[clang] [LifetimeSafety] Fix crash on explicit object member functions (PR #212154)

[via cfe-commits]

https://github.com/arhwx updated https://github.com/llvm/llvm-project/pull/212154

>From ef4a173b0d6a9c13a7fe99a490e34b09e4e2aa83 Mon Sep 17 00:00:00 2001
From: arhwx <arahwrm at gmail.com>
Date: Sun, 26 Jul 2026 18:08:56 -0400
Subject: [PATCH 1/3] [LifetimeSafety] Fix crash on explicit object member
 functions

handleMovedArgsInCall assumed the object argument is absent
from FunctionDecl::parameters() and applied a one parameter
offset. An explicit object parameter is a regular
ParmVarDecl, so the offset misaligned arguments with
parameters and the assert dereferenced a null OriginList.

Fixes #204210
---
 .../Analysis/LifetimeSafety/FactsGenerator.cpp |  3 ++-
 .../explicit-object-param-no-crash.cpp         | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp

diff --git a/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp b/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp
index 466bb2185c6d8..e858e0b54688b 100644
--- a/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp
+++ b/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp
@@ -911,7 +911,8 @@ void FactsGenerator::handleMovedArgsInCall(const FunctionDecl *FD,
                                            ArrayRef<const Expr *> Args) {
   unsigned IsInstance = 0;
   if (const auto *MD = dyn_cast<CXXMethodDecl>(FD);
-      MD && MD->isInstance() && !isa<CXXConstructorDecl>(FD)) {
+      MD && !isa<CXXConstructorDecl>(FD) &&
+      MD->isImplicitObjectMemberFunction()) {
     IsInstance = 1;
     // std::unique_ptr::release() transfers ownership.
     // Treat it as a move to prevent false-positive warnings when the unique_ptr
diff --git a/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp
new file mode 100644
index 0000000000000..56615437ab1ae
--- /dev/null
+++ b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp
@@ -0,0 +1,18 @@
+// RUN: %clang_cc1 %s -std=c++23 -verify -fsyntax-only -Wlifetime-safety
+
+// expected-no-diagnostics
+
+// Explicit object member functions must not be treated as having an implicit
+// object argument.
+struct Foo {
+  template <typename T>
+  int get(this Foo &&self, T) {
+    return self.field;
+  }
+
+  int field;
+};
+
+void call() {
+  Foo().get(0);
+}

>From 549b8ce565201f3839f43de668de0a3982251c87 Mon Sep 17 00:00:00 2001
From: arhwx <arahwrm at gmail.com>
Date: Mon, 27 Jul 2026 01:15:03 -0400
Subject: [PATCH 2/3] [LifetimeSafety] Add explicit object parameter test
 coverage

---
 .../explicit-object-param-no-crash.cpp        | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp
index 56615437ab1ae..159c342f15527 100644
--- a/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp
+++ b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp
@@ -13,6 +13,38 @@ struct Foo {
   int field;
 };
 
+struct Base {};
+struct Derived : Base {
+  int base(this Base &&, int);
+};
+
+template <typename T>
+struct Crtp {
+  template <typename Self>
+  int deduced(this Self &&self, T) {
+    return self.field;
+  }
+};
+
+struct Widget : Crtp<int> {
+  int field;
+};
+
+struct NoMove {
+  NoMove() = default;
+  NoMove(NoMove &&) = delete;
+  NoMove(const NoMove &) = delete;
+
+  int get(this NoMove &&self, int) {
+    return self.field;
+  }
+
+  int field;
+};
+
 void call() {
   Foo().get(0);
+  Derived().base(0);
+  Widget().deduced(0);
+  NoMove().get(0);
 }

>From 3cb27ed309f13003df61507d29d8095bb1f2012c Mon Sep 17 00:00:00 2001
From: arhwx <arahwrm at gmail.com>
Date: Mon, 27 Jul 2026 03:50:43 -0400
Subject: [PATCH 3/3] [LifetimeSafety] Avoid treating explicit object parameter
 as moved

---
 .../LifetimeSafety/FactsGenerator.cpp         |  2 ++
 .../explicit-object-param-no-crash.cpp        | 27 ++++++++++++++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp b/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp
index e858e0b54688b..4b045731e92a8 100644
--- a/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp
+++ b/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp
@@ -930,6 +930,8 @@ void FactsGenerator::handleMovedArgsInCall(const FunctionDecl *FD,
   for (unsigned I = IsInstance;
        I < Args.size() && I < FD->getNumParams() + IsInstance; ++I) {
     const ParmVarDecl *PVD = FD->getParamDecl(I - IsInstance);
+    if (PVD->isExplicitObjectParameter())
+      continue;
     if (!PVD->getType()->isRValueReferenceType())
       continue;
     // Skip lifetime annotated r-value reference parameters. Lifetime annotation
diff --git a/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp
index 159c342f15527..56c170e188af7 100644
--- a/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp
+++ b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp
@@ -1,4 +1,4 @@
-// RUN: %clang_cc1 %s -std=c++23 -verify -fsyntax-only -Wlifetime-safety
+// RUN: %clang_cc1 %s -std=c++23 -verify -fsyntax-only -Wlifetime-safety -Wlifetime-safety-lifetimebound-violation
 
 // expected-no-diagnostics
 
@@ -42,9 +42,34 @@ struct NoMove {
   int field;
 };
 
+template <typename T>
+struct SharedPtr {
+  SharedPtr() = default;
+  SharedPtr(SharedPtr &&o) : p(o.p) { o.p = nullptr; }
+  SharedPtr(const SharedPtr &) = default;
+
+  int get(this SharedPtr &&self, int) {
+    return self.p->field;
+  }
+
+  T *p = nullptr;
+};
+
 void call() {
   Foo().get(0);
   Derived().base(0);
   Widget().deduced(0);
   NoMove().get(0);
+  SharedPtr<NoMove>().get(0);
+}
+
+struct Holder {
+  int field;
+  const int *borrow() [[clang::lifetimebound]] { return &field; }
+  void consume(this Holder &&self) {}
+};
+
+const int *object_arg_is_not_moved(Holder &&h [[clang::lifetimebound]]) {
+  static_cast<Holder &&>(h).consume();
+  return h.borrow();
 }