Skip to content

Commit 5134452

Browse files
committed
Tree -> List
1 parent 39fcd2c commit 5134452

File tree

15 files changed

+1195
-660
lines changed

15 files changed

+1195
-660
lines changed

clang/include/clang/Analysis/Analyses/LifetimeSafety/Facts.h

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -155,18 +155,20 @@ class OriginEscapesFact : public Fact {
155155

156156
class UseFact : public Fact {
157157
const Expr *UseExpr;
158-
OriginID OID;
158+
// The origins of the expression being used.
159+
// SmallVector with size 1 since most expressions track a single origin level.
160+
llvm::SmallVector<OriginID, 1> OIDs;
159161
// True if this use is a write operation (e.g., left-hand side of assignment).
160162
// Write operations are exempted from use-after-free checks.
161163
bool IsWritten = false;
162164

163165
public:
164166
static bool classof(const Fact *F) { return F->getKind() == Kind::Use; }
165167

166-
UseFact(const Expr *UseExpr, OriginManager &OM)
167-
: Fact(Kind::Use), UseExpr(UseExpr), OID(OM.get(*UseExpr)) {}
168+
UseFact(const Expr *UseExpr, llvm::SmallVector<OriginID> OIDs)
169+
: Fact(Kind::Use), UseExpr(UseExpr), OIDs(std::move(OIDs)) {}
168170

169-
OriginID getUsedOrigin() const { return OID; }
171+
llvm::ArrayRef<OriginID> getUsedOrigins() const { return OIDs; }
170172
const Expr *getUseExpr() const { return UseExpr; }
171173
void markAsWritten() { IsWritten = true; }
172174
bool isWritten() const { return IsWritten; }
@@ -194,8 +196,8 @@ class TestPointFact : public Fact {
194196

195197
class FactManager {
196198
public:
197-
void init(const CFG &Cfg) {
198-
assert(BlockToFacts.empty() && "FactManager already initialized");
199+
FactManager(const AnalysisDeclContext &AC, const CFG &Cfg)
200+
: OriginMgr(AC.getASTContext()) {
199201
BlockToFacts.resize(Cfg.getNumBlockIDs());
200202
}
201203

clang/include/clang/Analysis/Analyses/LifetimeSafety/FactsGenerator.h

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,11 @@ class FactsGenerator : public ConstStmtVisitor<FactsGenerator> {
5050
void VisitMaterializeTemporaryExpr(const MaterializeTemporaryExpr *MTE);
5151

5252
private:
53+
OriginList *getOriginsList(const ValueDecl &D);
54+
OriginList *getOriginsList(const Expr &E);
55+
56+
void flow(OriginList *Dst, OriginList *Src, bool Kill);
57+
5358
void handleLifetimeEnds(const CFGLifetimeEnds &LifetimeEnds);
5459

5560
void handleGSLPointerConstruction(const CXXConstructExpr *CCE);
@@ -64,26 +69,18 @@ class FactsGenerator : public ConstStmtVisitor<FactsGenerator> {
6469

6570
template <typename Destination, typename Source>
6671
void flowOrigin(const Destination &D, const Source &S) {
67-
OriginID DestOID = FactMgr.getOriginMgr().getOrCreate(D);
68-
OriginID SrcOID = FactMgr.getOriginMgr().get(S);
69-
CurrentBlockFacts.push_back(FactMgr.createFact<OriginFlowFact>(
70-
DestOID, SrcOID, /*KillDest=*/false));
72+
flow(getOriginsList(D), getOriginsList(S), /*Kill=*/false);
7173
}
7274

7375
template <typename Destination, typename Source>
7476
void killAndFlowOrigin(const Destination &D, const Source &S) {
75-
OriginID DestOID = FactMgr.getOriginMgr().getOrCreate(D);
76-
OriginID SrcOID = FactMgr.getOriginMgr().get(S);
77-
CurrentBlockFacts.push_back(
78-
FactMgr.createFact<OriginFlowFact>(DestOID, SrcOID, /*KillDest=*/true));
77+
flow(getOriginsList(D), getOriginsList(S), /*Kill=*/true);
7978
}
8079

8180
/// Checks if the expression is a `void("__lifetime_test_point_...")` cast.
8281
/// If so, creates a `TestPointFact` and returns true.
8382
bool handleTestPoint(const CXXFunctionalCastExpr *FCE);
8483

85-
void handleAssignment(const Expr *LHSExpr, const Expr *RHSExpr);
86-
8784
// A DeclRefExpr will be treated as a use of the referenced decl. It will be
8885
// checked for use-after-free unless it is later marked as being written to
8986
// (e.g. on the left-hand side of an assignment).

clang/include/clang/Analysis/Analyses/LifetimeSafety/LifetimeSafety.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,13 +80,13 @@ class LifetimeSafetyAnalysis {
8080
return *LoanPropagation;
8181
}
8282
LiveOriginsAnalysis &getLiveOrigins() const { return *LiveOrigins; }
83-
FactManager &getFactManager() { return FactMgr; }
83+
FactManager &getFactManager() { return *FactMgr; }
8484

8585
private:
8686
AnalysisDeclContext &AC;
8787
LifetimeSafetyReporter *Reporter;
8888
LifetimeFactory Factory;
89-
FactManager FactMgr;
89+
std::unique_ptr<FactManager> FactMgr;
9090
std::unique_ptr<LiveOriginsAnalysis> LiveOrigins;
9191
std::unique_ptr<LoanPropagationAnalysis> LoanPropagation;
9292
};

clang/include/clang/Analysis/Analyses/LifetimeSafety/Origins.h

Lines changed: 104 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616

1717
#include "clang/AST/Decl.h"
1818
#include "clang/AST/Expr.h"
19+
#include "clang/AST/TypeBase.h"
1920
#include "clang/Analysis/Analyses/LifetimeSafety/Utils.h"
2021

2122
namespace clang::lifetimes::internal {
@@ -28,21 +29,30 @@ inline llvm::raw_ostream &operator<<(llvm::raw_ostream &OS, OriginID ID) {
2829

2930
/// An Origin is a symbolic identifier that represents the set of possible
3031
/// loans a pointer-like object could hold at any given time.
31-
/// TODO: Enhance the origin model to handle complex types, pointer
32-
/// indirection and reborrowing. The plan is to move from a single origin per
33-
/// variable/expression to a "list of origins" governed by the Type.
34-
/// For example, the type 'int**' would have two origins.
35-
/// See discussion:
36-
/// https://github.com/llvm/llvm-project/pull/142313/commits/0cd187b01e61b200d92ca0b640789c1586075142#r2137644238
32+
///
33+
/// Each Origin corresponds to a single level of indirection. For complex types
34+
/// with multiple levels of indirection (e.g., `int**`), multiple Origins are
35+
/// organized into an OriginList structure (see below).
3736
struct Origin {
3837
OriginID ID;
3938
/// A pointer to the AST node that this origin represents. This union
4039
/// distinguishes between origins from declarations (variables or parameters)
4140
/// and origins from expressions.
4241
llvm::PointerUnion<const clang::ValueDecl *, const clang::Expr *> Ptr;
4342

44-
Origin(OriginID ID, const clang::ValueDecl *D) : ID(ID), Ptr(D) {}
45-
Origin(OriginID ID, const clang::Expr *E) : ID(ID), Ptr(E) {}
43+
/// The type at this indirection level.
44+
///
45+
/// For `int** pp`:
46+
/// Root origin: QT = `int**` (what pp points to)
47+
/// Pointee origin: QT = `int*` (what *pp points to)
48+
///
49+
/// Null for synthetic lvalue origins (e.g., outer origin of DeclRefExpr).
50+
const Type *Ty;
51+
52+
Origin(OriginID ID, const clang::ValueDecl *D, const Type *QT)
53+
: ID(ID), Ptr(D), Ty(QT) {}
54+
Origin(OriginID ID, const clang::Expr *E, const Type *QT)
55+
: ID(ID), Ptr(E), Ty(QT) {}
4656

4757
const clang::ValueDecl *getDecl() const {
4858
return Ptr.dyn_cast<const clang::ValueDecl *>();
@@ -52,41 +62,111 @@ struct Origin {
5262
}
5363
};
5464

55-
/// Manages the creation, storage, and retrieval of origins for pointer-like
56-
/// variables and expressions.
57-
class OriginManager {
65+
/// A list of origins representing levels of indirection for pointer-like types.
66+
///
67+
/// Each node in the list contains an OriginID representing a level of
68+
/// indirection. The list structure captures the multi-level nature of
69+
/// pointer and reference types in the lifetime analysis.
70+
///
71+
/// Examples:
72+
/// - For `int& x`, the list has size 2:
73+
/// * Outer: origin for the reference storage itself (the lvalue `x`)
74+
/// * Inner: origin for what `x` refers to
75+
///
76+
/// - For `int* p`, the list has size 2:
77+
/// * Outer: origin for the pointer variable `p`
78+
/// * Inner: origin for what `p` points to
79+
///
80+
/// - For `View v` (where View is gsl::Pointer), the list has size 2:
81+
/// * Outer: origin for the view object itself
82+
/// * Inner: origin for what the view refers to
83+
///
84+
/// - For `int** pp`, the list has size 3:
85+
/// * Outer: origin for `pp` itself
86+
/// * Inner: origin for `*pp` (what `pp` points to)
87+
/// * Inner->Inner: origin for `**pp` (what `*pp` points to)
88+
///
89+
/// The list structure enables the analysis to track how loans flow through
90+
/// different levels of indirection when assignments and dereferences occur.
91+
class OriginList {
5892
public:
59-
OriginManager() = default;
60-
61-
Origin &addOrigin(OriginID ID, const clang::ValueDecl &D);
62-
Origin &addOrigin(OriginID ID, const clang::Expr &E);
93+
OriginList(OriginID OID) : OuterOID(OID) {}
94+
95+
OriginList *peelOuterOrigin() { return InnerList; }
96+
OriginID getOuterOriginID() const { return OuterOID; }
97+
98+
void setInnerOriginList(OriginList *Inner) { InnerList = Inner; }
99+
100+
// Used for assertion checks only (to ensure origin lists have matching
101+
// lengths).
102+
size_t getLength() const {
103+
size_t Length = 1;
104+
const OriginList *T = this;
105+
while (T->InnerList) {
106+
T = T->InnerList;
107+
Length++;
108+
}
109+
return Length;
110+
}
63111

64-
// TODO: Mark this method as const once we remove the call to getOrCreate.
65-
OriginID get(const Expr &E);
112+
private:
113+
OriginID OuterOID;
114+
OriginList *InnerList = nullptr;
115+
};
66116

67-
OriginID get(const ValueDecl &D);
117+
bool hasOrigins(QualType QT);
118+
bool hasOrigins(const Expr *E);
119+
bool doesDeclHaveStorage(const ValueDecl *D);
68120

69-
OriginID getOrCreate(const Expr &E);
121+
/// Manages the creation, storage, and retrieval of origins for pointer-like
122+
/// variables and expressions.
123+
class OriginManager {
124+
public:
125+
explicit OriginManager(ASTContext &AST) : AST(AST) {}
126+
127+
/// Gets or creates the OriginList for a given ValueDecl.
128+
///
129+
/// Creates a list structure mirroring the levels of indirection in the
130+
/// declaration's type (e.g., `int** p` creates list of size 2).
131+
///
132+
/// \returns The OriginList, or nullptr if the type is not pointer-like.
133+
OriginList *getOrCreateList(const ValueDecl *D);
134+
135+
/// Gets or creates the OriginList for a given Expr.
136+
///
137+
/// Creates a list based on the expression's type and value category:
138+
/// - Lvalues get an implicit reference level (modeling addressability)
139+
/// - Rvalues of non-pointer type return nullptr (no trackable origin)
140+
/// - DeclRefExpr may reuse the underlying declaration's list
141+
///
142+
/// \returns The OriginList, or nullptr for non-pointer rvalues.
143+
OriginList *getOrCreateList(const Expr *E);
70144

