https://github.com/aeft updated https://github.com/llvm/llvm-project/pull/181113
>From 443bcc74263343aa2105d14b851f128356171621 Mon Sep 17 00:00:00 2001 From: Alex Wang <[email protected]> Date: Thu, 12 Feb 2026 02:13:05 -0800 Subject: [PATCH 1/7] [clang][CFG] Sequence RHS before LHS for overloaded assignment operators in CFG to match C++17 rules --- clang/lib/Analysis/CFG.cpp | 18 ++++++++-- .../Analysis/cfg-assignment-eval-order.cpp | 29 ++++++++++++++++ .../test/Analysis/missing-bind-temporary.cpp | 34 +++++++++---------- 3 files changed, 62 insertions(+), 19 deletions(-) create mode 100644 clang/test/Analysis/cfg-assignment-eval-order.cpp diff --git a/clang/lib/Analysis/CFG.cpp b/clang/lib/Analysis/CFG.cpp index 8001a67a5e158..1d2085ca62791 100644 --- a/clang/lib/Analysis/CFG.cpp +++ b/clang/lib/Analysis/CFG.cpp @@ -656,6 +656,7 @@ class CFGBuilder { bool ExternallyDestructed = false); CFGBlock *VisitStmt(Stmt *S, AddStmtChoice asc); CFGBlock *VisitChildren(Stmt *S); + CFGBlock *VisitCallExprChildren(CallExpr *C); CFGBlock *VisitNoRecurse(Expr *E, AddStmtChoice asc); CFGBlock *VisitOMPExecutableDirective(OMPExecutableDirective *D, AddStmtChoice asc); @@ -2542,6 +2543,19 @@ CFGBlock *CFGBuilder::VisitChildren(Stmt *S) { return B; } +CFGBlock *CFGBuilder::VisitCallExprChildren(CallExpr *C) { + // C++17 onwards require that the right operand is sequenced before the left + // operand. + if (auto *OCE = dyn_cast<CXXOperatorCallExpr>(C)) { + if (OCE->isAssignmentOp()) { + Visit(OCE->getArg(0)); + Visit(OCE->getArg(1)); + return Visit(OCE->getCallee()); + } + } + return VisitChildren(C); +} + CFGBlock *CFGBuilder::VisitInitListExpr(InitListExpr *ILE, AddStmtChoice asc) { if (asc.alwaysAdd(*this, ILE)) { autoCreateBlock(); @@ -2879,7 +2893,7 @@ CFGBlock *CFGBuilder::VisitCallExpr(CallExpr *C, AddStmtChoice asc) { autoCreateBlock(); appendCall(Block, C); - return VisitChildren(C); + return VisitCallExprChildren(C); } if (Block) { @@ -2903,7 +2917,7 @@ CFGBlock *CFGBuilder::VisitCallExpr(CallExpr *C, AddStmtChoice asc) { addSuccessor(Block, &cfg->getExit()); } - return VisitChildren(C); + return VisitCallExprChildren(C); } CFGBlock *CFGBuilder::VisitChooseExpr(ChooseExpr *C, diff --git a/clang/test/Analysis/cfg-assignment-eval-order.cpp b/clang/test/Analysis/cfg-assignment-eval-order.cpp new file mode 100644 index 0000000000000..a792b7f7b33dd --- /dev/null +++ b/clang/test/Analysis/cfg-assignment-eval-order.cpp @@ -0,0 +1,29 @@ +// RUN: %clang_analyze_cc1 -analyzer-checker=debug.DumpCFG -std=c++17 %s > %t 2>&1 +// RUN: FileCheck --input-file=%t %s + +// CHECK-LABEL: void test(Map &m, int a, int b) +// CHECK: 1: operator= +// CHECK-NEXT: 2: [B1.1] (ImplicitCastExpr, FunctionToPointerDecay, Map &(*)(const Map &)) +// CHECK-NEXT: 3: operator[] +// CHECK-NEXT: 4: [B1.3] (ImplicitCastExpr, FunctionToPointerDecay, Map &(*)(int)) +// CHECK-NEXT: 5: m +// CHECK-NEXT: 6: a +// CHECK-NEXT: 7: [B1.6] (ImplicitCastExpr, LValueToRValue, int) +// CHECK-NEXT: 8: [B1.5][[B1.7]] (OperatorCall) +// CHECK-NEXT: 9: [B1.8] (ImplicitCastExpr, NoOp, const Map) +// CHECK-NEXT: 10: operator[] +// CHECK-NEXT: 11: [B1.10] (ImplicitCastExpr, FunctionToPointerDecay, Map &(*)(int)) +// CHECK-NEXT: 12: m +// CHECK-NEXT: 13: b +// CHECK-NEXT: 14: [B1.13] (ImplicitCastExpr, LValueToRValue, int) +// CHECK-NEXT: 15: [B1.12][[B1.14]] (OperatorCall) +// CHECK-NEXT: 16: [B1.15] = [B1.9] (OperatorCall) + +struct Map { + Map &operator[](int); + Map &operator=(const Map &); +}; + +void test(Map &m, int a, int b) { + m[b] = m[a]; +} \ No newline at end of file diff --git a/clang/test/Analysis/missing-bind-temporary.cpp b/clang/test/Analysis/missing-bind-temporary.cpp index 3d1af469dc01c..2ce733b0986b0 100644 --- a/clang/test/Analysis/missing-bind-temporary.cpp +++ b/clang/test/Analysis/missing-bind-temporary.cpp @@ -23,11 +23,11 @@ class B { // CHECK-NEXT: 2: B i; // CHECK-NEXT: 3: operator= // CHECK-NEXT: 4: [B1.3] (ImplicitCastExpr, FunctionToPointerDecay, B &(*)(B &&) noexcept) -// CHECK-NEXT: 5: i -// CHECK-NEXT: 6: {} (CXXConstructExpr, [B1.7], [B1.8], B) -// CHECK-NEXT: 7: [B1.6] (BindTemporary) -// CHECK-NEXT: 8: [B1.7] -// CHECK-NEXT: 9: [B1.5] = [B1.8] (OperatorCall) +// CHECK-NEXT: 5: {} (CXXConstructExpr, [B1.6], [B1.7], B) +// CHECK-NEXT: 6: [B1.5] (BindTemporary) +// CHECK-NEXT: 7: [B1.6] +// CHECK-NEXT: 8: i +// CHECK-NEXT: 9: [B1.8] = [B1.7] (OperatorCall) // CHECK-NEXT: 10: ~B() (Temporary object destructor) // CHECK-NEXT: 11: [B1.2].~B() (Implicit destructor) void foo(int) { @@ -60,13 +60,13 @@ class B { // CHECK-NEXT: 2: B i; // CHECK-NEXT: 3: operator= // CHECK-NEXT: 4: [B1.3] (ImplicitCastExpr, FunctionToPointerDecay, B &(*)(B &&) noexcept) -// CHECK-NEXT: 5: i -// CHECK-NEXT: 6: {} (CXXConstructExpr, [B1.7], [B1.8], B) -// CHECK-NEXT: 7: [B1.6] (BindTemporary) -// CHECK-NEXT: 8: [B1.7] -// CHECK-NEXT: 9: [B1.5] = [B1.8] (OperatorCall) -// CHECK-NEXT: 10: ~B() (Temporary object destructor) -// CHECK-NEXT: 11: [B1.2].~B() (Implicit destructor) +// CHECK-NEXT: 5: {} (CXXConstructExpr, [B1.6], [B1.7], B) +// CHECK-NEXT: 6: [B1.5] (BindTemporary) +// CHECK-NEXT: 7: [B1.6] +// CHECK-NEXT: 8: i +// CHECK-NEXT: 9: [B1.8] = [B1.7] (OperatorCall) +// CHECK-NEXT: 10: ~B() (Temporary object destructor) +// CHECK-NEXT: 11: [B1.2].~B() (Implicit destructor) template <typename T> void foo(T) { B i; i = {}; @@ -101,12 +101,12 @@ class B { // CHECK-NEXT: 2: B i; // CHECK-NEXT: 3: operator= // CHECK-NEXT: 4: [B1.3] (ImplicitCastExpr, FunctionToPointerDecay, B &(*)(B &&) noexcept) -// CHECK-NEXT: 5: i +// CHECK-NEXT: 5: {} // CHECK-NEXT: 6: {} -// CHECK-NEXT: 7: {} -// CHECK-NEXT: 8: [B1.7] (BindTemporary) -// CHECK-NEXT: 9: [B1.8] -// CHECK-NEXT: 10: [B1.5] = [B1.9] (OperatorCall) +// CHECK-NEXT: 7: [B1.6] (BindTemporary) +// CHECK-NEXT: 8: [B1.7] +// CHECK-NEXT: 9: i +// CHECK-NEXT: 10: [B1.9] = [B1.8] (OperatorCall) // CHECK-NEXT: 11: ~B() (Temporary object destructor) // CHECK-NEXT: 12: [B1.2].