[llvm-branch-commits] [clang] [analyzer] Only bind aggregate lifetime sources in LifetimeModeling for annotated functions (PR #214824)

[via llvm-branch-commits]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->
@llvm/pr-subscribers-clang

@llvm/pr-subscribers-clang-static-analyzer-1

Author: Benedek Kaibas (benedekaibas)

<details>
<summary>Changes</summary>

`checkPostCall` in `LifetimeModeling` should only bind aggregate lifetime sources if the code is annotated with `[[clang::lifetimebound]]`. If the code is not annotated then it's `DanglingPtrDeref`'s job to bind aggregate lifetime sources for functions (which will be done in a separate PR).  This PR is stacked on #<!-- -->214589.

---
Full diff: https://github.com/llvm/llvm-project/pull/214824.diff


2 Files Affected:

- (modified) clang/lib/StaticAnalyzer/Checkers/LifetimeModeling.cpp (+17-4) 
- (modified) clang/test/Analysis/lifetime-bound.cpp (+32) 


``````````diff
diff --git a/clang/lib/StaticAnalyzer/Checkers/LifetimeModeling.cpp b/clang/lib/StaticAnalyzer/Checkers/LifetimeModeling.cpp
index 882c90d10d72a..1f359d5f35cf6 100644
--- a/clang/lib/StaticAnalyzer/Checkers/LifetimeModeling.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/LifetimeModeling.cpp
@@ -167,6 +167,17 @@ lifetime_modeling::getRegionsFromAggrVal(SVal Val, CheckerContext &C) {
   return {};
 }
 
+static bool isAnnotated(const FunctionDecl *FD) {
+  for (const ParmVarDecl *PVD : FD->parameters()) {
+    if (PVD->hasAttr<LifetimeBoundAttr>())
+      return true;
+  }
+
+  if (lifetimes::implicitObjectParamIsLifetimeBound(FD))
+    return true;
+  return false;
+}
+
 void LifetimeModeling::checkPostCall(const CallEvent &Call,
                                      CheckerContext &C) const {
   ProgramStateRef State = C.getState();
@@ -180,11 +191,13 @@ void LifetimeModeling::checkPostCall(const CallEvent &Call,
     return;
 
   SVal RetVal = Call.getReturnValue();
-  SmallVector<const MemRegion *, 4> AggrRegs =
-      lifetime_modeling::getRegionsFromAggrVal(RetVal, C);
 
-  for (const MemRegion *I : AggrRegs) {
-    State = bindSource(State, RetVal, I);
+  if (isAnnotated(FD)) {
+    SmallVector<const MemRegion *, 4> AggrRegs =
+        lifetime_modeling::getRegionsFromAggrVal(RetVal, C);
+    for (const MemRegion *I : AggrRegs) {
+      State = bindSource(State, RetVal, I);
+    }
   }
 
   for (const ParmVarDecl *PVD : FD->parameters()) {
diff --git a/clang/test/Analysis/lifetime-bound.cpp b/clang/test/Analysis/lifetime-bound.cpp
index 749f264fe53eb..c421ba17325d4 100644
--- a/clang/test/Analysis/lifetime-bound.cpp
+++ b/clang/test/Analysis/lifetime-bound.cpp
@@ -471,3 +471,35 @@ IntPtrArr return_array_field_not_yet_detected() {
   // expected-note at -2    {{Address of stack memory associated with local variable 'z' returned to caller}}
   // expected-warning at -3 {{address of stack memory associated with local variable 'z' returned}}
 }
+
+struct Hold {
+  int *ptr;
+};
+
+Hold retPtr(int &x) {
+  return Hold{&x};
+}
+// Even though there is a lifetime error in the function
+// UseAfterLifetimeEnd should not emit a warning for this
+// case since there is no annotation present in the code.
+// The warning present in the test comes from core.StackAddressEscape
+// checker.
+Hold return_by_val_no_ann() {
+  int num = 4;
+  return retPtr(num);
+  // expected-warning at -1 {{Address of stack memory associated with local variable 'num' returned to caller}}
+  // expected-note at -2    {{Address of stack memory associated with local variable 'num' returned to caller}}
+}
+
+int *unwrap(Hold i [[clang::lifetimebound]]) { return i.ptr; }
+
+// FIXME: If an annotated argument is a by-value struct then
+// Arg.getAsRegion() returns null for CompoundVal/LazyCompoundVal
+// and the dangling pointer will not be detected.
+int *arg_aggregate_lifetimebound() {
+  int local_num = 5;
+  Hold h{&local_num};
+  return unwrap(h);
+  // expected-warning at -1 {{Address of stack memory associated with local variable 'local_num' returned to caller}}
+  // expected-note at -2    {{Address of stack memory associated with local variable 'local_num' returned to caller}}
+}

``````````

</details>


https://github.com/llvm/llvm-project/pull/214824