llvmbot wrote:
<!--LLVM PR SUMMARY COMMENT--> @llvm/pr-subscribers-clang Author: None (martinboehme) <details> <summary>Changes</summary> - **Reapply "[clang][dataflow] Don't propagate result objects in unevaluated contexts (#<!-- -->90438)"** - **fixup! Reapply "[clang][dataflow] Don't propagate result objects in unevaluated contexts (#<!-- -->90438)"** --- Full diff: https://github.com/llvm/llvm-project/pull/91172.diff 2 Files Affected: - (modified) clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp (+11) - (modified) clang/unittests/Analysis/FlowSensitive/TransferTest.cpp (+54) ``````````diff diff --git a/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp b/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp index d79e734402892a..cb6c8b2ef1072b 100644 --- a/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp +++ b/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp @@ -350,6 +350,17 @@ class ResultObjectVisitor : public RecursiveASTVisitor<ResultObjectVisitor> { return RecursiveASTVisitor<ResultObjectVisitor>::TraverseDecl(D); } + // Don't traverse expressions in unevaluated contexts, as we don't model + // fields that are only used in these. + // Note: The operand of the `noexcept` operator is an unevaluated operand, but + // nevertheless it appears in the Clang CFG, so we don't exclude it here. + bool TraverseDecltypeTypeLoc(DecltypeTypeLoc) { return true; } + bool TraverseTypeOfExprTypeLoc(TypeOfExprTypeLoc) { return true; } + bool TraverseCXXTypeidExpr(CXXTypeidExpr *) { return true; } + bool TraverseUnaryExprOrTypeTraitExpr(UnaryExprOrTypeTraitExpr *) { + return true; + } + bool TraverseBindingDecl(BindingDecl *BD) { // `RecursiveASTVisitor` doesn't traverse holding variables for // `BindingDecl`s by itself, so we need to tell it to. diff --git a/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp b/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp index 0b441faa6c76da..6743e778a2ffeb 100644 --- a/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp +++ b/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp @@ -3400,6 +3400,60 @@ TEST(TransferTest, ResultObjectLocationDontVisitNestedRecordDecl) { ASTContext &ASTCtx) {}); } +TEST(TransferTest, ResultObjectLocationDontVisitUnevaluatedContexts) { + // This is a crash repro. + // We used to crash because when propagating result objects, we would visit + // unevaluated contexts, but we don't model fields used only in these. + + auto testFunction = [](llvm::StringRef Code, llvm::StringRef TargetFun) { + runDataflow( + Code, + [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results, + ASTContext &ASTCtx) {}, + LangStandard::lang_gnucxx17, + /* ApplyBuiltinTransfer= */ true, TargetFun); + }; + + std::string Code = R"cc( + // Definitions needed for `typeid`. + namespace std { + class type_info {}; + class bad_typeid {}; + } // namespace std + + struct S1 {}; + struct S2 { S1 s1; }; + + // We test each type of unevaluated context from a different target + // function. Some types of unevaluated contexts may actually cause the + // field `s1` to be modeled, and we don't want this to "pollute" the tests + // for the other unevaluated contexts. + void decltypeTarget() { + decltype(S2{}) Dummy; + } + void typeofTarget() { + typeof(S2{}) Dummy; + } + void typeidTarget() { +#if __has_feature(cxx_rtti) + typeid(S2{}); +#endif + } + void sizeofTarget() { + sizeof(S2{}); + } + void noexceptTarget() { + noexcept(S2{}); + } + )cc"; + + testFunction(Code, "decltypeTarget"); + testFunction(Code, "typeofTarget"); + testFunction(Code, "typeidTarget"); + testFunction(Code, "sizeofTarget"); + testFunction(Code, "noexceptTarget"); +} + TEST(TransferTest, StaticCast) { std::string Code = R"( void target(int Foo) { `````````` </details> https://github.com/llvm/llvm-project/pull/91172 _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits