Skip to content

[Clang] Reland: Diagnose invalid function types in dependent contexts #139246

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
May 9, 2025

Conversation

cor3ntin
Copy link
Contributor

@cor3ntin cor3ntin commented May 9, 2025

When forming an invalid function type, we were not diagnosing it if the call was dependent.

However, we later rely on the function type to be sensible during argument deduction.

We now diagnose anything that is not a potential function type,
to avoid constructing bogus call expressions.

Fixes #138657
Fixes #115725
Fixes #68852
Fixes #139163

@llvmbot llvmbot added clang Clang issues not falling into any other category clang:frontend Language frontend issues, e.g. anything involving "Sema" labels May 9, 2025
@llvmbot
Copy link
Member

llvmbot commented May 9, 2025

@llvm/pr-subscribers-clang

Author: cor3ntin (cor3ntin)

Changes

When forming an invalid function type, we were not diagnosing it if the call was dependent.

However, we later rely on the function type to be sensible during argument deduction.

We now diagnose anything that is not a potential function type,
to avoid constructing bogus call expressions.

Fixes #138657
Fixes #115725
Fixes #68852


Full diff: https://github.com/llvm/llvm-project/pull/139246.diff

3 Files Affected:

  • (modified) clang/docs/ReleaseNotes.rst (+1)
  • (modified) clang/lib/Sema/SemaExpr.cpp (+30)
  • (modified) clang/test/SemaTemplate/fun-template-def.cpp (+97-1)
diff --git a/clang/docs/ReleaseNotes.rst b/clang/docs/ReleaseNotes.rst
index 203958dab7430..bdd54f6a52b05 100644
--- a/clang/docs/ReleaseNotes.rst
+++ b/clang/docs/ReleaseNotes.rst
@@ -655,6 +655,7 @@ Bug Fixes to C++ Support
 - Fixed an assertion when trying to constant-fold various builtins when the argument
   referred to a reference to an incomplete type. (#GH129397)
 - Fixed a crash when a cast involved a parenthesized aggregate initialization in dependent context. (#GH72880)
+- Fixed a crash when forming an invalid function type in a dependent context. (#GH138657) (#GH115725) (#GH68852)
 
 Bug Fixes to AST Handling
 ^^^^^^^^^^^^^^^^^^^^^^^^^
diff --git a/clang/lib/Sema/SemaExpr.cpp b/clang/lib/Sema/SemaExpr.cpp
index be3f145f3c5f1..abfc147045bbb 100644
--- a/clang/lib/Sema/SemaExpr.cpp
+++ b/clang/lib/Sema/SemaExpr.cpp
@@ -6541,6 +6541,28 @@ ExprResult Sema::ActOnCallExpr(Scope *Scope, Expr *Fn, SourceLocation LParenLoc,
   return Call;
 }
 
+// Any type that could be used to form a callable expression
+static bool MayBeFunctionType(const ASTContext &Context, const Expr* E) {
+    QualType T = E->getType();
+    if(T->isDependentType())
+        return true;
+
+    if( T == Context.BoundMemberTy || T == Context.UnknownAnyTy ||
+        T == Context.BuiltinFnTy || T == Context.OverloadTy ||
+        T->isFunctionType() || T->isFunctionReferenceType() ||
+        T->isMemberFunctionPointerType() || T->isFunctionPointerType() ||
+        T->isBlockPointerType() || T->isRecordType())
+        return true;
+
+    return isa<CallExpr,
+               DeclRefExpr,
+               MemberExpr,
+               CXXPseudoDestructorExpr,
+               OverloadExpr,
+               UnresolvedMemberExpr,
+               UnaryOperator>(E);
+}
+
 ExprResult Sema::BuildCallExpr(Scope *Scope, Expr *Fn, SourceLocation LParenLoc,
                                MultiExprArg ArgExprs, SourceLocation RParenLoc,
                                Expr *ExecConfig, bool IsExecConfig,
@@ -6594,6 +6616,14 @@ ExprResult Sema::BuildCallExpr(Scope *Scope, Expr *Fn, SourceLocation LParenLoc,
             *this, dyn_cast<UnresolvedMemberExpr>(Fn->IgnoreParens()),
             Fn->getBeginLoc());
 
+        // If the type of the function itself is not dependent
+        // check that it is a reasonable as a function, as type deduction
+        // later assume the CallExpr has a sensible TYPE.
+        if (!MayBeFunctionType(Context, Fn))
+          return ExprError(
+              Diag(LParenLoc, diag::err_typecheck_call_not_function)
+              << Fn->getType() << Fn->getSourceRange());
+
         return CallExpr::Create(Context, Fn, ArgExprs, Context.DependentTy,
                                 VK_PRValue, RParenLoc, CurFPFeatureOverrides());
       }
diff --git a/clang/test/SemaTemplate/fun-template-def.cpp b/clang/test/SemaTemplate/fun-template-def.cpp
index de77901b5b601..e666326202521 100644
--- a/clang/test/SemaTemplate/fun-template-def.cpp
+++ b/clang/test/SemaTemplate/fun-template-def.cpp
@@ -1,6 +1,7 @@
 // RUN: %clang_cc1 -fsyntax-only -verify %s
 // RUN: %clang_cc1 -fsyntax-only -verify -std=c++98 %s
 // RUN: %clang_cc1 -fsyntax-only -verify -std=c++11 %s
+// RUN: %clang_cc1 -fsyntax-only -verify -std=c++20 %s
 
 // Tests that dependent expressions are always allowed, whereas non-dependent
 // are checked as usual.
@@ -32,7 +33,7 @@ T f1(T t1, U u1, int i1, T** tpp)
   i1 = t1[u1];
   i1 *= t1;
 
