================
@@ -858,6 +858,13 @@ void FactsGenerator::handleExitBlock() {
FactMgr.createFact<GlobalEscapeFact>(O.ID, VD));
}
}
+
+ // A borrow captured via [[clang::lifetime_capture_by(this)]] flows into the
+ // never-expiring `this` origin, so it is not otherwise live at the captured
+ // local's expiry. Keep `this` live at exit so the dangle is caught.
+ if (auto ThisOrigins = FactMgr.getOriginMgr().getThisOrigins())
+ EscapesInCurrentBlock.push_back(FactMgr.createFact<ThisEscapeFact>(
+ (*ThisOrigins)->getOuterOriginID(), AC.getDecl()->getEndLoc()));
----------------
Xazax-hun wrote:
In static analysis escape usually means something along the lines that we can
no longer reason about something. It escaped our analysis. Since we do function
local reasoning, any value that persists somewhere after the function returned
are escaped. We do not know what will happen to them but chances are good they
got persisted because they will be used later. So we assume if a value escaped,
it will be used somewhere outside of this function. Since the value of `this`
is observable after a method returns, it escaped our analysis and the caller
can potentially use any value that is reachable from `this`.
https://github.com/llvm/llvm-project/pull/204630
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
