[all-commits] [llvm/llvm-project] 382992: [alpha.webkit.UncountedCallArgsChecker] Wait for t...

[Ryosuke Niwa via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 38299200b632536a769395c503c1f2fb2184e855
      https://github.com/llvm/llvm-project/commit/38299200b632536a769395c503c1f2fb2184e855
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2026-09-23 (Wed, 23 Sep 2026)

  Changed paths:
    M clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefCallArgsChecker.cpp
    A clang/test/Analysis/Checkers/WebKit/call-args-dependent-arg.cpp
    A clang/test/Analysis/Checkers/WebKit/call-args-generic-lambda.cpp

  Log Message:
  -----------
  [alpha.webkit.UncountedCallArgsChecker] Wait for the instantiation to check a dependent call argument (#224565)

RawPtrRefCallArgsChecker reported a call argument as unsafe when the
call appeared in an uninstantiated template pattern and the argument was
still type-dependent. In

    template <typename T> void f(T& voice) {
      Wrapper::create(protect(voice));
    }

Wrapper::create is qualified, so it is resolved in the pattern and its
parameter is known to be a raw reference, but protect(voice) is a
dependent call whose callee is still an UnresolvedLookupExpr.
tryToFindPtrOrigin has nothing to look at -- there is no callee decl and
the type of the call is '<dependent type>' rather than Ref<Voice> -- so
the argument was reported even though the instantiation resolves it to a
Ref. Giving the parameter a concrete type made the report go away with
no other change. The same happened in the body of a generic lambda,
which is such a pattern.

Skip type-dependent arguments and let the instantiation, which is
visited separately, decide. Function template instantiations were
already traversed, but a generic lambda's instantiated call operators
were not: with ShouldVisitImplicitCode disabled,
RecursiveASTVisitor::TraverseLambdaExpr only walks LambdaExpr::getBody()
and never the closure CXXRecordDecl. Traverse the specializations of the
dependent call operator as well, so that an argument which is only known
to be unsafe after instantiation is still reported.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications