<html>
    <head>
      <base href="https://llvm.org/bugs/" />
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW --- - warn when capturing an __autoreleasing object in a block"
   href="https://llvm.org/bugs/show_bug.cgi?id=25279">25279</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>warn when capturing an __autoreleasing object in a block
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>clang
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>unspecified
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>PC
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>All
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>NEW
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>enhancement
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>P
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>Static Analyzer
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>kremenek@apple.com
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>scarff@gmail.com
          </td>
        </tr>

        <tr>
          <th>CC</th>
          <td>llvm-bugs@lists.llvm.org
          </td>
        </tr>

        <tr>
          <th>Classification</th>
          <td>Unclassified
          </td>
        </tr></table>
      <p>
        <div>
        <pre>In Apple LLVM version 6.1.0 (clang-602.0.53) (based on LLVM 3.6.0svn), and
possibly other versions, there is no warning generated when capturing an
__autoreleasing object in a block, even though that is ill-formed.

The following compiles without generating any relevant warnings, but can crash
at runtime, either in objc_msgSend on the dealloc'd object, or in
objc_storeStrong/objc_retain when copying the __autoreleasing temporary to the
__strong as part of the implicit writeback logic in main().

/*
 clang -x objective-c -fobjc-arc -fmodules -framework Foundation -Weverything
-O -g test.m && lldb ./a.out
 run
 */
@import Foundation;

// Implicitly, the parameter is NSError *__autoreleasing *error:
//
<a href="http://clang.llvm.org/docs/AutomaticReferenceCounting.html#indirect-parameters">http://clang.llvm.org/docs/AutomaticReferenceCounting.html#indirect-parameters</a>
BOOL PerformOperationInNestedBlockWithError(NSError **error) {
  NSDictionary *dict = @{ @"a" : @"foo", @"b" : @"bar" };
  [dict enumerateKeysAndObjectsUsingBlock:^(id key, id val, BOOL *stop) {
    // Capturing |error| here is ill-formed:
    //
<a href="http://clang.llvm.org/docs/AutomaticReferenceCounting.html#storage-duration-of-autoreleasing-objects">http://clang.llvm.org/docs/AutomaticReferenceCounting.html#storage-duration-of-autoreleasing-objects</a>
    *error = [NSError errorWithDomain:NSCocoaErrorDomain
code:NSFeatureUnsupportedError userInfo:nil];
    *stop = YES;
  }];
  return NO;
}

int
main(int argc, char **argv) {
  NSError *error;
  if (!PerformOperationInNestedBlockWithError(&error)) {
    NSLog(@"error: %@", error);
  }
  return 0;
}</pre>
        </div>
      </p>
      <hr>
      <span>You are receiving this mail because:</span>
      
      <ul>
          <li>You are on the CC list for the bug.</li>
      </ul>
    </body>
</html>