Skip to content

Commit 3e3ccdc

Browse files
committed
Multi-origin changes
1 parent 3036de7 commit 3e3ccdc

File tree

14 files changed

+1117
-640
lines changed

14 files changed

+1117
-640
lines changed

clang/include/clang/Analysis/Analyses/LifetimeSafety/Facts.h

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -155,18 +155,19 @@ class OriginEscapesFact : public Fact {
155155

156156
class UseFact : public Fact {
157157
const Expr *UseExpr;
158-
OriginID OID;
158+
// The origins of the expression being used.
159+
llvm::SmallVector<OriginID, 1> OIDs;
159160
// True if this use is a write operation (e.g., left-hand side of assignment).
160161
// Write operations are exempted from use-after-free checks.
161162
bool IsWritten = false;
162163

163164
public:
164165
static bool classof(const Fact *F) { return F->getKind() == Kind::Use; }
165166

166-
UseFact(const Expr *UseExpr, OriginManager &OM)
167-
: Fact(Kind::Use), UseExpr(UseExpr), OID(OM.get(*UseExpr)) {}
167+
UseFact(const Expr *UseExpr, llvm::ArrayRef<OriginID> OIDs)
168+
: Fact(Kind::Use), UseExpr(UseExpr), OIDs(OIDs.begin(), OIDs.end()) {}
168169

169-
OriginID getUsedOrigin() const { return OID; }
170+
llvm::ArrayRef<OriginID> getUsedOrigins() const { return OIDs; }
170171
const Expr *getUseExpr() const { return UseExpr; }
171172
void markAsWritten() { IsWritten = true; }
172173
bool isWritten() const { return IsWritten; }
@@ -194,8 +195,8 @@ class TestPointFact : public Fact {
194195

195196
class FactManager {
196197
public:
197-
void init(const CFG &Cfg) {
198-
assert(BlockToFacts.empty() && "FactManager already initialized");
198+
FactManager(const AnalysisDeclContext &AC, const CFG &Cfg)
199+
: OriginMgr(AC.getASTContext()) {
199200
BlockToFacts.resize(Cfg.getNumBlockIDs());
200201
}
201202

clang/include/clang/Analysis/Analyses/LifetimeSafety/FactsGenerator.h

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,11 @@ class FactsGenerator : public ConstStmtVisitor<FactsGenerator> {
5050
void VisitMaterializeTemporaryExpr(const MaterializeTemporaryExpr *MTE);
5151

5252
private:
53+
OriginTree *getTree(const ValueDecl &D);
54+
OriginTree *getTree(const Expr &E);
55+
56+
void flow(OriginTree *Dst, OriginTree *Src, bool Kill);
57+
5358
void handleLifetimeEnds(const CFGLifetimeEnds &LifetimeEnds);
5459

5560
void handleGSLPointerConstruction(const CXXConstructExpr *CCE);
@@ -64,26 +69,18 @@ class FactsGenerator : public ConstStmtVisitor<FactsGenerator> {
6469

6570
template <typename Destination, typename Source>
6671
void flowOrigin(const Destination &D, const Source &S) {
67-
OriginID DestOID = FactMgr.getOriginMgr().getOrCreate(D);
68-
OriginID SrcOID = FactMgr.getOriginMgr().get(S);
69-
CurrentBlockFacts.push_back(FactMgr.createFact<OriginFlowFact>(
70-
DestOID, SrcOID, /*KillDest=*/false));
72+
flow(getTree(D), getTree(S), /*Kill=*/false);
7173
}
7274

7375
template <typename Destination, typename Source>
7476
void killAndFlowOrigin(const Destination &D, const Source &S) {
75-
OriginID DestOID = FactMgr.getOriginMgr().getOrCreate(D);
76-
OriginID SrcOID = FactMgr.getOriginMgr().get(S);
77-
CurrentBlockFacts.push_back(
78-
FactMgr.createFact<OriginFlowFact>(DestOID, SrcOID, /*KillDest=*/true));
77+
flow(getTree(D), getTree(S), /*Kill=*/true);
7978
}
8079

8180
/// Checks if the expression is a `void("__lifetime_test_point_...")` cast.
8281
/// If so, creates a `TestPointFact` and returns true.
8382
bool handleTestPoint(const CXXFunctionalCastExpr *FCE);
8483

85-
void handleAssignment(const Expr *LHSExpr, const Expr *RHSExpr);
86-
8784
// A DeclRefExpr will be treated as a use of the referenced decl. It will be
8885
// checked for use-after-free unless it is later marked as being written to
8986
// (e.g. on the left-hand side of an assignment).

clang/include/clang/Analysis/Analyses/LifetimeSafety/LifetimeSafety.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,13 +76,13 @@ class LifetimeSafetyAnalysis {
7676
return *LoanPropagation;
7777
}
7878
LiveOriginsAnalysis &getLiveOrigins() const { return *LiveOrigins; }
79-
FactManager &getFactManager() { return FactMgr; }
79+
FactManager &getFactManager() { return *FactMgr; }
8080

8181
private:
8282
AnalysisDeclContext &AC;
8383
LifetimeSafetyReporter *Reporter;
8484
LifetimeFactory Factory;
85-
FactManager FactMgr;
85+
std::unique_ptr<FactManager> FactMgr;
8686
std::unique_ptr<LiveOriginsAnalysis> LiveOrigins;
8787
std::unique_ptr<LoanPropagationAnalysis> LoanPropagation;
8888
};

clang/include/clang/Analysis/Analyses/LifetimeSafety/Origins.h

Lines changed: 104 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616

1717
#include "clang/AST/Decl.h"
1818
#include "clang/AST/Expr.h"
19+
#include "clang/AST/TypeBase.h"
1920
#include "clang/Analysis/Analyses/LifetimeSafety/Utils.h"
2021

2122
namespace clang::lifetimes::internal {
@@ -28,21 +29,30 @@ inline llvm::raw_ostream &operator<<(llvm::raw_ostream &OS, OriginID ID) {
2829

2930
/// An Origin is a symbolic identifier that represents the set of possible
3031
/// loans a pointer-like object could hold at any given time.
31-
/// TODO: Enhance the origin model to handle complex types, pointer
32-
/// indirection and reborrowing. The plan is to move from a single origin per
33-
/// variable/expression to a "list of origins" governed by the Type.
34-
/// For example, the type 'int**' would have two origins.
35-
/// See discussion:
36-
/// https://github.com/llvm/llvm-project/pull/142313/commits/0cd187b01e61b200d92ca0b640789c1586075142#r2137644238
32+
///
33+
/// Each Origin corresponds to a single level of indirection. For complex types
34+
/// with multiple levels of indirection (e.g., `int**`), multiple Origins are
35+
/// organized into an OriginTree structure (see below).
3736
struct Origin {
3837
OriginID ID;
3938
/// A pointer to the AST node that this origin represents. This union
4039
/// distinguishes between origins from declarations (variables or parameters)
4140
/// and origins from expressions.
4241
llvm::PointerUnion<const clang::ValueDecl *, const clang::Expr *> Ptr;
4342

44-
Origin(OriginID ID, const clang::ValueDecl *D) : ID(ID), Ptr(D) {}
45-
Origin(OriginID ID, const clang::Expr *E) : ID(ID), Ptr(E) {}
43+
/// The type at this indirection level.
44+
///
45+
/// For `int** pp`:
46+
/// Root origin: QT = `int**` (what pp points to)
47+
/// Pointee origin: QT = `int*` (what *pp points to)
48+
///
49+
/// Null for synthetic lvalue origins (e.g., outer origin of DeclRefExpr).
50+
QualType QT;
51+
52+
Origin(OriginID ID, const clang::ValueDecl *D, QualType QT)
53+
: ID(ID), Ptr(D), QT(QT) {}
54+
Origin(OriginID ID, const clang::Expr *E, QualType QT)
55+
: ID(ID), Ptr(E), QT(QT) {}
4656

4757
const clang::ValueDecl *getDecl() const {
4858
return Ptr.dyn_cast<const clang::ValueDecl *>();
@@ -52,41 +62,111 @@ struct Origin {
5262
}
5363
};
5464

65+
/// A tree of origins representing levels of indirection for pointer-like types.
66+
///
67+
/// Each node in the tree contains an OriginID representing a level of
68+
/// indirection. The tree structure captures the multi-level nature of
69+
/// pointer and reference types in the lifetime analysis.
70+
///
71+
/// Examples:
72+
/// - For `int& x`, the tree has depth 2:
73+
/// * Root: origin for the reference storage itself (the lvalue `x`)
74+
/// * Pointee: origin for what `x` refers to
75+
///
76+
/// - For `int* p`, the tree has depth 2:
77+
/// * Root: origin for the pointer variable `p`
78+
/// * Pointee: origin for what `p` points to
79+
///
80+
/// - For `View v` (where View is gsl::Pointer), the tree has depth 2:
81+
/// * Root: origin for the view object itself
82+
/// * Pointee: origin for what the view refers to
83+
///
84+
/// - For `int** pp`, the tree has depth 3:
85+
/// * Root: origin for `pp` itself
86+
/// * Pointee: origin for `*pp` (what `pp` points to)
87+
/// * Pointee->Pointee: origin for `**pp` (what `*pp` points to)
88+
///
89+
/// The tree structure enables the analysis to track how loans flow through
90+
/// different levels of indirection when assignments and dereferences occur.
91+
struct OriginTree {
92+
OriginID OID;
93+
OriginTree *Pointee = nullptr;
94+
95+
OriginTree(OriginID OID) : OID(OID) {}
96+
97+
size_t getDepth() const {
98+
size_t Depth = 1;
99+
const OriginTree *T = this;
100+
while (T->Pointee) {
101+
T = T->Pointee;
102+
Depth++;
103+
}
104+
return Depth;
105+
}
106+
};
107+
108+
bool hasOrigins(QualType QT);
109+
bool hasOrigins(const Expr *E);
110+
bool doesDeclHaveStorage(const ValueDecl *D);
111+
55112
/// Manages the creation, storage, and retrieval of origins for pointer-like
56113
/// variables and expressions.
57114
class OriginManager {
58115
public:
59-
OriginManager() = default;
60-
61-
Origin &addOrigin(OriginID ID, const clang::ValueDecl &D);
62-
Origin &addOrigin(OriginID ID, const clang::Expr &E);
63-
64-
// TODO: Mark this method as const once we remove the call to getOrCreate.
65-
OriginID get(const Expr &E);
66-
67-
OriginID get(const ValueDecl &D);
68-
69-
OriginID getOrCreate(const Expr &E);
116+
explicit OriginManager(ASTContext &AST) : AST(AST) {}
117+
118+
/// Gets or creates the OriginTree for a given ValueDecl.
119+
///
120+
/// Creates a tree structure mirroring the levels of indirection in the
121+
/// declaration's type (e.g., `int** p` creates depth 2).
122+
///
123+
/// \returns The OriginTree, or nullptr if the type is not pointer-like.
124+
OriginTree *getOrCreateTree(const ValueDecl *D);
125+
126+
/// Gets or creates the OriginTree for a given Expr.
127+
///
128+
/// Creates a tree based on the expression's type and value category:
129+
/// - Lvalues get an implicit reference level (modeling addressability)
130+
/// - Rvalues of non-pointer type return nullptr (no trackable origin)
131+
/// - DeclRefExpr may reuse the underlying declaration's tree
132+
///
133+
/// \returns The OriginTree, or nullptr for non-pointer rvalues.
134+
OriginTree *getOrCreateTree(const Expr *E, size_t Depth = 0);
70135

