[all-commits] [llvm/llvm-project] 9b0ea6: [webkit.UncountedLambdaCapturesChecker] Skip templ...

[Ryosuke Niwa via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 9b0ea6b5a754677a5d01b7908f4d05ca9d9ebdf0
      https://github.com/llvm/llvm-project/commit/9b0ea6b5a754677a5d01b7908f4d05ca9d9ebdf0
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2026-09-22 (Tue, 22 Sep 2026)

  Changed paths:
    M clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefLambdaCapturesChecker.cpp
    M clang/test/Analysis/Checkers/WebKit/uncounted-lambda-captures.cpp

  Log Message:
  -----------
  [webkit.UncountedLambdaCapturesChecker] Skip template patterns while traversing (#224572)

870d762546ee taught RawPtrRefLambdaCapturesChecker to ignore a lambda
passed to a call whose callee isn't resolved yet, by enumerating the
expressions that appear in a template pattern in place of a resolved
call: an OverloadExpr, a CXXDependentScopeMemberExpr or a
DependentScopeDeclRefExpr as the callee, a CXXUnresolvedConstructExpr,
and a type-dependent ParenListExpr or InitListExpr.

That list can only ever be approximate. A call through an object of
dependent type, as in

    template <typename T> void f(T& callable) {
      RefCountable* obj = make_obj();
      callable([obj] { obj->method(); });
    }

has a plain DeclRefExpr to the parameter as its callee, so none of the
cases matched and the lambda was reported even when the instantiation
passes it to a NOESCAPE parameter.

Take the approach used by the call arguments and local variables
checkers instead: don't enter a template pattern at all. TraverseDecl
now skips a templated decl, so every callee a handler sees is resolved
and the special cases are no longer reachable. The body of a generic
lambda is reached from the LambdaExpr as a statement, so
TraverseLambdaExpr hands the call operator to TraverseDecl, which skips
the pattern and traverses the instantiations.

Because an instantiation is now traversed as a declaration rather than
as a body, TraverseCXXMethodDecl would set the enclosing class to the
closure type. Keep the class of the enclosing method for a lambda's call
operator, which is what 'this' in the body refers to, so captures of
this are still reported.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications