https://github.com/steakhal updated https://github.com/llvm/llvm-project/pull/207433
From 3c53a0d99b4980e29a4cac8f7491a3088580f212 Mon Sep 17 00:00:00 2001 From: Balazs Benics <[email protected]> Date: Thu, 2 Jul 2026 15:17:09 +0100 Subject: [PATCH 1/7] [analyzer][docs] CSA release notes for clang-23 The commits were gathered using: ```sh git log --reverse --oneline llvmorg-23-init..llvm/main \ clang/lib/StaticAnalyzer clang/include/clang/StaticAnalyzer | \ grep -v NFC | grep -v OpenACC | grep -v -i revert | grep -v -i "webkit" ``` I used the `LLVM_ENABLE_SPHINX=ON` and `LLVM_ENABLE_DOXYGEN=ON` cmake options to enable the `docs-clang-html` build target, which generates the html into `build/tools/clang/docs/html/ReleaseNotes.html` of which I attach the screenshots to let you judge if it looks all good or not. I've swapped the PR links to the issue links when a PR was fixing an open GitHub issue. Those issues anyway have a link to the PR inside. Assisted-by: Claude Opus 4.8 --- clang/docs/ReleaseNotes.md | 78 +++++++++++++++++++++++++++++--------- 1 file changed, 60 insertions(+), 18 deletions(-) diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md index 3e6c10666ca16..e9df88cac3306 100644 --- a/clang/docs/ReleaseNotes.md +++ b/clang/docs/ReleaseNotes.md @@ -1074,33 +1074,75 @@ latest release, please see the [Clang Web Site](https://clang.llvm.org) or the ### Static Analyzer -- The `-analyzer-constraints` option `z3` was renamed to `unsupported-z3` - because the Z3-based (constraint) solver was known for crashing for years now. - Didn't receive support, so it was marked unsupported. +% comment: +% This is for the Static Analyzer. +% Subsections (using `####`), in this order, only when they have content: +% - New checkers and features +% - Crash and bug fixes +% - Improvements +% - Moved checkers +% - Removed checkers +% - Diagnostic changes + +#### New checkers and features + +- Introduced the experimental `alpha.cplusplus.UseAfterLifetimeEnd` checker to detect dangling pointers and references bound to local variables that go out of scope, using the `[[clang::lifetimebound]]` annotation. (#GH205521) +- Introduced the `optin.core.UnconditionalVAArg` checker to report variadic functions that unconditionally use `va_arg()`, which is undefined behavior when the function is called without any variadic arguments (SEI-CERT EXP47-C). (#GH175602) +- The `unix.DynamicMemoryModeling` modeling gained a new option to create branches where a memory allocation fails and returns a null pointer. It is disabled by default. (#GH205371) +- The `security.insecureAPI.DeprecatedOrUnsafeBufferHandling` checker gained a new `ReportInC99AndEarlier` option. When enabled, deprecated buffer-handling functions (`memcpy`, `memset`, `memmove`, etc.) are also reported when not compiling for C11 or later. It is disabled by default. (#GH168704, #GH177379) +- The `optin.taint.TaintPropagation` checker gained a new `EnableDefaultConfig` option, which makes it possible to disable the built-in taint configuration and use a fully custom configuration instead. (#GH176185) #### Crash and bug fixes -- Fixed `security.VAList` checker producing false positives when analyzing - C23 code where `va_start` expands to `__builtin_c23_va_start`. -- Fixed a compiler crash when combining `_Atomic` and `__auto_type` - in C, for example `_Atomic __auto_type x = expr`. (#GH118058) +- Fixed the `security.VAList` checker producing false positives when analyzing C23 code where `va_start` expands to `__builtin_c23_va_start`. (#GH192024) +- Fixed a crash when copying uninitialized data in a function named `swap`. (#GH178797) +- Fixed a compiler crash when combining `_Atomic` and `__auto_type` in C, for example `_Atomic __auto_type x = expr`. (#GH118058) +- Fixed a crash in the `unix.Malloc` checker when a function is annotated with both `ownership_returns` and `ownership_takes` (or `ownership_holds`). (#GH183344) +- Fixed a crash in the `alpha.unix.cstring` checkers on zero-size element types (for example an empty struct in C). (#GH190457) +- Fixed a use-after-free in `CheckerContext::getMacroNameOrSpelling`. (#GH194174) +- Fixed a false positive in the `alpha.unix.cstring` checkers when the buffer argument points into the middle of an array, such as `memcpy(dst, &arr[i], size)`. (#GH198346) +- Fixed the default binding of union aggregates being overwritten when initializing array elements with union members. (#GH178694) +- The analyzer no longer rules out the equality of a pointer to the stack and a symbolic pointer in unknown space, because a function may return a pointer to some other stack frame (for example one received as an argument). (#GH187080) +- Fixed bad logic in `VisitArrayInitLoopExpr` that used the wrong parent node when binding the expression value. (#GH196974) +- Fixed bad logic in `ExprEngine::evalBind` so that both the `check::Bind` and the pointer-escape checkers get a chance to run when binding to an `Unknown` or `Undefined` memory location. (#GH196313) +- Fixed an unjustified early return in `ExprEngine::processCallExit` that could drop execution paths produced by `removeDead`. (#GH205656) +- Fixed `CallEvent::getReturnValueUnderConstruction` to use the `LocationContext` and `CFGElementRef` stored in the `CallEvent` instead of the currently analyzed ones. (#GH187020) +- Fixed the `getcwd` summary in the `unix.StdCLibraryFunctions` checker. (#GH175136) #### Improvements -- `alpha.unix.PthreadLock` now emits path notes on lock, unlock, destroy, - and init operations. - -% comment: -% This is for the Static Analyzer. -% Using the caret `^^^` underlining for subsections: -% - Crash and bug fixes -% - New checkers and features -% - Improvements -% - Moved checkers +- The unmaintained and crash-prone Z3 constraint-manager backend selected via `-analyzer-constraints=z3` was renamed to `-analyzer-constraints=unsupported-z3` to make its unsupported status explicit. (#GH205370) +- The conservative call-invalidation logic now invalidates the object of an opaque constructor call regardless of whether an argument refers to it. (#GH170887) +- Improved the resolution of constant values from initializers in RegionStore, including preserving default bindings for aggregate-like cases, generalized field-initializer resolution for arbitrary nesting, and normalized sub-array indices. (#GH199271) +- The analyzer now conservatively evaluates `std::sort`, `std::stable_sort`, and `std::inplace_merge` to prevent false positives caused by complex STL internals that cannot be modeled adequately by the engine. (#GH177804) +- The `optin.cplusplus.VirtualCall` checker no longer reports virtual method calls during construction/destruction when the call site is in a system header. (#GH184178) +- Reduced false positives of the `unix.MallocSizeof` checker for layout-compatible types, such as `malloc(sizeof(std::atomic<int32_t>))` assigned to an `int32_t *`. (#GH200253) +- The `optin.core.FixedAddressDereference` checker no longer reports dereferences of a fixed address when the pointee is `volatile`. (#GH181644) +- Improved `[[clang::suppress]]` handling for tricky template specializations, nested templates, and friend function templates that are forward-declared at namespace scope. (#GH182659, #GH178441, #GH183727, #GH187043) +- The `unix.BlockInCriticalSection` checker now understands `std::scoped_lock` in addition to `std::lock_guard` and `std::unique_lock`. (#GH176134) +- The `alpha.unix.cstring` sub-checkers were untangled so that each one models and reports independently instead of relying on another sub-checker being enabled. (#GH186802) +- The analyzer now detects reads of uninitialized dynamically-allocated objects. (#GH193001) +- The `cplusplus.Move` checker can now detect a use-after-move for the three-argument `std::move` on containers (when `alpha.cplusplus.IteratorModeling` is also enabled). (#GH137157) +- The condition of a `switch` statement now triggers the `check::BranchCondition` callback, so checkers like `core.uninitialized.Branch` can report an undefined `switch` condition. (#GH182058) +- Improved handling of multiple `[[assume]]` attributes on a single statement. (#GH198618) +- When the execution environment is untrusted, the `argv`, `argc`, and `envp` parameters of `main` are now treated as taint sources. (#GH178054) +- The `alpha.unix.PthreadLock` checker now emits path notes on lock, unlock, destroy, and init operations. (#GH202473) +- Added a new `check::LifetimeEnd` callback that fires for each `CFGLifetimeEnds` element, which is useful for detecting dangling pointers. (#GH201123) +- The `unix.StdCLibraryFunctions` standard-library summaries were optimized for binary size. (#GH202662) +- Fixed the alignment of entries printed by `clang -cc1 -analyzer-print-analyzer-options` / `-analyzer-help`. (#GH190570) #### Moved checkers -- The checker `unix.cstring.UninitializedRead` is now out of alpha. +- The checker `unix.cstring.UninitializedRead` is now out of alpha. (#GH196292) + +#### Removed checkers + +- The `alpha.core.FixedAddr` checker was removed. It was overly simplistic and is largely superseded by the `optin.core.FixedAddressDereference` checker. (#GH182033) + +#### Diagnostic changes + +- Cross Translation Unit (CTU) import failures are now reported at the location where the imported symbol would be used, making it easier to understand why a cross-TU bug was missed. (#GH188795) +- Uninitialized-value diagnostics no longer emit a misleading "initialized here" note for a variable that was declared without an initializer; the note now reads "declared without an initial value". (#GH198345) (release-notes-sanitizers)= From 11d44e7570b5a7b0c28b3186e1006d0a30f110df Mon Sep 17 00:00:00 2001 From: Balazs Benics <[email protected]> Date: Mon, 13 Jul 2026 10:53:18 +0100 Subject: [PATCH 2/7] Drop the entry about VisitArrayInitLoopExpr --- clang/docs/ReleaseNotes.md | 1 - 1 file changed, 1 deletion(-) diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md index 32782bcc60201..e76548e816a88 100644 --- a/clang/docs/ReleaseNotes.md +++ b/clang/docs/ReleaseNotes.md @@ -1204,7 +1204,6 @@ latest release, please see the [Clang Web Site](https://clang.llvm.org) or the - Fixed a false positive in the `alpha.unix.cstring` checkers when the buffer argument points into the middle of an array, such as `memcpy(dst, &arr[i], size)`. (#GH198346) - Fixed the default binding of union aggregates being overwritten when initializing array elements with union members. (#GH178694) - The analyzer no longer rules out the equality of a pointer to the stack and a symbolic pointer in unknown space, because a function may return a pointer to some other stack frame (for example one received as an argument). (#GH187080) -- Fixed bad logic in `VisitArrayInitLoopExpr` that used the wrong parent node when binding the expression value. (#GH196974) - Fixed bad logic in `ExprEngine::evalBind` so that both the `check::Bind` and the pointer-escape checkers get a chance to run when binding to an `Unknown` or `Undefined` memory location. (#GH196313) - Fixed an unjustified early return in `ExprEngine::processCallExit` that could drop execution paths produced by `removeDead`. (#GH205656) - Fixed `CallEvent::getReturnValueUnderConstruction` to use the `LocationContext` and `CFGElementRef` stored in the `CallEvent` instead of the currently analyzed ones. (#GH187020) From fb06d0fb110016a6fec6f8f5217c8fe7d055594f Mon Sep 17 00:00:00 2001 From: Balazs Benics <[email protected]> Date: Mon, 13 Jul 2026 10:57:50 +0100 Subject: [PATCH 3/7] Drop 3 more entries as per requested --- clang/docs/ReleaseNotes.