https://github.com/cor3ntin updated 
https://github.com/llvm/llvm-project/pull/139246

>From 4c87a813ed0d4b4646ab6d32374dfa1525a3711e Mon Sep 17 00:00:00 2001
From: Corentin Jabot <corentinja...@gmail.com>
Date: Tue, 6 May 2025 20:00:18 +0200
Subject: [PATCH 1/4] [Clang] Diagnose invalid function types in dependent
 contexts

When forming an invalid function type, we were not diagnosing
it if the call was dependent.

However, we later rely on the function type to be sensible
during argument deduction.

We now diagnose anything that is not a potential function type,
to avoid constructing bogus call expressions.

Fixes #138657
Fixes #115725
Fixes #68852
---
 clang/docs/ReleaseNotes.rst                  |  1 +
 clang/lib/Sema/SemaExpr.cpp                  | 19 ++++++++
 clang/test/SemaTemplate/fun-template-def.cpp | 51 +++++++++++++++++++-
 3 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/clang/docs/ReleaseNotes.rst b/clang/docs/ReleaseNotes.rst
index a8f5f40d8fef7..cd452179a6555 100644
--- a/clang/docs/ReleaseNotes.rst
+++ b/clang/docs/ReleaseNotes.rst
@@ -680,6 +680,7 @@ Bug Fixes to C++ Support
 - Improved parser recovery of invalid requirement expressions. In turn, this
   fixes crashes from follow-on processing of the invalid requirement. 
(#GH138820)
 - Fixed the handling of pack indexing types in the constraints of a member 
function redeclaration. (#GH138255)
+- Fixed a crash when forming an invalid function type in a dependent context. 
(#GH138657) (#GH115725) (#GH68852)
 
 Bug Fixes to AST Handling
 ^^^^^^^^^^^^^^^^^^^^^^^^^
diff --git a/clang/lib/Sema/SemaExpr.cpp b/clang/lib/Sema/SemaExpr.cpp
index deb8d2edfc5c9..9517c73006fd0 100644
--- a/clang/lib/Sema/SemaExpr.cpp
+++ b/clang/lib/Sema/SemaExpr.cpp
@@ -6550,6 +6550,15 @@ ExprResult Sema::ActOnCallExpr(Scope *Scope, Expr *Fn, 
SourceLocation LParenLoc,
   return Call;
 }
 
+// Any type that could be used to form a callable expression
+static bool MayBeFunctionType(const ASTContext &Context, QualType T) {
+  return T == Context.BoundMemberTy || T == Context.UnknownAnyTy ||
+         T == Context.BuiltinFnTy || T == Context.OverloadTy ||
+         T->isFunctionType() || T->isFunctionReferenceType() ||
+         T->isMemberFunctionPointerType() || T->isFunctionPointerType() ||
+         T->isBlockPointerType() || T->isRecordType();
+}
+
 ExprResult Sema::BuildCallExpr(Scope *Scope, Expr *Fn, SourceLocation 
LParenLoc,
                                MultiExprArg ArgExprs, SourceLocation RParenLoc,
                                Expr *ExecConfig, bool IsExecConfig,
@@ -6603,6 +6612,16 @@ ExprResult Sema::BuildCallExpr(Scope *Scope, Expr *Fn, 
SourceLocation LParenLoc,
             *this, dyn_cast<UnresolvedMemberExpr>(Fn->IgnoreParens()),
             Fn->getBeginLoc());
 
+        if (!Fn->getType()->isDependentType()) {
+          // If the type of the function itself is not dependent
+          // check that it is a reasonable as a function, as type deduction
+          // later assume the CallExpr has a sensible TYPE.
+          if (!MayBeFunctionType(Context, Fn->getType()))
+            return ExprError(
+                Diag(LParenLoc, diag::err_typecheck_call_not_function)
+                << Fn->getType() << Fn->getSourceRange());
+        }
+
         return CallExpr::Create(Context, Fn, ArgExprs, Context.DependentTy,
                                 VK_PRValue, RParenLoc, 
CurFPFeatureOverrides());
       }
diff --git a/clang/test/SemaTemplate/fun-template-def.cpp 
b/clang/test/SemaTemplate/fun-template-def.cpp
index de77901b5b601..716296e72bc44 100644
--- a/clang/test/SemaTemplate/fun-template-def.cpp
+++ b/clang/test/SemaTemplate/fun-template-def.cpp
@@ -1,6 +1,7 @@
 // RUN: %clang_cc1 -fsyntax-only -verify %s
 // RUN: %clang_cc1 -fsyntax-only -verify -std=c++98 %s
 // RUN: %clang_cc1 -fsyntax-only -verify -std=c++11 %s
+// RUN: %clang_cc1 -fsyntax-only -verify -std=c++20 %s
 
