Type checking error in clang AST

This page describes the resulting AST and the behavior of clang when type-check error occurs. We have created this page in response of reported issue: Type-checking error leads to compiler crash

Long story short, when clang encounters a type-check error, it still tries to build the full AST to the best of its knowledge. Additionally, there is not an easy way to detect whether the type-checking error occurred only by looking at the -ast-dump.

Type-Checking Error Example

Below c code will generate an error at s->arr[i], since s is a struct, not a pointer to a struct.

struct S {
  int arr [10];
  int data;
};
void passing_test_2(int i) {
  struct S s = { { 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 }, 10 };
  s->arr[i] = 1;
}

Below is a part of the resulting AST generated by clang.

...
|-ArraySubscriptExpr 0x2839286d7d8 <col:3, col:11> 'int' lvalue
| |-ImplicitCastExpr 0x2839286d798 <col:3, col:6> 'int *' <ArrayToPointerDecay>
| | -MemberExpr 0x2839286d700 <col:3, col:6> 'int [10]' .arr 0x28390fcba68
| |   -ImplicitCastExpr 0x2839286d340 <col:3> 'struct S':'struct S' <LValueToRValue>
| |     -DeclRefExpr 0x2839286d318 <col:3> 'struct S':'struct S' lvalue Var 0x2839286cf20 's' 'struct S':'struct S'
...

Notice that the MemberExpr is missing lvalue, although it should be an lvalue.

Correct Implementation 1

Here is a correct c program of c snippet above.

struct S {
  int arr [10];
  int data;
};

void passing_test_2(int i) {
  struct S s = { { 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 }, 10 };
  s.arr[i] = 1;
}

Here is a part of the generated AST. This snippet of AST is accessing s.arr

|-ArraySubscriptExpr 0x246f1163a88 <col:3, col:10> 'int' lvalue
| |-ImplicitCastExpr 0x246f1163a48 <col:3, col:5> 'int *' <ArrayToPointerDecay>
| | `-MemberExpr 0x246f11639b0 <col:3, col:5> 'int [10]' lvalue .arr 0x246ef8c9c48
| |   `-DeclRefExpr 0x246f1163988 <col:3> 'struct S':'struct S' lvalue Var 0x246f1163590 's' 'struct S':'struct S'

Correct Implementation 2

Or we can correctly write the program this way

struct S {
  int arr [10];
  int data;
};

void passing_test_2(int i) {
  struct S s = { { 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 }, 10 };
  (&s)->arr[i] = 1;
}

And it will generate this AST

|-ArraySubscriptExpr 0x209dea7c158 <col:3, col:14> 'int' lvalue
| |-ImplicitCastExpr 0x209dea7c118 <col:3, col:9> 'int *' <ArrayToPointerDecay>
| | `-MemberExpr 0x209dea7c080 <col:3, col:9> 'int [10]' lvalue ->arr 0x209dea0f748
| |   `-ParenExpr 0x209dea7c060 <col:3, col:6> 'struct S *'
| |     `-UnaryOperator 0x209dea7c038 <col:4, col:5> 'struct S *' prefix '&'
| |       `-DeclRefExpr 0x209dea7bfb8 <col:5> 'struct S':'struct S' lvalue Var 0x209dea7bbc0 's' 'struct S':'struct S'

Both of above AST correctly identifies MemberExpr to be an lvalue.

Experimental Incorrect Code

As an experiment, I compiled this code:

struct S {
  int arr [10];
  int data;
};

void passing_test_2(int i) {
  struct S s = { { 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 }, 10 };
  (&s).arr[i] = 1;
}

And the resulting AST looks like this

|-ArraySubscriptExpr 0x1fbf2933ec8 <col:3, col:13> 'int' lvalue
| |-ImplicitCastExpr 0x1fbf2933e88 <col:3, col:8> 'int *' <ArrayToPointerDecay>
| | `-MemberExpr 0x1fbf2933df0 <col:3, col:8> 'int [10]' lvalue ->arr 0x1fbf0fe7a28
| |   `-ParenExpr 0x1fbf2933a30 <col:3, col:6> 'struct S *'
| |     `-UnaryOperator 0x1fbf2933a08 <col:4, col:5> 'struct S *' prefix '&'
| |       `-DeclRefExpr 0x1fbf2933988 <col:5> 'struct S':'struct S' lvalue Var 0x1fbf2933590 's' 'struct S':'struct S'

Note that even though the compiler exited with an error, the constructed AST has** MemberExpr to be an lvalue**. It's also worth noting that that clang tried to fix the error in MemberExpr (->arr).

Investigation

I went through clang/lib/Sema/SemaExprMember.cpp. It looks like clang decides to keep going even when it finds a syntax error. The developer note comments that because the member reference will be empty, they will be able to identify the error later and deal with it (line 1335):

Returning valid-but-null is how we indicate to the caller that the lookup result was filled in. If typo correction was attempted and failed, the lookup result will have been cleared--that combined with the valid-but-null ExprResult will trigger the appropriate diagnostics.