71145
const Origin &getOrigin(OriginID ID) const;
72146

73147
llvm::ArrayRef<Origin> getOrigins() const { return AllOrigins; }
74148

75-
OriginID getOrCreate(const ValueDecl &D);
76-
77149
unsigned getNumOrigins() const { return NextOriginID.Value; }
78150

79151
void dump(OriginID OID, llvm::raw_ostream &OS) const;
80152

81153
private:
82154
OriginID getNextOriginID() { return NextOriginID++; }
83155

156+
OriginList *createNode(const ValueDecl *D, QualType QT);
157+
OriginList *createNode(const Expr *E, QualType QT);
158+
159+
template <typename T>
160+
OriginList *buildListForType(QualType QT, const T *Node);
161+
162+
ASTContext &AST;
84163
OriginID NextOriginID{0};
85-
/// TODO(opt): Profile and evaluate the usefullness of small buffer
164+
/// TODO(opt): Profile and evaluate the usefulness of small buffer
86165
/// optimisation.
87166
llvm::SmallVector<Origin> AllOrigins;
88-
llvm::DenseMap<const clang::ValueDecl *, OriginID> DeclToOriginID;
89-
llvm::DenseMap<const clang::Expr *, OriginID> ExprToOriginID;
167+
llvm::BumpPtrAllocator ListAllocator;
168+
llvm::DenseMap<const clang::ValueDecl *, OriginList *> DeclToList;
169+
llvm::DenseMap<const clang::Expr *, OriginList *> ExprToList;
90170
};
91171
} // namespace clang::lifetimes::internal
92172

clang/lib/Analysis/LifetimeSafety/Facts.cpp

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,14 @@ void ExpireFact::dump(llvm::raw_ostream &OS, const LoanManager &LM,
3535

3636
void OriginFlowFact::dump(llvm::raw_ostream &OS, const LoanManager &,
3737
const OriginManager &OM) const {
38-
OS << "OriginFlow (Dest: ";
38+
OS << "OriginFlow: \n";
39+
OS << "\tDest: ";
3940
OM.dump(getDestOriginID(), OS);
40-
OS << ", Src: ";
41+
OS << "\n";
42+
OS << "\tSrc: ";
4143
OM.dump(getSrcOriginID(), OS);
4244
OS << (getKillDest() ? "" : ", Merge");
43-
OS << ")\n";
45+
OS << "\n";
4446
}
4547

4648
void OriginEscapesFact::dump(llvm::raw_ostream &OS, const LoanManager &,
@@ -53,7 +55,12 @@ void OriginEscapesFact::dump(llvm::raw_ostream &OS, const LoanManager &,
5355
void UseFact::dump(llvm::raw_ostream &OS, const LoanManager &,
5456
const OriginManager &OM) const {
5557
OS << "Use (";
56-
OM.dump(getUsedOrigin(), OS);
58+
size_t NumUsedOrigins = getUsedOrigins().size();
59+
for (size_t I = 0; I < NumUsedOrigins; ++I) {
60+
OM.dump(getUsedOrigins()[I], OS);
61+
if (I < NumUsedOrigins - 1)
62+
OS << ", ";
63+
}
5764
OS << ", " << (isWritten() ? "Write" : "Read") << ")\n";
5865
}
5966

0 commit comments

Comments
 (0)