 // Tests that dependent expressions are always allowed, whereas non-dependent
 // are checked as usual.
@@ -32,7 +33,7 @@ T f1(T t1, U u1, int i1, T** tpp)
   i1 = t1[u1];
   i1 *= t1;
 
-  i1(u1, t1); // error
+  i1(u1, t1); // expected-error {{called object type 'int' is not a function 
or function pointer}}
   u1(i1, t1);
 
   U u2 = (T)i1;
@@ -60,3 +61,51 @@ void f3() {
   f2<int*>(0);
   f2<int>(0); // expected-error {{no matching function for call to 'f2'}}
 }
+
+#if __cplusplus >= 202002L
+namespace GH138657 {
+template <auto V> // #gh138657-template-head
+class meta {};
+template<int N>
+class meta<N()> {}; // expected-error {{called object type 'int' is not a 
function or function point}}
+
+template<int N[1]>
+class meta<N()> {}; // expected-error {{called object type 'int *' is not a 
function or function point}}
+
+template<char* N>
+class meta<N()> {}; // expected-error {{called object type 'char *' is not a 
function or function point}}
+
+struct S {};
+template<S>
+class meta<S()> {}; // expected-error {{template argument for non-type 
template parameter is treated as function type 'S ()'}}
+                    // expected-note@#gh138657-template-head {{template 
parameter is declared here}}
+
+}
+
+namespace GH115725 {
+template<auto ...> struct X {};
+template<typename T, typename ...Ts> struct A {
+  template<Ts ...Ns, T *...Ps>
+  A(X<0(Ps)...>, Ts (*...qs)[Ns]);
+  // expected-error@-1{{called object type 'int' is not a function or function 
pointer}}
+
+};
+}
+
+namespace GH68852 {
+template <auto v>
+struct constexpr_value {
+  template <class... Ts>
+  constexpr constexpr_value<v(Ts::value...)> call(Ts...) {
+    //expected-error@-1 {{called object type 'int' is not a function or 
function pointer}}
+    return {};
+  }
+};
+
+template <auto v> constexpr static inline auto c_ = constexpr_value<v>{};
+// expected-note@-1 {{in instantiation of template}}
+auto k = c_<1>; // expected-note {{in instantiation of variable}}
+
+}
+
+#endif

>From 0dff4575eb6104311bc5f4524c9bfafe72990d94 Mon Sep 17 00:00:00 2001
From: Corentin Jabot <corentinja...@gmail.com>
Date: Tue, 6 May 2025 20:43:31 +0200
Subject: [PATCH 2/4] address feedback

---
 clang/lib/Sema/SemaExpr.cpp | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/clang/lib/Sema/SemaExpr.cpp b/clang/lib/Sema/SemaExpr.cpp
index 9517c73006fd0..57135adf714ce 100644
--- a/clang/lib/Sema/SemaExpr.cpp
+++ b/clang/lib/Sema/SemaExpr.cpp
@@ -6612,15 +6612,14 @@ ExprResult Sema::BuildCallExpr(Scope *Scope, Expr *Fn, 
SourceLocation LParenLoc,
             *this, dyn_cast<UnresolvedMemberExpr>(Fn->IgnoreParens()),
             Fn->getBeginLoc());
 
-        if (!Fn->getType()->isDependentType()) {
-          // If the type of the function itself is not dependent
-          // check that it is a reasonable as a function, as type deduction
-          // later assume the CallExpr has a sensible TYPE.
-          if (!MayBeFunctionType(Context, Fn->getType()))
-            return ExprError(
-                Diag(LParenLoc, diag::err_typecheck_call_not_function)
-                << Fn->getType() << Fn->getSourceRange());
-        }
+        // If the type of the function itself is not dependent
+        // check that it is a reasonable as a function, as type deduction
+        // later assume the CallExpr has a sensible TYPE.
+        if (!Fn->getType()->isDependentType() &&
+            !MayBeFunctionType(Context, Fn->getType()))
+          return ExprError(
+              Diag(LParenLoc, diag::err_typecheck_call_not_function)
+              << Fn->getType() << Fn->getSourceRange());
 
         return CallExpr::Create(Context, Fn, ArgExprs, Context.DependentTy,
                                 VK_PRValue, RParenLoc, 
CurFPFeatureOverrides());

>From 0b9a1be26300941942dd10db8c60926dcd753039 Mon Sep 17 00:00:00 2001
From: Corentin Jabot <corentinja...@gmail.com>
Date: Fri, 9 May 2025 13:37:00 +0200
Subject: [PATCH 3/4] Address post-review feedback/revert

https://github.com/llvm/llvm-project/pull/138731#issuecomment-2864298000

A call expression might have been partially constructed,
in which case it will be a call-expressions (and its type
will not be that of a function)

To address that, we check that the expression might already be
a well-formed call
---
 clang/lib/Sema/SemaExpr.cpp                  | 28 +++++++----
 clang/test/SemaTemplate/fun-template-def.cpp | 49 +++++++++++++++++++-
 2 files changed, 68 insertions(+), 9 deletions(-)

diff --git a/clang/lib/Sema/SemaExpr.cpp b/clang/lib/Sema/SemaExpr.cpp
index 57135adf714ce..18930dee8dc41 100644
--- a/clang/lib/Sema/SemaExpr.cpp
+++ b/clang/lib/Sema/SemaExpr.cpp
@@ -6551,12 +6551,25 @@ ExprResult Sema::ActOnCallExpr(Scope *Scope, Expr *Fn, 
SourceLocation LParenLoc,
 }
 
 // Any type that could be used to form a callable expression
-static bool MayBeFunctionType(const ASTContext &Context, QualType T) {
-  return T == Context.BoundMemberTy || T == Context.UnknownAnyTy ||
-         T == Context.BuiltinFnTy || T == Context.OverloadTy ||
-         T->isFunctionType() || T->isFunctionReferenceType() ||
-         T->isMemberFunctionPointerType() || T->isFunctionPointerType() ||
-         T->isBlockPointerType() || T->isRecordType();
+static bool MayBeFunctionType(const ASTContext &Context, const Expr* E) {
+    QualType T = E->getType();
+    if(T->isDependentType())
+        return true;
+
+    if( T == Context.BoundMemberTy || T == Context.UnknownAnyTy ||
+        T == Context.BuiltinFnTy || T == Context.OverloadTy ||
+        T->isFunctionType() || T->isFunctionReferenceType() ||
+        T->isMemberFunctionPointerType() || T->isFunctionPointerType() ||
+        T->isBlockPointerType() || T->isRecordType())
+        return true;
+
+    return isa<CallExpr,
+               DeclRefExpr,
+               MemberExpr,
+               CXXPseudoDestructorExpr,
+               OverloadExpr,
+               UnresolvedMemberExpr,
+               UnaryOperator>(E);
 }
 
 ExprResult Sema::BuildCallExpr(Scope *Scope, Expr *Fn, SourceLocation 
LParenLoc,
@@ -6615,8 +6628,7 @@ ExprResult Sema::BuildCallExpr(Scope *Scope, Expr *Fn, 
SourceLocation LParenLoc,
         // If the type of the function itself is not dependent
         // check that it is a reasonable as a function, as type deduction
         // later assume the CallExpr has a sensible TYPE.
-        if (!Fn->getType()->isDependentType() &&
-            !MayBeFunctionType(Context, Fn->getType()))
+        if (!MayBeFunctionType(Context, Fn))
           return ExprError(
               Diag(LParenLoc, diag::err_typecheck_call_not_function)
               << Fn->getType() << Fn->getSourceRange());
diff --git a/clang/test/SemaTemplate/fun-template-def.cpp 
b/clang/test/SemaTemplate/fun-template-def.cpp
index 716296e72bc44..e666326202521 100644
--- a/clang/test/SemaTemplate/fun-template-def.cpp
+++ b/clang/test/SemaTemplate/fun-template-def.cpp
@@ -33,7 +33,7 @@ T f1(T t1, U u1, int i1, T** tpp)
   i1 = t1[u1];
   i1 *= t1;
 
