[clang][trunk] compiler crashes if the first parameter of a member operator delete is in class type

[Snape3058]

detailed execution result on godbolt

This bug was discovered when I was studying the usage of std::destorying_delete_t.
After removing the first parameter of a pointer type, the compiler crashes.

In the example below, std::destorying_delete_t is simplified to struct S for the sake of debugging.

struct S {};
struct T {
  void operator delete(S) {}
};

void foo(T *t) { delete t; }

Pretty stack dump:

1.	<source>:6:26: current parser token ';'
2.	<source>:6:16: parsing function body 'foo'
3.	<source>:6:16: in compound statement ('{}')

Crashed in function clang::Sema::ActOnCXXDelete(clang::SourceLocation, bool, bool, clang::Expr*)
when checking QualType ParamType, which is not a pointer and its getPointeeType returns an empty QualType.

llvm-project/clang/lib/Sema/SemaExprCXX.cpp

Lines 3883 to 3884 in 724d903

	QualType ParamType = OperatorDelete->getParamDecl(0)->getType();
	if (!IsVirtualDelete && !ParamType->getPointeeType()->isVoidType()) {

[llvmbot]

@llvm/issue-subscribers-clang-frontend

Author: Ella Ma (Snape3058)

[detailed execution result on godbolt](https://godbolt.org/#g:!((g:!((g:!((h:codeEditor,i:(filename:'1',fontScale:15,fontUsePx:'0',j:1,lang:c%2B%2B,selection:(endColumn:29,endLineNumber:6,positionColumn:29,positionLineNumber:6,selectionStartColumn:29,selectionStartLineNumber:6,startColumn:29,startLineNumber:6),source:'struct+S+%7B%7D%3B%0Astruct+T+%7B%0A++void+operator+delete(S)+%7B%7D%0A%7D%3B%0A%0Avoid+foo(T+*t)+%7B+delete+t%3B+%7D'),l:'5',n:'0',o:'C%2B%2B+source+%231',t:'0')),k:49.56256362285746,l:'4',m:100,n:'0',o:'',s:0,t:'0'),(g:!((h:executor,i:(argsPanelShown:'1',compilationPanelShown:'0',compiler:clang_trunk,compilerName:'',compilerOutShown:'0',execArgs:'',execStdin:'',fontScale:14,fontUsePx:'0',j:1,lang:c%2B%2B,libs:!(),options:'-std%3Dc%2B%2B20',overrides:!(),runtimeTools:!(),source:1,stdinPanelShown:'1',wrap:'1'),l:'5',n:'0',o:'Executor+x86-64+clang+(trunk)+(C%2B%2B,+Editor+%231)',t:'0')),header:(),k:50.41112058766887,l:'4',n:'0',o:'',s:0,t:'0')),l:'2',n:'0',o:'',t:'0')),version:4)

This bug was discovered when I was studying the usage of std::destorying_delete_t.
After removing the first parameter of a pointer type, the compiler crashes.

In the example below, std::destorying_delete_t is simplified to struct S for the sake of debugging.

struct S {};
struct T {
  void operator delete(S) {}
};

void foo(T *t) { delete t; }

Pretty stack dump:

1.	<source>:6:26: current parser token ';'
2.	<source>:6:16: parsing function body 'foo'
3.	<source>:6:16: in compound statement ('{}')

Crashed in function clang::Sema::ActOnCXXDelete(clang::SourceLocation, bool, bool, clang::Expr*)
when checking QualType ParamType, which is not a pointer and its getPointeeType returns an empty QualType.

llvm-project/clang/lib/Sema/SemaExprCXX.cpp

Lines 3883 to 3884 in 724d903

	QualType ParamType = OperatorDelete->getParamDecl(0)->getType();
	if (!IsVirtualDelete && !ParamType->getPointeeType()->isVoidType()) {

[llvmbot]

@llvm/issue-subscribers-c-20

Author: Ella Ma (Snape3058)

[detailed execution result on godbolt](https://godbolt.org/#g:!((g:!((g:!((h:codeEditor,i:(filename:'1',fontScale:15,fontUsePx:'0',j:1,lang:c%2B%2B,selection:(endColumn:29,endLineNumber:6,positionColumn:29,positionLineNumber:6,selectionStartColumn:29,selectionStartLineNumber:6,startColumn:29,startLineNumber:6),source:'struct+S+%7B%7D%3B%0Astruct+T+%7B%0A++void+operator+delete(S)+%7B%7D%0A%7D%3B%0A%0Avoid+foo(T+*t)+%7B+delete+t%3B+%7D'),l:'5',n:'0',o:'C%2B%2B+source+%231',t:'0')),k:49.56256362285746,l:'4',m:100,n:'0',o:'',s:0,t:'0'),(g:!((h:executor,i:(argsPanelShown:'1',compilationPanelShown:'0',compiler:clang_trunk,compilerName:'',compilerOutShown:'0',execArgs:'',execStdin:'',fontScale:14,fontUsePx:'0',j:1,lang:c%2B%2B,libs:!(),options:'-std%3Dc%2B%2B20',overrides:!(),runtimeTools:!(),source:1,stdinPanelShown:'1',wrap:'1'),l:'5',n:'0',o:'Executor+x86-64+clang+(trunk)+(C%2B%2B,+Editor+%231)',t:'0')),header:(),k:50.41112058766887,l:'4',n:'0',o:'',s:0,t:'0')),l:'2',n:'0',o:'',t:'0')),version:4)

This bug was discovered when I was studying the usage of std::destorying_delete_t.
After removing the first parameter of a pointer type, the compiler crashes.

In the example below, std::destorying_delete_t is simplified to struct S for the sake of debugging.

struct S {};
struct T {
  void operator delete(S) {}
};

void foo(T *t) { delete t; }

Pretty stack dump:

1.	<source>:6:26: current parser token ';'
2.	<source>:6:16: parsing function body 'foo'
3.	<source>:6:16: in compound statement ('{}')

Crashed in function clang::Sema::ActOnCXXDelete(clang::SourceLocation, bool, bool, clang::Expr*)
when checking QualType ParamType, which is not a pointer and its getPointeeType returns an empty QualType.

llvm-project/clang/lib/Sema/SemaExprCXX.cpp

Lines 3883 to 3884 in 724d903

	QualType ParamType = OperatorDelete->getParamDecl(0)->getType();
	if (!IsVirtualDelete && !ParamType->getPointeeType()->isVoidType()) {

[shafik]

Confirmed: https://godbolt.org/z/9oo8na777

Assertion:

clang++: /root/llvm-project/clang/include/clang/AST/Type.h:956:
const clang::ExtQualsTypeCommonBase* clang::QualType::getCommonPtr() const:
Assertion `!isNull() && "Cannot retrieve a NULL type pointer"' failed.

Backtrace:

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -gdwarf-4 -g -o /app/output.s -mllvm --x86-asm-syntax=intel -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics <source>
1.	<source>:6:26: current parser token ';'
2.	<source>:6:16: parsing function body 'foo'
3.	<source>:6:16: in compound statement ('{}')
 #0 0x0000000003a24218 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3a24218)
 #1 0x0000000003a21efc llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3a21efc)
 #2 0x00000000039679f8 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007635d0c42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007635d0c969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x00007635d0c42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007635d0c287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007635d0c2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #8 0x00007635d0c39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #9 0x0000000006a6cee4 clang::Sema::ActOnCXXDelete(clang::SourceLocation, bool, bool, clang::Expr*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6a6cee4)
#10 0x000000000641e900 clang::Parser::ParseCXXDeleteExpression(bool, clang::SourceLocation) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x641e900)
#11 0x00000000063fcc73 clang::Parser::ParseCastExpression(clang::Parser::CastParseKind, bool, bool&, clang::Parser::TypeCastState, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x63fcc73)
#12 0x00000000063fed4a clang::Parser::ParseCastExpression(clang::Parser::CastParseKind, bool, clang::Parser::TypeCastState, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x63fed4a)
#13 0x00000000063feee9 clang::Parser::ParseAssignmentExpression(clang::Parser::TypeCastState) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x63feee9)
#14 0x0000000006403979 clang::Parser::ParseExpression(clang::Parser::TypeCastState) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6403979)
#15 0x0000000006483da9 clang::Parser::ParseExprStatement(clang::Parser::ParsedStmtContext) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6483da9)
#16 0x000000000647a975 clang::Parser::ParseStatementOrDeclarationAfterAttributes(llvm::SmallVector<clang::Stmt*, 32u>&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::ParsedAttributes&, clang::ParsedAttributes&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x647a975)
#17 0x000000000647b7d7 clang::Parser::ParseStatementOrDeclaration(llvm::SmallVector<clang::Stmt*, 32u>&, clang::Parser::ParsedStmtContext, clang::SourceLocation*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x647b7d7)
#18 0x000000000647c5e5 clang::Parser::ParseCompoundStatementBody(bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x647c5e5)
#19 0x000000000647de4a clang::Parser::ParseFunctionStatementBody(clang::Decl*, clang::Parser::ParseScope&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x647de4a)
#20 0x0000000006393ec3 clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::LateParsedAttrList*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6393ec3)
#21 0x00000000063c9aac clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x63c9aac)
#22 0x00000000063878fe clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x63878fe)
#23 0x000000000638815e clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x638815e)
#24 0x000000000638e867 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x638e867)
#25 0x000000000638f76f clang::Parser::ParseTopLevelDecl(clang::OpaquePtr<clang::DeclGroupRef>&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x638f76f)
#26 0x0000000006382f6a clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6382f6a)
#27 0x00000000043055c8 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x43055c8)
#28 0x000000000458a969 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x458a969)
#29 0x00000000045115ce clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x45115ce)
#30 0x0000000004671e2e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4671e2e)
#31 0x0000000000c6ea1c cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xc6ea1c)
#32 0x0000000000c67d7a ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#33 0x00000000043488a9 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#34 0x0000000003967ea4 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3967ea4)
#35 0x0000000004348e9f clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#36 0x000000000430ed45 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x430ed45)
#37 0x000000000430f7ad clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x430f7ad)
#38 0x00000000043174a5 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x43174a5)
#39 0x0000000000c6bf25 clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xc6bf25)
#40 0x0000000000b45924 main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xb45924)
#41 0x00007635d0c29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#42 0x00007635d0c29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#43 0x0000000000c6782e _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xc6782e)
clang++: error: clang frontend command failed with exit code 134 (use -v to see invocation)
Compiler returned: 134