[PATCH] D43689: [analyzer] Disable constructor inlining when lifetime extension through fields occurs.
Phabricator via Phabricator via cfe-commits
cfe-commits at lists.llvm.org
Tue Feb 27 12:16:27 PST 2018
This revision was automatically updated to reflect the committed changes.
Closed by commit rC326240: [analyzer] Disable constructor inlining when lifetime extending through a field. (authored by dergachev, committed by ).
Changed prior to commit:
https://reviews.llvm.org/D43689?vs=135669&id=136133#toc
Repository:
rC Clang
https://reviews.llvm.org/D43689
Files:
include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
test/Analysis/lifetime-extension.cpp
Index: lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
===================================================================
--- lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
+++ lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
@@ -678,6 +678,11 @@
// the fake temporary target.
if (CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion)
return CIP_DisallowedOnce;
+
+ // If the temporary is lifetime-extended by binding a smaller object
+ // within it to a reference, automatic destructors don't work properly.
+ if (CallOpts.IsTemporaryLifetimeExtendedViaSubobject)
+ return CIP_DisallowedOnce;
}
break;
Index: lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
===================================================================
--- lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
+++ lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
@@ -168,6 +168,18 @@
break;
}
case ConstructionContext::TemporaryObjectKind: {
+ const auto *TOCC = cast<TemporaryObjectConstructionContext>(CC);
+ // See if we're lifetime-extended via our field. If so, take a note.
+ // Because automatic destructors aren't quite working in this case.
+ if (const auto *MTE = TOCC->getMaterializedTemporaryExpr()) {
+ if (const ValueDecl *VD = MTE->getExtendingDecl()) {
+ assert(VD->getType()->isReferenceType());
+ if (VD->getType()->getPointeeType().getCanonicalType() !=
+ MTE->GetTemporaryExpr()->getType().getCanonicalType()) {
+ CallOpts.IsTemporaryLifetimeExtendedViaSubobject = true;
+ }
+ }
+ }
// TODO: Support temporaries lifetime-extended via static references.
// They'd need a getCXXStaticTempObjectRegion().
CallOpts.IsTemporaryCtorOrDtor = true;
Index: include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
===================================================================
--- include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
+++ include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
@@ -65,6 +65,10 @@
bool IsArrayCtorOrDtor = false;
/// This call is a constructor or a destructor of a temporary value.
bool IsTemporaryCtorOrDtor = false;
+ /// This call is a constructor for a temporary that is lifetime-extended
+ /// by binding a smaller object within it to a reference, for example
+ /// 'const int &x = C().x;'.
+ bool IsTemporaryLifetimeExtendedViaSubobject = false;
EvalCallOptions() {}
};
Index: test/Analysis/lifetime-extension.cpp
===================================================================
--- test/Analysis/lifetime-extension.cpp
+++ test/Analysis/lifetime-extension.cpp
@@ -39,18 +39,10 @@
const int &y = A().j[1]; // no-crash
const int &z = (A().j[1], A().j[0]); // no-crash
- clang_analyzer_eval(x == 1);
- clang_analyzer_eval(y == 3);
- clang_analyzer_eval(z == 2);
-#ifdef TEMPORARIES
- // expected-warning at -4{{TRUE}}
- // expected-warning at -4{{TRUE}}
- // expected-warning at -4{{TRUE}}
-#else
- // expected-warning at -8{{UNKNOWN}}
- // expected-warning at -8{{UNKNOWN}}
- // expected-warning at -8{{UNKNOWN}}
-#endif
+ // FIXME: All of these should be TRUE, but constructors aren't inlined.
+ clang_analyzer_eval(x == 1); // expected-warning{{UNKNOWN}}
+ clang_analyzer_eval(y == 3); // expected-warning{{UNKNOWN}}
+ clang_analyzer_eval(z == 2); // expected-warning{{UNKNOWN}}
}
} // end namespace pr19539_crash_on_destroying_an_integer
@@ -144,12 +136,7 @@
const bool &x = C(true, &after, &before).x; // no-crash
}
// FIXME: Should be TRUE. Should not warn about garbage value.
- clang_analyzer_eval(after == before);
-#ifdef TEMPORARIES
- // expected-warning at -2{{The left operand of '==' is a garbage value}}
-#else
- // expected-warning at -4{{UNKNOWN}}
-#endif
+ clang_analyzer_eval(after == before); // expected-warning{{UNKNOWN}}
}
} // end namespace maintain_original_object_address_on_lifetime_extension
-------------- next part --------------
A non-text attachment was scrubbed...
Name: D43689.136133.patch
Type: text/x-patch
Size: 3992 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20180227/8c81320b/attachment.bin>
More information about the cfe-commits
mailing list