<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Apr 7, 2015 at 9:26 PM, Nikola Smiljanic <span dir="ltr"><<a href="mailto:popizdeh@gmail.com" target="_blank">popizdeh@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Yeah, something like that, it really feels like it belongs in the static analyzer. BTW, would any of the sanitizers catch this?</div></blockquote><div><br>I believe MSan would be the tool to catch this, but I'm not sure how good its stack lifetime tracking is just yet.<br><br>(& yes, I don't think there's a local warning (non-static analysis) that would be good for this. Stashing a reference to a temporary in a member variable isn't, itself, a bug - see Twine for example - you just have to use it carefully. That said, we did have some bugs in LLVM/Clang due to taking references to temporaries from conversions - ArrayRef<Base*> constructed from a single Derived* - the Derived* was converted to a temporary Base*, the ArrayRef had a pointer to that Base* which ceased to exist at the end of the full expression... )<br> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Apr 8, 2015 at 2:20 PM, Daniel Dilts <span dir="ltr"><<a href="mailto:diltsman@gmail.com" target="_blank">diltsman@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>So, it would be something like:</div><div>If MaterializeTemporaryExpr and assign result to a reference that persists beyond the scope of the function</div><div>Then generate a warning</div><div><br></div><div>Something like that? I am not an expert on this; could someone else comment on the reasonableness of this?</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Apr 7, 2015 at 8:55 PM, Nikola Smiljanic <span dir="ltr"><<a href="mailto:popizdeh@gmail.com" target="_blank">popizdeh@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">We just ran into this in production, but as you can imagine it was much harder to spot. It only happened in optimized code. It was hidden behind templates and one member of the class would try to bind a const ref to int to something that was an enum. Combine that with mfc hash map and results are spectacular :)<div><br></div><div>Looking at ast dump I can see MaterializeTemporaryExpr. Couldn't we just check that one of function's or constructor's arguments is coming from it?</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Apr 8, 2015 at 1:41 PM, Daniel Dilts <span dir="ltr"><<a href="mailto:diltsman@gmail.com" target="_blank">diltsman@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div dir="ltr">Ah! I finally see where your issue is. This problem is probably better suited for static code analysis. For a trivial example like this you can pretty quickly track down what is wrong, but for the more general case I don't imagine that this being a check that can be done quickly enough for a compiler warning.</div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Apr 7, 2015 at 8:04 PM, Nikola Smiljanic <span dir="ltr"><<a href="mailto:popizdeh@gmail.com" target="_blank">popizdeh@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div dir="ltr">I should have made a better comment, the types are different! Parameter needs to be implicitly converted to int, and we're binding a a const ref to this temp object whose lifetime ends once S is constructed. Unless I'm mistaken.</div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Apr 8, 2015 at 1:01 PM, Daniel Dilts <span dir="ltr"><<a href="mailto:diltsman@gmail.com" target="_blank">diltsman@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote"><div><div>On Tue, Apr 7, 2015 at 6:11 PM, Nikola Smiljanic <span dir="ltr"><<a href="mailto:popizdeh@gmail.com" target="_blank">popizdeh@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div dir="ltr">I'm surprised this doesn't produce a warning:<div><br></div><div><div>struct S</div><div>{</div><div><span style="white-space:pre-wrap"> </span>S(const int& i) : i(i) {}</div><div><span style="white-space:pre-wrap"> </span>const int& i;</div><div>};</div><div><br></div><div>void foo(long l)</div><div>{</div><div><span style="white-space:pre-wrap"> </span>S s(l); // binding a const ref to temporary</div><div>}</div><div><br></div><div>int main()</div><div>{</div><div><span style="white-space:pre-wrap"> </span>foo(1l);</div><div>}</div></div><div><br></div></div><br></blockquote></div></div><div>Why would that produce a warning? You can bind an r-value to a const l-value reference. And, function foo takes the parameter by value, so it is passing an l-value to the constructor of S.</div></div><br></div></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
cfe-dev mailing list<br>
<a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br>
<a href="http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev" target="_blank">http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev</a><br>
<br></blockquote></div><br></div></div>