71136
const Origin &getOrigin(OriginID ID) const;
72137

73138
llvm::ArrayRef<Origin> getOrigins() const { return AllOrigins; }
74139

75-
OriginID getOrCreate(const ValueDecl &D);
76-
77140
unsigned getNumOrigins() const { return NextOriginID.Value; }
78141

79142
void dump(OriginID OID, llvm::raw_ostream &OS) const;
80143

81144
private:
82145
OriginID getNextOriginID() { return NextOriginID++; }
83146

147+
OriginTree *createNode(const ValueDecl *D, QualType QT) {
148+
OriginID NewID = getNextOriginID();
149+
AllOrigins.emplace_back(NewID, D, QT);
150+
return new (TreeAllocator.Allocate<OriginTree>()) OriginTree(NewID);
151+
}
152+
153+
OriginTree *createNode(const Expr *E, QualType QT) {
154+
OriginID NewID = getNextOriginID();
155+
AllOrigins.emplace_back(NewID, E, QT);
156+
return new (TreeAllocator.Allocate<OriginTree>()) OriginTree(NewID);
157+
}
158+
159+
template <typename T>
160+
OriginTree *buildTreeForType(QualType QT, const T *Node);
161+
162+
ASTContext &AST;
84163
OriginID NextOriginID{0};
85-
/// TODO(opt): Profile and evaluate the usefullness of small buffer
164+
/// TODO(opt): Profile and evaluate the usefulness of small buffer
86165
/// optimisation.
87166
llvm::SmallVector<Origin> AllOrigins;
88-
llvm::DenseMap<const clang::ValueDecl *, OriginID> DeclToOriginID;
89-
llvm::DenseMap<const clang::Expr *, OriginID> ExprToOriginID;
167+
llvm::BumpPtrAllocator TreeAllocator;
168+
llvm::DenseMap<const clang::ValueDecl *, OriginTree *> DeclToTree;
169+
llvm::DenseMap<const clang::Expr *, OriginTree *> ExprToTree;
90170
};
91171
} // namespace clang::lifetimes::internal
92172

clang/lib/Analysis/LifetimeSafety/Facts.cpp

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,14 @@ void ExpireFact::dump(llvm::raw_ostream &OS, const LoanManager &LM,
3535

3636
void OriginFlowFact::dump(llvm::raw_ostream &OS, const LoanManager &,
3737
const OriginManager &OM) const {
38-
OS << "OriginFlow (Dest: ";
38+
OS << "OriginFlow: \n";
39+
OS << "\tDest: ";
3940
OM.dump(getDestOriginID(), OS);
40-
OS << ", Src: ";
41+
OS << "\n";
42+
OS << "\tSrc: ";
4143
OM.dump(getSrcOriginID(), OS);
4244
OS << (getKillDest() ? "" : ", Merge");
43-
OS << ")\n";
45+
OS << "\n";
4446
}
4547

4648
void OriginEscapesFact::dump(llvm::raw_ostream &OS, const LoanManager &,
@@ -53,7 +55,12 @@ void OriginEscapesFact::dump(llvm::raw_ostream &OS, const LoanManager &,
5355
void UseFact::dump(llvm::raw_ostream &OS, const LoanManager &,
5456
const OriginManager &OM) const {
5557
OS << "Use (";
56-
OM.dump(getUsedOrigin(), OS);
58+
size_t NumUsedOrigins = getUsedOrigins().size();
59+
for (size_t I = 0; I < NumUsedOrigins; ++I) {
60+
OM.dump(getUsedOrigins()[I], OS);
61+
if (I < NumUsedOrigins - 1)
62+
OS << ", ";
63+
}
5764
OS << ", " << (isWritten() ? "Write" : "Read") << ")\n";
5865
}
5966

0 commit comments

Comments
 (0)