commit 8cdb0b10160f640e5975a6f16ee3d30bce9ed193
author Martin Brænne <mboehme@google.com> Thu Apr 27 03:47:50 2023 -0700
committer Copybara-Service <copybara-worker@google.com> Thu Apr 27 03:48:34 2023 -0700
tree b7993b3604381be054f15050b94375ed5d0e1054
parent d7d905093f1909122be2cee2c132076ece3f19d3

[nullability] Fix crash on function template calls that only deduce some arguments.

PiperOrigin-RevId: 527531959

nullability_verification/pointer_nullability_analysis.cc

diff --git a/nullability_verification/pointer_nullability_analysis.cc b/nullability_verification/pointer_nullability_analysis.cc
index e4a4729..946fa11 100644
--- a/nullability_verification/pointer_nullability_analysis.cc
+++ b/nullability_verification/pointer_nullability_analysis.cc
@@ -173,7 +173,18 @@
         if (auto* DRE =
                 dyn_cast<DeclRefExpr>(CE->getCallee()->IgnoreImpCasts());
             DRE != nullptr && ST->getReplacedParameter()->getDepth() == 0 &&
-            DRE->hasExplicitTemplateArgs()) {
+            // Some or all of the template arguments may be deduced, and we
+            // won't see those on the `DeclRefExpr`. If the template argument
+            // was deduced, we don't have any sugar for it.
+            // TODO: Can we somehow obtain it from the function param it was
+            // deduced from?
+            // TODO: This check, as well as the index into `template_arguments`
+            // below, may be incorrect in the presence of parameters packs.
+            // In function templates, parameter packs may appear anywhere in the
+            // parameter list. The index may therefore refer to one of the
+            // pack arguments, but we might incorrectly interpret it as
+            // referring to an argument that follows the pack.
+            ST->getIndex() < DRE->template_arguments().size()) {
           TypeSourceInfo* TSI =
               DRE->template_arguments()[ST->getIndex()].getTypeSourceInfo();
           if (TSI == nullptr) return std::nullopt;