https://github.com/arhwx updated https://github.com/llvm/llvm-project/pull/212154
>From ef4a173b0d6a9c13a7fe99a490e34b09e4e2aa83 Mon Sep 17 00:00:00 2001 From: arhwx <[email protected]> Date: Sun, 26 Jul 2026 18:08:56 -0400 Subject: [PATCH 1/3] [LifetimeSafety] Fix crash on explicit object member functions handleMovedArgsInCall assumed the object argument is absent from FunctionDecl::parameters() and applied a one parameter offset. An explicit object parameter is a regular ParmVarDecl, so the offset misaligned arguments with parameters and the assert dereferenced a null OriginList. Fixes #204210 --- .../Analysis/LifetimeSafety/FactsGenerator.cpp | 3 ++- .../explicit-object-param-no-crash.cpp | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp diff --git a/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp b/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp index 466bb2185c6d8..e858e0b54688b 100644 --- a/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp +++ b/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp @@ -911,7 +911,8 @@ void FactsGenerator::handleMovedArgsInCall(const FunctionDecl *FD, ArrayRef<const Expr *> Args) { unsigned IsInstance = 0; if (const auto *MD = dyn_cast<CXXMethodDecl>(FD); - MD && MD->isInstance() && !isa<CXXConstructorDecl>(FD)) { + MD && !isa<CXXConstructorDecl>(FD) && + MD->isImplicitObjectMemberFunction()) { IsInstance = 1; // std::unique_ptr::release() transfers ownership. // Treat it as a move to prevent false-positive warnings when the unique_ptr diff --git a/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp new file mode 100644 index 0000000000000..56615437ab1ae --- /dev/null +++ b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp @@ -0,0 +1,18 @@ +// RUN: %clang_cc1 %s -std=c++23 -verify -fsyntax-only -Wlifetime-safety + +// expected-no-diagnostics + +// Explicit object member functions must not be treated as having an implicit +// object argument. +struct Foo { + template <typename T> + int get(this Foo &&self, T) { + return self.field; + } + + int field; +}; + +void call() { + Foo().get(0); +} >From 549b8ce565201f3839f43de668de0a3982251c87 Mon Sep 17 00:00:00 2001 From: arhwx <[email protected]> Date: Mon, 27 Jul 2026 01:15:03 -0400 Subject: [PATCH 2/3] [LifetimeSafety] Add explicit object parameter test coverage --- .../explicit-object-param-no-crash.cpp | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp index 56615437ab1ae..159c342f15527 100644 --- a/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp +++ b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp @@ -13,6 +13,38 @@ struct Foo { int field; }; +struct Base {}; +struct Derived : Base { + int base(this Base &&, int); +}; + +template <typename T> +struct Crtp { + template <typename Self> + int deduced(this Self &&self, T) { + return self.field; + } +}; + +struct Widget : Crtp<int> { + int field; +}; + +struct NoMove { + NoMove() = default; + NoMove(NoMove &&) = delete; + NoMove(const NoMove &) = delete; + + int get(this NoMove &&self, int) { + return self.field; + } + + int field; +}; + void call() { Foo().get(0); + Derived().base(0); + Widget().deduced(0); + NoMove().get(0); } >From 3cb27ed309f13003df61507d29d8095bb1f2012c Mon Sep 17 00:00:00 2001 From: arhwx <[email protected]> Date: Mon, 27 Jul 2026 03:50:43 -0400 Subject: [PATCH 3/3] [LifetimeSafety] Avoid treating explicit object parameter as moved --- .../LifetimeSafety/FactsGenerator.cpp | 2 ++ .../explicit-object-param-no-crash.cpp | 27 ++++++++++++++++++- 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp b/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp index e858e0b54688b..4b045731e92a8 100644 --- a/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp +++ b/clang/lib/Analysis/LifetimeSafety/FactsGenerator.cpp @@ -930,6 +930,8 @@ void FactsGenerator::handleMovedArgsInCall(const FunctionDecl *FD, for (unsigned I = IsInstance; I < Args.size() && I < FD->getNumParams() + IsInstance; ++I) { const ParmVarDecl *PVD = FD->getParamDecl(I - IsInstance); + if (PVD->isExplicitObjectParameter()) + continue; if (!PVD->getType()->isRValueReferenceType()) continue; // Skip lifetime annotated r-value reference parameters. Lifetime annotation diff --git a/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp index 159c342f15527..56c170e188af7 100644 --- a/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp +++ b/clang/test/Sema/LifetimeSafety/explicit-object-param-no-crash.cpp @@ -1,4 +1,4 @@ -// RUN: %clang_cc1 %s -std=c++23 -verify -fsyntax-only -Wlifetime-safety +// RUN: %clang_cc1 %s -std=c++23 -verify -fsyntax-only -Wlifetime-safety -Wlifetime-safety-lifetimebound-violation // expected-no-diagnostics @@ -42,9 +42,34 @@ struct NoMove { int field; }; +template <typename T> +struct SharedPtr { + SharedPtr() = default; + SharedPtr(SharedPtr &&o) : p(o.p) { o.p = nullptr; } + SharedPtr(const SharedPtr &) = default; + + int get(this SharedPtr &&self, int) { + return self.p->field; + } + + T *p = nullptr; +}; + void call() { Foo().get(0); Derived().base(0); Widget().deduced(0); NoMove().get(0); + SharedPtr<NoMove>().get(0); +} + +struct Holder { + int field; + const int *borrow() [[clang::lifetimebound]] { return &field; } + void consume(this Holder &&self) {} +}; + +const int *object_arg_is_not_moved(Holder &&h [[clang::lifetimebound]]) { + static_cast<Holder &&>(h).consume(); + return h.borrow(); } _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