~B() (Implicit destructor) template <typename T> void foo(T) { >From 3cfe7c092591636571d8658170234f33ce5dd1e6 Mon Sep 17 00:00:00 2001 From: Alex Wang <[email protected]> Date: Thu, 12 Feb 2026 02:44:12 -0800 Subject: [PATCH 2/7] fixup! [clang][CFG] Sequence RHS before LHS for overloaded assignment operators in CFG to match C++17 rules --- clang/test/Analysis/cfg-assignment-eval-order.cpp | 4 ++-- clang/test/Analysis/scopes-cfg-output.cpp | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/clang/test/Analysis/cfg-assignment-eval-order.cpp b/clang/test/Analysis/cfg-assignment-eval-order.cpp index a792b7f7b33dd..5315eb3fcda3a 100644 --- a/clang/test/Analysis/cfg-assignment-eval-order.cpp +++ b/clang/test/Analysis/cfg-assignment-eval-order.cpp @@ -9,14 +9,14 @@ // CHECK-NEXT: 5: m // CHECK-NEXT: 6: a // CHECK-NEXT: 7: [B1.6] (ImplicitCastExpr, LValueToRValue, int) -// CHECK-NEXT: 8: [B1.5][[B1.7]] (OperatorCall) +// CHECK-NEXT: 8: [B1.5]{{\[\[}}B1.7]] (OperatorCall) // CHECK-NEXT: 9: [B1.8] (ImplicitCastExpr, NoOp, const Map) // CHECK-NEXT: 10: operator[] // CHECK-NEXT: 11: [B1.10] (ImplicitCastExpr, FunctionToPointerDecay, Map &(*)(int)) // CHECK-NEXT: 12: m // CHECK-NEXT: 13: b // CHECK-NEXT: 14: [B1.13] (ImplicitCastExpr, LValueToRValue, int) -// CHECK-NEXT: 15: [B1.12][[B1.14]] (OperatorCall) +// CHECK-NEXT: 15: [B1.12]{{\[\[}}B1.14]] (OperatorCall) // CHECK-NEXT: 16: [B1.15] = [B1.9] (OperatorCall) struct Map { diff --git a/clang/test/Analysis/scopes-cfg-output.cpp b/clang/test/Analysis/scopes-cfg-output.cpp index 6ed6f3638f75b..ac8ff1179a994 100644 --- a/clang/test/Analysis/scopes-cfg-output.cpp +++ b/clang/test/Analysis/scopes-cfg-output.cpp @@ -907,10 +907,10 @@ void test_for_compound_and_break() { // CHECK-NEXT: 5: auto &i // CHECK-NEXT: 6: operator= // CHECK-NEXT: 7: [B4.6] (ImplicitCastExpr, FunctionToPointerDecay, A &(*)(const A &) -// CHECK-NEXT: 8: i -// CHECK-NEXT: 9: b -// CHECK-NEXT: 10: [B4.9] (ImplicitCastExpr, NoOp, const A) -// CHECK-NEXT: 11: [B4.8] = [B4.10] (OperatorCall) +// CHECK-NEXT: 8: b +// CHECK-NEXT: 9: [B4.8] (ImplicitCastExpr, NoOp, const A) +// CHECK-NEXT: 10: i +// CHECK-NEXT: 11: [B4.10] = [B4.9] (OperatorCall) // CHECK-NEXT: 12: CFGScopeEnd(i) // CHECK-NEXT: Preds (1): B2 // CHECK-NEXT: Succs (1): B3 >From 946f29dcd2d41353d506e74aa28ef0cee4c7f8c3 Mon Sep 17 00:00:00 2001 From: Alex Wang <[email protected]> Date: Thu, 12 Feb 2026 10:14:26 -0800 Subject: [PATCH 3/7] fixup! [clang][CFG] Sequence RHS before LHS for overloaded assignment operators in CFG to match C++17 rules --- clang/lib/Analysis/CFG.cpp | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/clang/lib/Analysis/CFG.cpp b/clang/lib/Analysis/CFG.cpp index 1d2085ca62791..3827b0c341664 100644 --- a/clang/lib/Analysis/CFG.cpp +++ b/clang/lib/Analysis/CFG.cpp @@ -2544,14 +2544,14 @@ CFGBlock *CFGBuilder::VisitChildren(Stmt *S) { } CFGBlock *CFGBuilder::VisitCallExprChildren(CallExpr *C) { - // C++17 onwards require that the right operand is sequenced before the left - // operand. - if (auto *OCE = dyn_cast<CXXOperatorCallExpr>(C)) { - if (OCE->isAssignmentOp()) { - Visit(OCE->getArg(0)); - Visit(OCE->getArg(1)); - return Visit(OCE->getCallee()); - } + // For overloaded assignment operators, visit arguments in reverse order (LHS + // then RHS) so that RHS is sequenced before LHS in the CFG, matching C++17 + // sequencing rules. + if (auto *OCE = dyn_cast<CXXOperatorCallExpr>(C); + OCE && OCE->isAssignmentOp()) { + Visit(OCE->getArg(0)); + Visit(OCE->getArg(1)); + return Visit(OCE->getCallee()); } return VisitChildren(C); } >From ecaf008c35e2cfe2e98bd9ad2c3559b98a550f2d Mon Sep 17 00:00:00 2001 From: Alex Wang <[email protected]> Date: Thu, 12 Feb 2026 14:59:37 -0800 Subject: [PATCH 4/7] fixup! [clang][CFG] Sequence RHS before LHS for overloaded assignment operators in CFG to match C++17 rules --- clang/lib/Analysis/CFG.cpp | 12 +++++++ .../Analysis/cfg-assignment-eval-order.cpp | 36 ++++++++++++++++--- 2 files changed, 43 insertions(+), 5 deletions(-) diff --git a/clang/lib/Analysis/CFG.cpp b/clang/lib/Analysis/CFG.cpp index 3827b0c341664..db415400da6cf 100644 --- a/clang/lib/Analysis/CFG.cpp +++ b/clang/lib/Analysis/CFG.cpp @@ -5109,6 +5109,18 @@ CFGBlock *CFGBuilder::VisitForTemporaryDtors(Stmt *E, bool ExternallyDestructed, ExternallyDestructed, Context); + case Stmt::CXXOperatorCallExprClass: { + auto *OCE = cast<CXXOperatorCallExpr>(E); + if (OCE->isAssignmentOp()) { + CFGBlock *RHSBlock = + VisitForTemporaryDtors(OCE->getArg(1), false, Context); + CFGBlock *LHSBlock = + VisitForTemporaryDtors(OCE->getArg(0), false, Context); + return LHSBlock ? LHSBlock : RHSBlock; + } + return VisitChildrenForTemporaryDtors(E, false, Context); + } + case Stmt::CXXBindTemporaryExprClass: return VisitCXXBindTemporaryExprForTemporaryDtors( cast<CXXBindTemporaryExpr>(E), ExternallyDestructed, Context); diff --git a/clang/test/Analysis/cfg-assignment-eval-order.cpp b/clang/test/Analysis/cfg-assignment-eval-order.cpp index 5315eb3fcda3a..46950aa06f95a 100644 --- a/clang/test/Analysis/cfg-assignment-eval-order.cpp +++ b/clang/test/Analysis/cfg-assignment-eval-order.cpp @@ -1,7 +1,7 @@ // RUN: %clang_analyze_cc1 -analyzer-checker=debug.DumpCFG -std=c++17 %s > %t 2>&1 // RUN: FileCheck --input-file=%t %s -// CHECK-LABEL: void test(Map &m, int a, int b) +// CHECK-LABEL: void test_eval_order(Map &m, int a, int b) // CHECK: 1: operator= // CHECK-NEXT: 2: [B1.1] (ImplicitCastExpr, FunctionToPointerDecay, Map &(*)(const Map &)) // CHECK-NEXT: 3: operator[] @@ -20,10 +20,36 @@ // CHECK-NEXT: 16: [B1.15] = [B1.9] (OperatorCall) struct Map { - Map &operator[](int); - Map &operator=(const Map &); + Map &operator[](int); + Map &operator=(const Map &); }; -void test(Map &m, int a, int b) { - m[b] = m[a]; +void test_eval_order(Map &m, int a, int b) { + m[b] = m[a]; +} + +struct A { + A(); + ~A(); + A &operator=(const A &); +}; + +struct B { + B(); + ~B(); +}; + +struct C { + C(); + ~C(); +}; + +A &getLHS(const B &); +A &getRHS(const C &); + +// CHECK-LABEL: void test_temp_dtor_order() +// CHECK: ~B() (Temporary object destructor) +// CHECK-NEXT: ~C() (Temporary object destructor) +void test_temp_dtor_order() { + getLHS(B()) = getRHS(C()); } \ No newline at end of file >From 0178896ee22fa5d6af2922338e9df51437c05dd7 Mon Sep 17 00:00:00 2001 From: Alex Wang <[email protected]> Date: Thu, 12 Feb 2026 15:07:29 -0800 Subject: [PATCH 5/7] fixup! [clang][CFG] Sequence RHS before LHS for overloaded assignment operators in CFG to match C++17 rules --- clang/test/Analysis/cfg-assignment-eval-order.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clang/test/Analysis/cfg-assignment-eval-order.cpp b/clang/test/Analysis/cfg-assignment-eval-order.cpp index 46950aa06f95a..8acf2684aa682 100644 --- a/clang/test/Analysis/cfg-assignment-eval-order.cpp +++ b/clang/test/Analysis/cfg-assignment-eval-order.cpp @@ -52,4 +52,4 @@ A &getRHS(const C &); // CHECK-NEXT: ~C() (Temporary object destructor) void test_temp_dtor_order() { getLHS(B()) = getRHS(C()); -} \ No newline at end of file +} >From d116c92863edb18c48bd1e53b9eba6c39665fd56 Mon Sep 17 00:00:00 2001 From: Alex Wang <[email protected]> Date: Fri, 13 Feb 2026 08:54:33 -0800 Subject: [PATCH 6/7] fixup! [clang][CFG] Sequence RHS before LHS for overloaded assignment operators in CFG to match C++17 rules --- clang/lib/Analysis/CFG.cpp | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/clang/lib/Analysis/CFG.cpp b/clang/lib/Analysis/CFG.cpp index db415400da6cf..48d22e6d5300c 100644 --- a/clang/lib/Analysis/CFG.cpp +++ b/clang/lib/Analysis/CFG.cpp @@ -732,6 +732,9 @@ class CFGBuilder { CFGBlock *VisitBinaryOperatorForTemporaryDtors(BinaryOperator *E, bool ExternallyDestructed, TempDtorContext &Context); + CFGBlock * + VisitCXXOperatorCallExprClassForTemporaryDtors(CXXOperatorCallExpr *E, + TempDtorContext &Context); CFGBlock *VisitCXXBindTemporaryExprForTemporaryDtors( CXXBindTemporaryExpr *E, bool ExternallyDestructed, TempDtorContext &Context); CFGBlock *VisitConditionalOperatorForTemporaryDtors( @@ -5110,15 +5113,8 @@ CFGBlock *CFGBuilder::VisitForTemporaryDtors(Stmt *E, bool ExternallyDestructed, Context); case Stmt::CXXOperatorCallExprClass: { - auto *OCE = cast<CXXOperatorCallExpr>(E); - if (OCE->isAssignmentOp()) { - CFGBlock *RHSBlock = - VisitForTemporaryDtors(OCE->getArg(1), false, Context); - CFGBlock *LHSBlock = - VisitForTemporaryDtors(OCE->getArg(0), false, Context); - return LHSBlock ? LHSBlock : RHSBlock; - } - return VisitChildrenForTemporaryDtors(E, false, Context); + return VisitCXXOperatorCallExprClassForTemporaryDtors( + cast<CXXOperatorCallExpr>(E), Context); } case Stmt::CXXBindTemporaryExprClass: @@ -5261,6 +5257,18 @@ CFGBlock *CFGBuilder::VisitBinaryOperatorForTemporaryDtors( return VisitChildrenForTemporaryDtors(E, ExternallyDestructed, Context); } +CFGBlock *CFGBuilder::VisitCXXOperatorCallExprClassForTemporaryDtors( + CXXOperatorCallExpr *E, TempDtorContext &Context) { + if (E->isAssignmentOp()) { + // For assignment operators, the RHS expression is evaluated before the LHS + // expression, so prepend temporary destructors for the RHS first. + CFGBlock *RHSBlock = VisitForTemporaryDtors(E->getArg(1), false, Context); + CFGBlock *LHSBlock = VisitForTemporaryDtors(E->getArg(0), false, Context); + return LHSBlock ? LHSBlock : RHSBlock; + } + return VisitChildrenForTemporaryDtors(E, false, Context); +} + CFGBlock *CFGBuilder::VisitCXXBindTemporaryExprForTemporaryDtors( CXXBindTemporaryExpr *E, bool ExternallyDestructed, TempDtorContext &Context) { // First add destructors for temporaries in subexpression. >From 853919dec9aeb17ab265323c7b5a9b45d2b56557 Mon Sep 17 00:00:00 2001 From: Alex Wang <[email protected]> Date: Fri, 13 Feb 2026 09:09:58 -0800 Subject: [PATCH 7/7] fixup! [clang][CFG] Sequence RHS before LHS for overloaded assignment operators in CFG to match C++17 rules --- clang/lib/Analysis/CFG.cpp | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/clang/lib/Analysis/CFG.cpp b/clang/lib/Analysis/CFG.cpp index 48d22e6d5300c..18bd945089b75 100644 --- a/clang/lib/Analysis/CFG.cpp +++ b/clang/lib/Analysis/CFG.cpp @@ -732,9 +732,8 @@ class CFGBuilder { CFGBlock *VisitBinaryOperatorForTemporaryDtors(BinaryOperator *E, bool ExternallyDestructed, TempDtorContext &Context); - CFGBlock * - VisitCXXOperatorCallExprClassForTemporaryDtors(CXXOperatorCallExpr *E, - TempDtorContext &Context); + CFGBlock *VisitCXXOperatorCallExprForTemporaryDtors(CXXOperatorCallExpr *E, + TempDtorContext &Context); CFGBlock *VisitCXXBindTemporaryExprForTemporaryDtors( CXXBindTemporaryExpr *E, bool ExternallyDestructed, TempDtorContext &Context); CFGBlock *VisitConditionalOperatorForTemporaryDtors( @@ -5113,7 +5112,7 @@ CFGBlock *CFGBuilder::VisitForTemporaryDtors(Stmt *E, bool ExternallyDestructed, Context); case Stmt::CXXOperatorCallExprClass: { - return VisitCXXOperatorCallExprClassForTemporaryDtors( + return VisitCXXOperatorCallExprForTemporaryDtors( cast<CXXOperatorCallExpr>(E), Context); } @@ -5257,7 +5256,7 @@ CFGBlock *CFGBuilder::VisitBinaryOperatorForTemporaryDtors( return VisitChildrenForTemporaryDtors(E, ExternallyDestructed, Context); } -CFGBlock *CFGBuilder::VisitCXXOperatorCallExprClassForTemporaryDtors( +CFGBlock *CFGBuilder::VisitCXXOperatorCallExprForTemporaryDtors( CXXOperatorCallExpr *E, TempDtorContext &Context) { if (E->isAssignmentOp()) { // For assignment operators, the RHS expression is evaluated before the LHS _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