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md index e76548e816a88..e9649ea8af2ad 100644 --- a/clang/docs/ReleaseNotes.md +++ b/clang/docs/ReleaseNotes.md @@ -1204,9 +1204,6 @@ latest release, please see the [Clang Web Site](https://clang.llvm.org) or the - Fixed a false positive in the `alpha.unix.cstring` checkers when the buffer argument points into the middle of an array, such as `memcpy(dst, &arr[i], size)`. (#GH198346) - Fixed the default binding of union aggregates being overwritten when initializing array elements with union members. (#GH178694) - The analyzer no longer rules out the equality of a pointer to the stack and a symbolic pointer in unknown space, because a function may return a pointer to some other stack frame (for example one received as an argument). (#GH187080) -- Fixed bad logic in `ExprEngine::evalBind` so that both the `check::Bind` and the pointer-escape checkers get a chance to run when binding to an `Unknown` or `Undefined` memory location. (#GH196313) -- Fixed an unjustified early return in `ExprEngine::processCallExit` that could drop execution paths produced by `removeDead`. (#GH205656) -- Fixed `CallEvent::getReturnValueUnderConstruction` to use the `LocationContext` and `CFGElementRef` stored in the `CallEvent` instead of the currently analyzed ones. (#GH187020) - Fixed the `getcwd` summary in the `unix.StdCLibraryFunctions` checker. (#GH175136) #### Improvements From 0c564b441a4beb56853e2468569651aef51734ba Mon Sep 17 00:00:00 2001 From: Balazs Benics <[email protected]> Date: Mon, 13 Jul 2026 11:05:27 +0100 Subject: [PATCH 4/7] Mention the ImmutableSet/Map improvements --- clang/docs/ReleaseNotes.md | 1 + 1 file changed, 1 insertion(+) diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md index e9649ea8af2ad..d640cf862191e 100644 --- a/clang/docs/ReleaseNotes.md +++ b/clang/docs/ReleaseNotes.md @@ -1208,6 +1208,7 @@ latest release, please see the [Clang Web Site](https://clang.llvm.org) or the #### Improvements +- Significantly sped up core data structures like ImmutableSet/Map, leading to up to 5.2x faster analysis in edge cases. (#GH205552, #GH207596, #GH208907) - The unmaintained and crash-prone Z3 constraint-manager backend selected via `-analyzer-constraints=z3` was renamed to `-analyzer-constraints=unsupported-z3` to make its unsupported status explicit. (#GH205370) - The conservative call-invalidation logic now invalidates the object of an opaque constructor call regardless of whether an argument refers to it. (#GH170887) - Improved the resolution of constant values from initializers in RegionStore, including preserving default bindings for aggregate-like cases, generalized field-initializer resolution for arbitrary nesting, and normalized sub-array indices. (#GH199271) From e3d23fe8e0222688b596128e12971869f19a909b Mon Sep 17 00:00:00 2001 From: Balazs Benics <[email protected]> Date: Mon, 13 Jul 2026 11:24:40 +0100 Subject: [PATCH 5/7] Add new changes since last week --- clang/docs/ReleaseNotes.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md index d640cf862191e..58ab2b32c83a9 100644 --- a/clang/docs/ReleaseNotes.md +++ b/clang/docs/ReleaseNotes.md @@ -1205,6 +1205,9 @@ latest release, please see the [Clang Web Site](https://clang.llvm.org) or the - Fixed the default binding of union aggregates being overwritten when initializing array elements with union members. (#GH178694) - The analyzer no longer rules out the equality of a pointer to the stack and a symbolic pointer in unknown space, because a function may return a pointer to some other stack frame (for example one received as an argument). (#GH187080) - Fixed the `getcwd` summary in the `unix.StdCLibraryFunctions` checker. (#GH175136) +- Fixed invalid HTML nesting for popups at end of line. (#GH46089) +- Fixed a false-positive in the `unix.BlockInCriticalSection` checker that reported double locking when using `std::lock_guard`/`std::unique_lock`/`std::scoped_lock`. (#GH208729) +- Fixed a false-negative in the `unix.Malloc` checker due to a typo in the expected arguments of `if_nameindex`. It will now properly match its single expected argument. (#GH207726) #### Improvements @@ -1228,6 +1231,7 @@ latest release, please see the [Clang Web Site](https://clang.llvm.org) or the - Added a new `check::LifetimeEnd` callback that fires for each `CFGLifetimeEnds` element, which is useful for detecting dangling pointers. (#GH201123) - The `unix.StdCLibraryFunctions` standard-library summaries were optimized for binary size. (#GH202662) - Fixed the alignment of entries printed by `clang -cc1 -analyzer-print-analyzer-options` / `-analyzer-help`. (#GH190570) +- Improved the models of `strchr`/`strrchr`/`memchr`/`strstr`/`strpbrk`/`strchrnul`, enabling `core.StackAddressEscape` to catch dangling pointers returned by these functions. (#GH203260) #### Moved checkers From d1c3a50c6c247c03fd83dbe12689411cf67bd7c7 Mon Sep 17 00:00:00 2001 From: Balazs Benics <[email protected]> Date: Mon, 13 Jul 2026 11:24:51 +0100 Subject: [PATCH 6/7] Fix a wrong GH link --- clang/docs/ReleaseNotes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md index 58ab2b32c83a9..c5ac80b4405ba 100644 --- a/clang/docs/ReleaseNotes.md +++ b/clang/docs/ReleaseNotes.md @@ -1215,7 +1215,7 @@ latest release, please see the [Clang Web Site](https://clang.llvm.org) or the - The unmaintained and crash-prone Z3 constraint-manager backend selected via `-analyzer-constraints=z3` was renamed to `-analyzer-constraints=unsupported-z3` to make its unsupported status explicit. (#GH205370) - The conservative call-invalidation logic now invalidates the object of an opaque constructor call regardless of whether an argument refers to it. (#GH170887) - Improved the resolution of constant values from initializers in RegionStore, including preserving default bindings for aggregate-like cases, generalized field-initializer resolution for arbitrary nesting, and normalized sub-array indices. (#GH199271) -- The analyzer now conservatively evaluates `std::sort`, `std::stable_sort`, and `std::inplace_merge` to prevent false positives caused by complex STL internals that cannot be modeled adequately by the engine. (#GH177804) +- The analyzer now conservatively evaluates `std::sort`, `std::stable_sort`, and `std::inplace_merge` to prevent false positives caused by complex STL internals that cannot be modeled adequately by the engine. (#GH178910) - The `optin.cplusplus.VirtualCall` checker no longer reports virtual method calls during construction/destruction when the call site is in a system header. (#GH184178) - Reduced false positives of the `unix.MallocSizeof` checker for layout-compatible types, such as `malloc(sizeof(std::atomic<int32_t>))` assigned to an `int32_t *`. (#GH200253) - The `optin.core.FixedAddressDereference` checker no longer reports dereferences of a fixed address when the pointee is `volatile`. (#GH181644) From 6d27e810765d660f3fbde46d5c0eaa836ba2365f Mon Sep 17 00:00:00 2001 From: Balazs Benics <[email protected]> Date: Mon, 13 Jul 2026 13:16:44 +0100 Subject: [PATCH 7/7] Update release notes after a few PRs --- clang/docs/ReleaseNotes.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md index c5ac80b4405ba..96b106225d03d 100644 --- a/clang/docs/ReleaseNotes.md +++ b/clang/docs/ReleaseNotes.md @@ -1208,6 +1208,7 @@ latest release, please see the [Clang Web Site](https://clang.llvm.org) or the - Fixed invalid HTML nesting for popups at end of line. (#GH46089) - Fixed a false-positive in the `unix.BlockInCriticalSection` checker that reported double locking when using `std::lock_guard`/`std::unique_lock`/`std::scoped_lock`. (#GH208729) - Fixed a false-negative in the `unix.Malloc` checker due to a typo in the expected arguments of `if_nameindex`. It will now properly match its single expected argument. (#GH207726) +- Fixed a crash in the Z3-solver-based (unsupported) constraint manager involving unary/binary operators. (#GH205037) #### Improvements @@ -1232,6 +1233,7 @@ latest release, please see the [Clang Web Site](https://clang.llvm.org) or the - The `unix.StdCLibraryFunctions` standard-library summaries were optimized for binary size. (#GH202662) - Fixed the alignment of entries printed by `clang -cc1 -analyzer-print-analyzer-options` / `-analyzer-help`. (#GH190570) - Improved the models of `strchr`/`strrchr`/`memchr`/`strstr`/`strpbrk`/`strchrnul`, enabling `core.StackAddressEscape` to catch dangling pointers returned by these functions. (#GH203260) +- Improved the modeling of symbolic ranges in the engine when calculating the largest and smallest possible values for range sets involving the `+`, `-`, and `*` binary operators. (#GH173113) #### Moved checkers _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
