarify things.

lib/Sema/SemaDecl.cpp

if (C.capturesVariable()) {
       LSI->addVLATypeCapture(C.getLocation(), I->getType());
     }
     ++I;
   }
 }
 
 Decl *Sema::ActOnStartOfFunctionDef(Scope *FnBodyScope, Decl *D,
                                     SkipBodyInfo *SkipBody) {
-  if (!D)
+  if (!D) {
+    // Parsing the function declaration failed in some way. Push on a fake scope
+    // anyway so we can try to parse the function body.
+    PushFunctionScope();
     return D;
+  }
+
   FunctionDecl *FD = nullptr;
 
   if (FunctionTemplateDecl *FunTmpl = dyn_cast<FunctionTemplateDecl>(D))
     FD = FunTmpl->getTemplatedDecl();
   else
     FD = cast<FunctionDecl>(D);
 
   // Check for defining attributes before the check for redefinition.
if (FD) {
     if (getCurFunction()->ObjCWarnForNoInitDelegation) {
       // Don't issue this warning for unavaialable inits.
       if (!MD->isUnavailable())
         Diag(MD->getLocation(),
              diag::warn_objc_secondary_init_missing_init_call);
       getCurFunction()->ObjCWarnForNoInitDelegation = false;
     }
   } else {
+    // Parsing the function declaration failed in some way. Pop the fake scope
+    // we pushed on.
+    PopFunctionScopeInfo(ActivePolicy, dcl);
     return nullptr;
   }
 
   if (Body && getCurFunction()->HasPotentialAvailabilityViolations)
     DiagnoseUnguardedAvailabilityViolations(dcl);
 
   assert(!getCurFunction()->ObjCShouldCallSuper &&
          "This should only be set for ObjC methods, which should have been "

test/SemaCXX/pr36536.cpp

+// RUN: %clang_cc1 -std=c++11 %s -verify -fno-spell-checking
+
+// These test cases are constructed to make clang call ActOnStartOfFunctionDef
+// with nullptr.
+
+struct ImplicitDefaultCtor1 {};
+struct Foo {
+  typedef int NameInClass;
+  void f();
+};
+namespace bar {
+// FIXME: Improved our recovery to make this a redeclaration of Foo::f,
+// even though this is in the wrong namespace. That will allow name lookup to
+// find NameInClass below. Users are likely to hit this when they forget to
+// close namespaces.
+// expected-error@+1 {{cannot define or redeclare 'f' here}}
+void Foo::f() {
+  switch (0) { case 0: ImplicitDefaultCtor1 o; }
+  // expected-error@+1 {{unknown type name 'NameInClass'}}
+  NameInClass var;
+}
+} // namespace bar
+
+struct ImplicitDefaultCtor2 {};
+template <typename T> class TFoo { void f(); };
+// expected-error@+1 {{nested name specifier 'decltype(TFoo<T>())::'}}
+template <typename T> void decltype(TFoo<T>())::f() {
+  switch (0) { case 0: ImplicitDefaultCtor1 o; }
+}
+
+namespace tpl2 {
+struct ImplicitDefaultCtor3 {};
+template <class T1> class A {
+  template <class T2> class B {
+    void mf2();
+  };
+};
+template <class Y>
+template <>
+// expected-error@+1 {{nested name specifier 'A<Y>::B<double>::'}}
+void A<Y>::B<double>::mf2() {
+  switch (0) { case 0: ImplicitDefaultCtor3 o; }
+}
+}