[clang] 6ccc491 - [LifetimeSafety] Fix off-by-one crash in `lifetime_capture_by` argument indexing (#227231)

[via cfe-commits]

Author: Utkarsh Saxena
Date: 2026-09-29T11:58:07+02:00
New Revision: 6ccc4917217c650428fd36360690dad4a3f69d20

URL: https://github.com/llvm/llvm-project/commit/6ccc4917217c650428fd36360690dad4a3f69d20
DIFF: https://github.com/llvm/llvm-project/commit/6ccc4917217c650428fd36360690dad4a3f69d20.diff

LOG: [LifetimeSafety] Fix off-by-one crash in `lifetime_capture_by` argument indexing (#227231)

Fixes an off-by-one crash in the lifetime_capture_by attribute handling.
The CapturingArgIdx is already an index into the full Args array, but
the code was incorrectly creating a CallArgs array (dropping the first
argument for instance methods) and then indexing into it with
CapturingArgIdx, causing incorrect argument access and potential
out-of-bounds crashes.

Currently crashes at head: https://godbolt.org/z/7rYczK1z6

Added: 
    

Modified: 
    clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp
    clang/test/Sema/LifetimeSafety/safety.cpp

Removed: 
    


################################################################################
diff  --git a/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp b/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp
index 292e3279233bb..2457b8270cb80 100644
--- a/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp
+++ b/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp
@@ -1044,11 +1044,12 @@ void FactsGenerator::handleLifetimeCaptureBy(const FunctionDecl *FD,
           CapturingArgIdx == LifetimeCaptureByAttr::Unknown ||
           CapturingArgIdx == LifetimeCaptureByAttr::Invalid)
         continue;
-      ArrayRef<const Expr *> CallArgs = IsInstance ? Args.drop_front() : Args;
-      const Expr *CapturedByArg =
-          (CapturingArgIdx == LifetimeCaptureByAttr::This)
-              ? Args[0]
-              : CallArgs[CapturingArgIdx];
+      // FIXME: Diagnose bad CapturingArgIdx.
+      if (CapturingArgIdx != LifetimeCaptureByAttr::This &&
+          (CapturingArgIdx < 0 ||
+           static_cast<size_t>(CapturingArgIdx) >= Args.size()))
+        continue;
+      const Expr *CapturedByArg = Args[CapturingArgIdx];
       assert(CapturedByArg && "Capturer expression must be valid");
 
       OriginList *Dest = readValue(CapturedByArg);

diff  --git a/clang/test/Sema/LifetimeSafety/safety.cpp b/clang/test/Sema/LifetimeSafety/safety.cpp
index bf49e86577678..fb91fb30713db 100644
--- a/clang/test/Sema/LifetimeSafety/safety.cpp
+++ b/clang/test/Sema/LifetimeSafety/safety.cpp
@@ -4076,6 +4076,29 @@ void capturing_multiple_locals() {
     use(v);                         // expected-note 2 {{later used here}}
 }
 
+namespace off_by_one_crash {
+struct Item {
+  const int* ptr;
+};
+
+struct Container {
+  const Item* saved;
+};
+
+struct Helper {
+  void AddItem(const Item& item [[clang::lifetime_capture_by(c)]],
+               Container& c) const;
+  void Populate() const {
+    Container c{};
+    {
+      Item item;
+      AddItem(item, c); // expected-warning {{local variable 'item' does not live long enough}}
+    }                   // expected-note {{local variable 'item' is destroyed here}}
+    use(c);             // expected-note {{later used here}}
+  }
+};
+} // namespace off_by_one_crash
+
 struct [[gsl::Pointer()]] PtrWithInt { int x; };
 PtrWithInt f() {
   return PtrWithInt{10};