Proposal on how to fix temporary dtors.

[klimek]

Summary

Alex McCarthy and me have put our heads together and come up with something
that works. This still needs some cleanup, and has broken tests (in the compiler
based "consumed" and "reachable code" analysis, as mentioned in other threads).

We would like to get some feedback on the architecture, and whether the changes
the the CFG make sense or are expected to make problems in corner cases.

The gist of the change is a change to how the CFG is created:
For every temporary, add a new block that runs the dtor, and a decision
block that has the CXXBindTemporaryExpr as terminator. That way, we have one
entry and exit block for each temporary cleanup, and as long as they're chained
in the right order, it'll work.
This is of course suboptimal in multiple ways:

• often we know when one destructor has executed that we must also execute the dtor of things that were generated previously; this makes the code and the CFG significantly more complex, though; the biggest downside seems to be that we potentially generate more states; not sure whether it's worth it
• often we do not actually need a new block (for example, if the temporary is created unconditionally); in that case, we could just run with a single block; again this would make the code more complex though, and I'm not sure it's worth the effort, unless we feel it's an important invariant on the CFG

[alexmc]

This is awesome, thanks Manuel! I can't wait to see this working :)

lib/Analysis/CFG.cpp

3675

Noob question: If we return FalseBlock below, do we need to visit CondBlock and TrueBlock even if they aren't returned? If we do need to visit them, is the order important? (Consider documenting this if this isn't super-obvious to someone with more clang experience than me :) )

lib/StaticAnalyzer/Core/ExprEngine.cpp

823

If includeTemporaryDtorsInCFG is not set, should we avoid this state modification?

1502

I think it's worth pulling this out into a new processTemporary helper method rather than adding it to processBranch: you're not reusing any of the logic in processBranch in the temporary dtor case.

This would involve adding a new HandleTemporary helper (or similar) that you'd call instead of HandleBranch, and that would call processTemporary

test/Analysis/temporaries.cpp

270

Don't we hit the NoReturnDtor when i == 0, which will prevent us from getting to i==2? This seems correct as-is.

333

Can you add a test that cleans up multiple temporaries in one condition? Maybe something like this (not sure if this compiles, we might need to add a check2(obj1, obj2) function):

class Dtor {
  ~Dtor() {}
};

void testMultipleTemporaries(bool value) {
  if (value) {
    // ~Dtor should run before ~NoReturnDtor() because construction order is guaranteed by comma operator
    if (!value || check((NoReturnDtor(), Dtor())) || value) {
      clang_analyzer_eval(true); // no warning, unreachable code
    }
  }
}

We could also make ~Dtor emit a warning which would only be triggered if Dtor was constructed with a certain value (e.g. check(Dtor(/*warning=*/true), NoReturnDtor()), then see if clang warns on that error that should never happen.

[klimek]

I also thought again about the problem of where to reset the bound state of the bind-temporary. The problem with the current solution is that it puts pretty strong requirements on how the CFG looks: we need to guarantee that for every constructed temporary, we will control-flow through the decision node that branches to the destructor call. At a first glance this may seem benign, but when I first thought about how to construct the CFG in that case, I believed the "optimum" to be one where we don't have any decision blocks when there is no control flow, and where we use the knowledge from where we are in a logical operator chain to unconditionally flow into the next destructor block.
For example:
A() || B() || C() || D()
When we are in the destructor block for D(), we *know* that we have to call the destructor of C(), thus we could unconditionally flow into C's destructor block without first flowing into its decision block (like the current code does).
I'm not sure it makes sense to do that (as it's more complex), but on the other hand I'm not sure it makes sense to preclude that with an implementation detail of how we track the temp ctor calls.

lib/Analysis/CFG.cpp

3675

Yes, the CFG blocks are hooked up even if they aren't returned. Actually, most of the hooking up goes via the Block and Succ members, and afaiu the returned value is mostly for convenience (and usually equals Block).
I'm not sure whether it makes sense to document that here, as it seems to be an invariant used throughout the CFG builder.

lib/StaticAnalyzer/Core/ExprEngine.cpp

823

That's a good question (for Jordan ;)

Another question is whether we still want to do the runCheckersForPre / runCheckersForPost enchilada.

1502

I agree. I mainly haven't done that, as somewhere in that chain there is an interface, and the method is abstract. I found only one use, so I assume somebody else implements that interface outside of the clang codebase. I'd like to hear what Jordan thinks on that issue, architecture-wise.

test/Analysis/temporaries.cpp

270

/me headdesks.

333

Added the test, and it works as expected. The problem is that I have no idea how to verify the construction order, as (according to comments I've seen in the code) the analyzer does not inline destructors (or at least temporary destructors).

[jordan_rose]

Wow, this actually came out very nicely. Good work, Manuel and Alex! I have a few comments on individual pieces, but overall I'm actually pretty confident in this. Have you run it over a large codebase yet?

often we know when one destructor has executed that we must also execute the dtor of things that were generated previously; this makes the code and the CFG significantly more complex, though; the biggest downside seems to be that we potentially generate more states; not sure whether it's worth it

often we do not actually need a new block (for example, if the temporary is created unconditionally); in that case, we could just run with a single block; again this would make the code more complex though, and I'm not sure it's worth the effort, unless we feel it's an important invariant on the CFG

We do still have this knowledge: it's whether the logical expression immediately dominating the last temporary processed is the same as the logical expression dominating the current temporary. That's not perfect (it doesn't handle the A() || B() || C() case), but it works in the simple cases, and handles unconditional creation as well. That said, if we do this we need to make sure the state is cleaned up correctly, as I mention below.

I'm not sure how changing either of these behaviors would generate more states. It seems like if you have different sets of destructors to run, the states are already necessarily different, and once you've reached the common set of destructors, you'd have the same opportunity to "cache out", i.e. match an existing node in the ExplodedGraph.

lib/StaticAnalyzer/Core/ExprEngine.cpp

54–56

This needs to include the current StackFrameContext as well (for recursive functions). You can get that from the current LocationContext.

823

We're trying to run pre/post-checks on all non-trivial statements, so yes, we should still do it. It's almost simple enough that we can hoist that out of the big switch, but I'm not sure that's correct for all statement kinds, and no one's looked into it.

(But now that we have C++11, I'm really inclined to hoist the thing into a closure, so that people don't have to write that "loop over the nodes generated by pre-checkers" loop themselves.)

As for the state modification, what I mainly care about is that we clean up the map. Since that doesn't happen when temporary destructors are off, yes, we should be checking here. (Note that this is also important if we stop generating conditions for every temporary destructor—we need to make sure that the state is clean by the end of the full-expression even if we skip some of the conditions.)

1502

These days the interface isn't serving us much real purpose. In theory CoreEngine is just traversing CFGs, and doesn't actually know very much about C ef al. It then hands the CFGElements off to its SubEngine, which actually processes them and tells the CoreEngine where to go next if there's a branch. ExprEngine is the particularly SubEngine that understands the AST / the language.

In practice there's a lot of linguistic knowledge coded into CoreEngine, just because there's a lot of linguistic knowledge in the CFG and in ProgramPoints these days. But either way, SubEngine is more of an interface than a real base class; I don't think Ted ever expected that we'd get subclassing more than one level deep. It's okay to split this up into helper methods.

test/Analysis/temporaries.cpp

333

We've turned that off until we can get it right, yes. We can turn that back on after this patch. I'm happy to make this a CFG-dump test for now.

[klimek]

Just a short update:
I ran this over our internal codebase, and found a roughly 0.5% change in
warnings. All the ones I investigated were new warnings of the form:
SomeType x = ...;
CHECK(some.Other() || something.Else()); // this is the macro that
evaluates to a no-return destructor iff the condition is false
...
doSomethingWith(x);

And now we would get a warning that 'x' is never used after being
initialized (I assume because it now always thinks the noreturn dtor is
run). I'll have to investigate some more.

Cheers,
/Manuel

[klimek]

Giving this a shot at pulling it together, and got a couple more questions...

lib/StaticAnalyzer/Core/ExprEngine.cpp

54–56

Can you elaborate on how I would put that into a datastructure? Just use a std::pair? (doesn't seem to work with ImmutableSet though)

Also, I seem unable to write a test that breaks because of this - any hints would be highly welcome.

[jordan_rose]

lib/StaticAnalyzer/Core/ExprEngine.cpp

54–56

We'd have to write a specialization of ImutProfileInfo for std::pair, but that's probably not a bad idea anyway. Please feel free to add one to ImmutableSet.h.

I would guess the test case would look something like this:

static bool test(bool isInner) {
  if (isInner || NoReturnDtor() || test(true)) {
    *(volatile int *)0 = 1; // should warn
  }
}
void topLevel() {
  test(false);
}

[klimek]

Worked in all the review comments.

The remaining failing test is blocked on:
http://reviews.llvm.org/D3638

[klimek]

Ok, I think I worked through the issues. Please take another look :D

lib/StaticAnalyzer/Core/ExprEngine.cpp

54–56

Sent patch for review & added test.

823

Done.

1502

Done.

[alexmc]

Looking really good, thanks Manuel! I'll leave the final acceptance for Jordan or someone else with more clang cred than I.

It looks like this fixes all of the FIXMEs in temporaries.cpp. Does this (hopefully) close out all known bugs with temporary dtor handling?

If so, wooooo :D

lib/StaticAnalyzer/Core/ExprEngine.cpp

1458–1459

Maybe add a message to this assert, like "Temporary destructor branches should be handled by processBindTemporary" or similar?

1488

Consider adding an assert message

lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

25 ↗

(On Diff #9765)

Consider documenting that we need the stack frame to handle recursion

190 ↗

(On Diff #9765)

is it worth adding a makeBindTemporaryContext(BTE, Pred) helper?

test/Analysis/temporaries.cpp

256

Can you add a ternary test that does generate expected warnings if the branching doesn't flow through a noreturn temporary dtor?

282

This looks identical to the namespaced struct defined on line 115: maybe extract that definition and remove this duplicate? (same with extern check)

290

Can we provide (inline) destructor bodies that do or don't warn to test this? (in a followup change)

[klimek]

Apply review comments.

lib/StaticAnalyzer/Core/ExprEngine.cpp

1458–1459

Done.

1488

Done.

lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

25 ↗

(On Diff #9765)

Done.

190 ↗

(On Diff #9765)

I don't think so.

test/Analysis/temporaries.cpp

256

Done. Aaaand it revealed a bug in the test. