[all-commits] [llvm/llvm-project] d28d49: [alpha.webkit.UncountedLocalVarsChecker] Wait for ...

[Ryosuke Niwa via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: d28d490e113147bed0061a1bde79ebc982cbdb52
      https://github.com/llvm/llvm-project/commit/d28d490e113147bed0061a1bde79ebc982cbdb52
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2026-09-23 (Wed, 23 Sep 2026)

  Changed paths:
    M clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefLocalVarsChecker.cpp
    A clang/test/Analysis/Checkers/WebKit/local-vars-dependent-init.cpp

  Log Message:
  -----------
  [alpha.webkit.UncountedLocalVarsChecker] Wait for the instantiation to check a dependent local variable (#224566)

RawPtrRefLocalVarsChecker had the same false positive as the call
arguments checker: a local variable whose declared type is a concrete
raw pointer was reported when its initializer was still type-dependent.
In

    template <typename T> void f(T& guard) {
      Voice* v = guard.ptr();
    }

the declared type Voice* makes isUnsafePtr fire, while guard.ptr() is a
CXXDependentScopeMemberExpr, so tryToFindPtrOrigin bails out before it
can reach the guardian analysis which makes the resolved form safe. The
instantiation is character for character the concrete form, which is not
reported.

Skip type-dependent initializers and traverse the instantiated call
operators of a generic lambda, as in the call arguments checker. Unlike
there, each specialization also has to be installed as DeclWithIssue
while its body is traversed: the guardian analysis runs GuardianVisitor
over the body of DeclWithIssue, and pointed at the function enclosing
the lambda it walks the dependent pattern instead, where VisitCallExpr
gives up on a null getDirectCallee() and every guarded local is reported
again.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications