TGParser::ParseValue contains two recursive calls, one to parse the RHS of a list paste operator and one to parse the RHS of a paste operator in a class/def name. Both of these calls neglect to check the return value to see if it is null (because of some error). This causes a crash in the next line of code, which uses the return value. The code now checks for null returns.
Differential Revision: https://reviews.llvm.org/D85852
break;
default:
Init *RHSResult = ParseValue(CurRec, ItemType, ParseNameMode);
+ if (!RHSResult)
+ return nullptr;
Result = BinOpInit::getListConcat(LHS, RHSResult);
}
break;
default:
Init *RHSResult = ParseValue(CurRec, nullptr, ParseNameMode);
+ if (!RHSResult)
+ return nullptr;
RHS = dyn_cast<TypedInit>(RHSResult);
if (!RHS) {
Error(PasteLoc, "RHS of paste is not typed!");
--- /dev/null
+// RUN: not llvm-tblgen -DERROR1 %s 2>&1 | FileCheck --check-prefix=ERROR1 %s
+// RUN: not llvm-tblgen -DERROR2 %s 2>&1 | FileCheck --check-prefix=ERROR2 %s
+
+defvar list1 = ["foo", "bar", "snork"];
+
+// Pasting a list with a reserved word should produce an error.
+
+#ifdef ERROR1
+def list_paste {
+ list<string> the_list = list1 # in;
+}
+// ERROR1: error: Unknown token when parsing a value
+#endif
+
+
+// Pasting an identifier with a reserved word should produce an error.
+
+#ifdef ERROR2
+def name_paste#in {
+}
+// ERROR2: error: Unknown token when parsing a value
+#endif