[Clang] Add sanity check in Sema::getDestructorName to prevent nullptr dereference

Currently in Sema::getDestructorName we call SS.getScopeRep()->getPrefix() but
SS.getScopeRep() can return nullptr because LookupInNestedNameSpec(...) called a
little before can invalidate SS.

This fixes: https://github.com/llvm/llvm-project/issues/59446

Differential Revision: https://reviews.llvm.org/D140598

diff --git a/clang/docs/ReleaseNotes.rst b/clang/docs/ReleaseNotes.rst
index e105f3e..28345f1 100644 (file)
--- a/clang/docs/ReleaseNotes.rst
+++ b/clang/docs/ReleaseNotes.rst
@@ -54,6 +54,9 @@ Major New Features
 
 Bug Fixes
 ---------
+- Fix crash on invalid code when looking up a destructor in a templated class
+  inside a namespace. This fixes
+  `Issue 59446 <https://github.com/llvm/llvm-project/issues/59446>`_.
 
 Improvements to Clang's diagnostics
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

diff --git a/clang/lib/Sema/SemaExprCXX.cpp b/clang/lib/Sema/SemaExprCXX.cpp
index abf5a72..ef01277 100644 (file)
--- a/clang/lib/Sema/SemaExprCXX.cpp
+++ b/clang/lib/Sema/SemaExprCXX.cpp
@@ -391,7 +391,7 @@ ParsedType Sema::getDestructorName(SourceLocation TildeLoc,
     //
     // also looks for type-name in the scope. Unfortunately, we can't
     // reasonably apply this fallback for dependent nested-name-specifiers.
-    if (SS.getScopeRep()->getPrefix()) {
+    if (SS.isValid() && SS.getScopeRep()->getPrefix()) {
       if (ParsedType T = LookupInScope()) {
         Diag(SS.getEndLoc(), diag::ext_qualified_dtor_named_in_lexical_scope)
             << FixItHint::CreateRemoval(SS.getRange());

diff --git a/clang/test/SemaCXX/GH59446.cpp b/clang/test/SemaCXX/GH59446.cpp
new file mode 100644 (file)
index 0000000..b85a57a
--- /dev/null
+++ b/clang/test/SemaCXX/GH59446.cpp
@@ -0,0 +1,12 @@
+// RUN: %clang_cc1 -fsyntax-only -verify -std=c++11 %s
+
+namespace GH59446 { // expected-note {{to match this '{'}}
+namespace N {
+    template <typename T> struct X ; // expected-note 2 {{template is declared here}}
+                                     // expected-note@-1 {{'N::X' declared here}}
+                                    // expected-note@-2 {{non-type declaration found by destructor name lookup}}
+  }
+  void f(X<int> *x) { // expected-error {{no template named 'X'; did you mean 'N::X'}}
+    x->N::X<int>::~X(); // expected-error 2 {{implicit instantiation of undefined template 'GH59446::N::X<int>'}}
+                        // expected-error@-1 {{identifier 'X' after '~' in destructor name does not name a type}}
+} // expected-error {{expected '}'}}