[llvm-bugs] [Bug 42433] New: clang-analyzer-cplusplus.Move false positive due to incompletely tracked data dependency

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=42433

            Bug ID: 42433
           Summary: clang-analyzer-cplusplus.Move false positive due to
                    incompletely tracked data dependency
           Product: clang
           Version: trunk
          Hardware: PC
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: Static Analyzer
          Assignee: dcoughlin at apple.com
          Reporter: bbannier at gmail.com
                CC: dcoughlin at apple.com, llvm-bugs at lists.llvm.org

We are seeing a false positive from `clang-analyzer-cplusplus.Move` in our code
which looks like it is due to incomplete tracking of data dependencies.

A somewhat simplified example:
```
// file test.cpp
#include <string>
#include <utility>

enum class Flow { BREAK, CONTINUE };

struct F {
  template <typename T> F(T, Flow f) : _flow(f) {}
  Flow _flow;
};

template <typename T> F break_(T &&t) {
  return F{std::forward<T>(t), Flow::BREAK};
}

F continue_() { return F{0, Flow::CONTINUE}; }

template <typename Body> void while_(Body &&body) {
  auto flow = body();

  switch (flow._flow) {
  case Flow::CONTINUE: {
    body();
    break;
  }
  case Flow::BREAK:
    return;
  }

  return while_(body);
}

int main() {
    std::string s("foo");

    while_([&]() -> F {
      if (!s.empty()) {
        return break_(std::move(s));
      } else {
        s = std::string();
        return continue_();
      }
    });
}
```

When analyzed this gives
```
$ clang-tidy -checks='-*,clang-analyzer-cplusplus.Move' test.cpp -- --std=c++11
1 warning generated.
/test.cpp:12:12: warning: Moved-from object 's' of type
'std::__cxx11::basic_string' is moved [clang-analyzer-cplusplus.Move]
  return F{std::forward<T>(t), Flow::BREAK};
           ^
/test.cpp:35:5: note: Calling 'while_<(lambda at /test.cpp:35:12)>'
    while_([&]() -> F {
    ^
/test.cpp:20:3: note: Control jumps to 'case CONTINUE:'  at line 21
  switch (flow._flow) {
  ^
/test.cpp:22:5: note: Calling 'operator()'
    body();
    ^
/test.cpp:36:11: note: Assuming the condition is true
      if (!s.empty()) {
          ^
/test.cpp:36:7: note: Taking true branch
      if (!s.empty()) {
      ^
/test.cpp:37:16: note: Calling 'break_<std::__cxx11::basic_string<char>>'
        return break_(std::move(s));
               ^
/test.cpp:12:12: note: Object 's' of type 'std::__cxx11::basic_string' is left
in a valid but unspecified state after move
  return F{std::forward<T>(t), Flow::BREAK};
           ^
/test.cpp:37:16: note: Returning from
'break_<std::__cxx11::basic_string<char>>'
        return break_(std::move(s));
               ^
/test.cpp:22:5: note: Returning from 'operator()'
    body();
    ^
/test.cpp:23:5: note:  Execution continues on line 29
    break;
    ^
/test.cpp:29:10: note: Calling 'while_<(lambda at /test.cpp:35:12) &>'
  return while_(body);
         ^
/test.cpp:18:15: note: Calling 'operator()'
  auto flow = body();
              ^
/test.cpp:36:11: note: Assuming the condition is true
      if (!s.empty()) {
          ^
/test.cpp:36:7: note: Taking true branch
      if (!s.empty()) {
      ^
/test.cpp:37:16: note: Calling 'break_<std::__cxx11::basic_string<char>>'
        return break_(std::move(s));
               ^
//test.cpp:12:12: note: Moved-from object 's' of type
'std::__cxx11::basic_string' is moved
  return F{std::forward<T>(t), Flow::BREAK};
           ^
```

I am seeing this with clang version `44019e8c500fba0cece458d2e44700c967f247c9`
(`git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@364630
91177308-0d34-0410-b5e6-96231b3b80d8`).

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20190628/4f4fc7e8/attachment-0001.html>