[all-commits] [llvm/llvm-project] 9906c5: [WebKit Checkers] Trace through temporaries in try...

[geoffreygaren via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 9906c580517b6e22df73a6f7206de551e4883a52
      https://github.com/llvm/llvm-project/commit/9906c580517b6e22df73a6f7206de551e4883a52
  Author: geoffreygaren <ggaren at apple.com>
  Date:   2026-09-21 (Mon, 21 Sep 2026)

  Changed paths:
    M clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp
    M clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.h
    M clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefCallArgsChecker.cpp
    M clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefLocalVarsChecker.cpp
    M clang/test/Analysis/Checkers/WebKit/uncounted-local-vars.cpp

  Log Message:
  -----------
  [WebKit Checkers] Trace through temporaries in tryToFindPtrOrigin (#224877)

RefPtr checking skips temporaries, reporting a path through any
temporary as unsafe. This is mostly correct, but not always. For
example, the following is a false positive:

    // makeKey() returns a temporary
    RefCountable* p = condition(makeKey()) ? guardian.ptr() : nullptr;

In the upcoming Borrow checker, it's even more important to trace
through temporaries because not tracing an expression can drop a
`lifetimebound` link, resulting in false **negatives**.

This patch adds tracing through temporaries. The logic is:

* In function call arguments, temporaries are lifetime safe because the
full expression does not end until the call returns

* In ranged for loops, temporaries are lifetime safe because lifetime
extends past the full expression to the duration of the loop (C++ P2718)

    * Otherwise, temporaries are not lifetime safe

Assisted-by: Claude



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications