<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Scott,<div class=""><br class=""></div><div class="">I suspect that the analyzer does not step into the constructor during the analysis but instead treats it as an opaque function. The temporary variable destructor support is lacking, so we choose not to “inline” or step into the constructors in some cases as well.</div><div class=""><br class=""></div><div class="">When this program is analyzed, objectCreate() is analyzed and the constructor of S is also analyzed as a top-level function. You can pass <span style="font-family: monospace; font-size: small; background-color: rgb(255, 255, 255);" class="">-analyzer-display-progress</span> option to the analyzer to see the order in which the top-level functions are being analyzed. (<a href="http://clang-analyzer.llvm.org/checker_dev_manual.html" class="">http://clang-analyzer.llvm.org/checker_dev_manual.html</a>)</div><div class=""><br class=""></div><div class="">Anna.</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Sep 10, 2015, at 10:29 AM, scott constable via cfe-dev <<a href="mailto:cfe-dev@lists.llvm.org" class="">cfe-dev@lists.llvm.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Hi All,<div class=""><br class=""></div><div class="">It seems that the clang static analyzer does not correctly handle C++ constructors. For example, I have the following code:</div><div class=""><br class=""></div><div class=""><div class="">struct S {</div><div class=""><span class="" style="white-space:pre"> </span>S(int x, int y, int z) {</div><div class=""><span class="" style="white-space:pre"> </span>a = x;</div><div class=""><span class="" style="white-space:pre"> </span>b = y;</div><div class=""><span class="" style="white-space:pre"> </span>c = z;</div><div class=""><span class="" style="white-space:pre"> </span>}</div><div class=""><span class="" style="white-space:pre"> </span>int a;</div><div class=""><span class="" style="white-space:pre"> </span>int b;</div><div class=""><span class="" style="white-space:pre"> </span>int c;</div><div class="">};</div><div class=""><br class=""></div><div class="">void objectCreate() {</div><div class=""><span class="" style="white-space:pre"> </span>S *newS = new S(12, 0, 15);</div><div class=""><span class="" style="white-space:pre"> </span>if (newS->b)</div><div class=""><span class="" style="white-space:pre"> </span>newS->c++;</div><div class=""><span class="" style="white-space:pre"> </span>else</div><div class=""><span class="" style="white-space:pre"> </span>newS->a++;</div><div class=""><span class="" style="white-space:pre"> </span>delete newS;</div><div class="">}</div></div><div class=""><br class=""></div><div class="">Since newS->b initializes to 0, the expression "newS->a++" should never execute. However, the analyzer in fact generates two new states and evaluates both branches. If I replace the newS->b condition with the integer literal 0, then only the first branch is evaluated, as I would expect. I dug into this further, and found that newS's constructor is called AFTER objectCreate() has been evaluated. In other words, newS's constructor is called after "delete newS". This is clearly the wrong behavior.</div><div class=""><br class=""></div><div class="">This is not the first time I have observed C++ constructors being handled incorrectly. I also posted several weeks ago with the same observation regarding implicit copy constructors.</div><div class=""><br class=""></div><div class="">Any help would be so very appreciated, as this has been driving me crazy!</div><div class=""><br class=""></div><div class="">~Scott Constable</div></div>
_______________________________________________<br class="">cfe-dev mailing list<br class=""><a href="mailto:cfe-dev@lists.llvm.org" class="">cfe-dev@lists.llvm.org</a><br class="">http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev<br class=""></div></blockquote></div><br class=""></div></body></html>