-  i1(u1, t1); // expected-error {{called object type 'int' is not a function 
or function pointer}}
+  i1(u1, t1);
   u1(i1, t1);
 
   U u2 = (T)i1;
@@ -108,4 +108,51 @@ auto k = c_<1>; // expected-note {{in instantiation of 
variable}}
 
 }
 
+namespace GH138731 {
+template <class...>
+using void_t = void;
+template <class...>
+using void_t = void;
+
+template <class T>
+T&& declval();
+
+struct S {
+  S();
+  static int f();
+  static int var;
+};
+
+namespace invoke_detail {
+
+template <typename F>
+struct traits {
+  template <typename... A>
+  using result = decltype(declval<F>()(declval<A>()...));
+};
+
+template <typename F, typename... A>
+using invoke_result_t = typename traits<F>::template result<A...>;
+
+template <typename Void, typename F, typename... A>
+inline constexpr bool is_invocable_v = false;
+
+template <typename F, typename... A>
+inline constexpr bool
+    is_invocable_v<void_t<invoke_result_t<F, A...>>, F, A...> = true;
+
+}
+
+template <typename F, typename... A>
+inline constexpr bool is_invocable_v =
+    invoke_detail::is_invocable_v<void, F, A...>;
+
+static_assert(!is_invocable_v<int>);
+static_assert(!is_invocable_v<int, int>);
+static_assert(!is_invocable_v<S>);
+static_assert(is_invocable_v<decltype(&S::f)>);
+static_assert(!is_invocable_v<decltype(&S::var)>);
+
+}
+
 #endif

>From 4e78c5d3ee8b2131d1be8f96532738fb9e439fbc Mon Sep 17 00:00:00 2001
From: Corentin Jabot <corentinja...@gmail.com>
Date: Fri, 9 May 2025 18:41:01 +0200
Subject: [PATCH 4/4] format

---
 clang/lib/Sema/SemaExpr.cpp | 29 ++++++++++++-----------------
 1 file changed, 12 insertions(+), 17 deletions(-)

diff --git a/clang/lib/Sema/SemaExpr.cpp b/clang/lib/Sema/SemaExpr.cpp
index 18930dee8dc41..eed791c7c9bde 100644
--- a/clang/lib/Sema/SemaExpr.cpp
+++ b/clang/lib/Sema/SemaExpr.cpp
@@ -6551,25 +6551,20 @@ ExprResult Sema::ActOnCallExpr(Scope *Scope, Expr *Fn, 
SourceLocation LParenLoc,
 }
 
 // Any type that could be used to form a callable expression
-static bool MayBeFunctionType(const ASTContext &Context, const Expr* E) {
-    QualType T = E->getType();
-    if(T->isDependentType())
-        return true;
+static bool MayBeFunctionType(const ASTContext &Context, const Expr *E) {
+  QualType T = E->getType();
+  if (T->isDependentType())
+    return true;
 
-    if( T == Context.BoundMemberTy || T == Context.UnknownAnyTy ||
-        T == Context.BuiltinFnTy || T == Context.OverloadTy ||
-        T->isFunctionType() || T->isFunctionReferenceType() ||
-        T->isMemberFunctionPointerType() || T->isFunctionPointerType() ||
-        T->isBlockPointerType() || T->isRecordType())
-        return true;
+  if (T == Context.BoundMemberTy || T == Context.UnknownAnyTy ||
+      T == Context.BuiltinFnTy || T == Context.OverloadTy ||
+      T->isFunctionType() || T->isFunctionReferenceType() ||
+      T->isMemberFunctionPointerType() || T->isFunctionPointerType() ||
+      T->isBlockPointerType() || T->isRecordType())
+    return true;
 
-    return isa<CallExpr,
-               DeclRefExpr,
-               MemberExpr,
-               CXXPseudoDestructorExpr,
-               OverloadExpr,
-               UnresolvedMemberExpr,
-               UnaryOperator>(E);
+  return isa<CallExpr, DeclRefExpr, MemberExpr, CXXPseudoDestructorExpr,
+             OverloadExpr, UnresolvedMemberExpr, UnaryOperator>(E);
 }
 
 ExprResult Sema::BuildCallExpr(Scope *Scope, Expr *Fn, SourceLocation 
LParenLoc,

_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

Reply via email to