-  i1(u1, t1); // error
+  i1(u1, t1);
   u1(i1, t1);
 
   U u2 = (T)i1;
@@ -60,3 +61,98 @@ void f3() {
   f2<int*>(0);
   f2<int>(0); // expected-error {{no matching function for call to 'f2'}}
 }
+
+#if __cplusplus >= 202002L
+namespace GH138657 {
+template <auto V> // #gh138657-template-head
+class meta {};
+template<int N>
+class meta<N()> {}; // expected-error {{called object type 'int' is not a function or function point}}
+
+template<int N[1]>
+class meta<N()> {}; // expected-error {{called object type 'int *' is not a function or function point}}
+
+template<char* N>
+class meta<N()> {}; // expected-error {{called object type 'char *' is not a function or function point}}
+
+struct S {};
+template<S>
+class meta<S()> {}; // expected-error {{template argument for non-type template parameter is treated as function type 'S ()'}}
+                    // expected-note@#gh138657-template-head {{template parameter is declared here}}
+
+}
+
+namespace GH115725 {
+template<auto ...> struct X {};
+template<typename T, typename ...Ts> struct A {
+  template<Ts ...Ns, T *...Ps>
+  A(X<0(Ps)...>, Ts (*...qs)[Ns]);
+  // expected-error@-1{{called object type 'int' is not a function or function pointer}}
+
+};
+}
+
+namespace GH68852 {
+template <auto v>
+struct constexpr_value {
+  template <class... Ts>
+  constexpr constexpr_value<v(Ts::value...)> call(Ts...) {
+    //expected-error@-1 {{called object type 'int' is not a function or function pointer}}
+    return {};
+  }
+};
+
+template <auto v> constexpr static inline auto c_ = constexpr_value<v>{};
+// expected-note@-1 {{in instantiation of template}}
+auto k = c_<1>; // expected-note {{in instantiation of variable}}
+
+}
+
+namespace GH138731 {
+template <class...>
+using void_t = void;
+template <class...>
+using void_t = void;
+
+template <class T>
+T&& declval();
+
+struct S {
+  S();
+  static int f();
+  static int var;
+};
+
+namespace invoke_detail {
+
+template <typename F>
+struct traits {
+  template <typename... A>
+  using result = decltype(declval<F>()(declval<A>()...));
+};
+
+template <typename F, typename... A>
+using invoke_result_t = typename traits<F>::template result<A...>;
+
+template <typename Void, typename F, typename... A>
+inline constexpr bool is_invocable_v = false;
+
+template <typename F, typename... A>
+inline constexpr bool
+    is_invocable_v<void_t<invoke_result_t<F, A...>>, F, A...> = true;
+
+}
+
+template <typename F, typename... A>
+inline constexpr bool is_invocable_v =
+    invoke_detail::is_invocable_v<void, F, A...>;
+
+static_assert(!is_invocable_v<int>);
+static_assert(!is_invocable_v<int, int>);
+static_assert(!is_invocable_v<S>);
+static_assert(is_invocable_v<decltype(&S::f)>);
+static_assert(!is_invocable_v<decltype(&S::var)>);
+
+}
+
+#endif

Copy link
Contributor

@zyn0217 zyn0217 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM assuming clang-formatted

i1(u1, t1); // expected-error {{called object type 'int' is not a function or function pointer}}
i1(u1, t1);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is unfortunate

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is because that function is not instantiated

@mizvekov
Copy link
Contributor

mizvekov commented May 9, 2025

Hello, it is helpful to include link to original landing attempt, and a brief description of what changed since last time, or otherwise explanation of why we go ahead and reland with no changes anyway.

@mizvekov
Copy link
Contributor

mizvekov commented May 9, 2025

Aha, I see that's described in one of the internal commits.
It would be ideal if GitHub would float that up to the PR description automatically.

Copy link

github-actions bot commented May 9, 2025

✅ With the latest revision this PR passed the C/C++ code formatter.

cor3ntin added 4 commits May 9, 2025 18:40
When forming an invalid function type, we were not diagnosing
it if the call was dependent.

However, we later rely on the function type to be sensible
during argument deduction.

We now diagnose anything that is not a potential function type,
to avoid constructing bogus call expressions.

Fixes llvm#138657
Fixes llvm#115725
Fixes llvm#68852
llvm#138731 (comment)

A call expression might have been partially constructed,
in which case it will be a call-expressions (and its type
will not be that of a function)

To address that, we check that the expression might already be
a well-formed call
@cor3ntin cor3ntin force-pushed the corentin/138657 branch from cf416cb to 4e78c5d Compare May 9, 2025 16:41
Comment on lines 112 to 115
template <class...>
using void_t = void;
template <class...>
using void_t = void;

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Duplicate definitions of void_. May be deduplicated.


}

namespace GH138731 {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This regression test does not need to be limited to C++ >= 20. It uses variable templates so it should work with C++ >= 14 as well (provided that this definition of void_t works). A variation without variable templates would work with C++ >= 11. Not sure how important that all is.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is a bunch of C++17 features in there (inline variables) - it doesn't really matter here, but I did change the test to run in c++17 mode. Thanks

@cor3ntin cor3ntin force-pushed the corentin/138657 branch from f144548 to f9143d9 Compare May 9, 2025 17:57
@cor3ntin cor3ntin merged commit 52b18b4 into llvm:main May 9, 2025
7 of 10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
clang:frontend Language frontend issues, e.g. anything involving "Sema" clang Clang issues not falling into any other category
Projects
None yet
5 participants