[clang] [LifetimeSafety] Fix crash on explicit object member functions (PR #212154)

[via cfe-commits]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-clang-analysis

Author: arhwx

<details>
<summary>Changes</summary>

`-Wlifetime-safety` crashes on any call to an explicit object member function template:
```c++
struct Foo {
  template <typename T>
  int get(this Foo &&self, T) { return self.field; }
  
  int field;
};

void call() { Foo().get(0); }
```

`handleMovedArgsInCall` pairs `Args[I]` with `getParamDecl(I - 1)`, assuming the object argument has no corresponding `ParmVarDecl`. An explicit object parameter is a `ParmVarDecl`, so the offset misaligned them and the object parameter got paired with the following argument, which has no origins. So the assert dereferenced the null `OriginList`.

The same offset appears in `IsArgLifetimeBound` and `handleLifetimeCaptureBy`, where it reads the attribute off the wrong parameter instead of crashing. I have left those for a separate change.

Fixes #<!-- -->204210

---
Full diff: https://github.com/llvm/llvm-project/pull/212154.diff


2 Files Affected:

- (modified) clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp (+2-1) 
- (added) clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp (+18) 


``````````diff
diff --git a/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp b/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp
index 466bb2185c6d8..e858e0b54688b 100644
--- a/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp
+++ b/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp
@@ -911,7 +911,8 @@ void FactsGenerator::handleMovedArgsInCall(const FunctionDecl *FD,
                                            ArrayRef<const Expr *> Args) {
   unsigned IsInstance = 0;
   if (const auto *MD = dyn_cast<CXXMethodDecl>(FD);
-      MD && MD->isInstance() && !isa<CXXConstructorDecl>(FD)) {
+      MD && !isa<CXXConstructorDecl>(FD) &&
+      MD->isImplicitObjectMemberFunction()) {
     IsInstance = 1;
     // std::unique_ptr::release() transfers ownership.
     // Treat it as a move to prevent false-positive warnings when the unique_ptr
diff --git a/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp
new file mode 100644
index 0000000000000..56615437ab1ae
--- /dev/null
+++ b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp
@@ -0,0 +1,18 @@
+// RUN: %clang_cc1 %s -std=c++23 -verify -fsyntax-only -Wlifetime-safety
+
+// expected-no-diagnostics
+
+// Explicit object member functions must not be treated as having an implicit
+// object argument.
+struct Foo {
+  template <typename T>
+  int get(this Foo &&self, T) {
+    return self.field;
+  }
+
+  int field;
+};
+
+void call() {
+  Foo().get(0);
+}

``````````

</details>


https://github.com/llvm/llvm-project/pull/212154