<div dir="ltr">Matthias,<div><br></div><div>I can at least give you a partial solution. The reason that checkDeadSymbols() is not triggered by 'i' going out of scope is that 'i' is not symbolic. Symbols refer to values which the analyzer cannot properly model, other than by assigning constraints to them. Since 'i' is declared locally, and a reference to 'i' never leaves this translation unit, 'i' is never assigned a symbolic value. I think that what you need is provided by the analysis context. You can do something like:</div><div><br></div><div>const CFGBlock *currentBlock = Ctx.getLocationContext()->getCurrentStackFrame()->getCallSiteBlock();</div><div>LiveVariables *analysisLV = Ctx.getLocationContext()->getAnalysis<RelaxedLiveVariables>();</div><div>if (!analysisLV->isLive(currentBlock, iVar)) {</div><div> // iVar went out of scope, handle it somehow</div><div>}</div><div><br></div><div>The next question would be concern which callback to hook. Although checkEndFunction() would be the easiest, it's not precise enough to handle compoundStmts. But I'm not aware of a better option (someone else might be?).</div><div><br></div><div>~Scott</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Oct 18, 2015 at 6:39 PM, Matthias Gehre via cfe-dev <span dir="ltr"><<a href="mailto:cfe-dev@lists.llvm.org" target="_blank">cfe-dev@lists.llvm.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div style="font-size:12.8px">Hi,</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">I'm currently trying to implement a clang analyzer check</div><div style="font-size:12.8px">to detect dangling pointers to a local (that went out of scope), like in:</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><div>void pointer_leaves_scope(bool bb) {<br></div><div> int* p;</div><div> {<br></div><div> int i = 0;</div><div> p = &i;</div><div> } // need to get a callback here</div><div> *p = 1; // should produce warning: i went out-of-scope</div><div>}</div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">I first though that <span style="font-size:12.8px">checkDeadSymbols(..)</span><span style="font-size:12.8px"> will be called when i goes out of scope,</span></div><div style="font-size:12.8px"><span style="font-size:12.8px">but it does not. Seems that I don't understand what </span><span style="font-size:12.8px">checkDeadSymbols is supposed to do.</span></div><div style="font-size:12.8px"><span style="font-size:12.8px"><br></span></div><div style="font-size:12.8px"><span style="font-size:12.8px">I </span><span style="font-size:12.8px">also</span><span style="font-size:12.8px"> </span><span style="font-size:12.8px">tried checkPostStmt(</span><span style="font-size:12.8px">CompoundStmt*,..), </span><span style="font-size:12.8px">but that is not called either.</span></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Now I'm looking how to implement this callback (could be named <span style="font-size:12.8px">checkSymbolLeavesScope).</span></div><div style="font-size:12.8px"><span style="font-size:12.8px">Or something like </span><span style="font-size:12.8px">checkEndFunction() </span><span style="font-size:12.8px">but for all local scopes.</span></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Could anyone please give me some hints where to add this to the analyzer core?</div><div style="font-size:12.8px">I'm I missing something obvious?</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Thanks,</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Matthias</div></div>
<br>_______________________________________________<br>
cfe-dev mailing list<br>
<a href="mailto:cfe-dev@lists.llvm.org">cfe-dev@lists.llvm.org</a><br>
<a href="http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev" rel="noreferrer" target="_blank">http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a><br>
<br></blockquote></div><br></div>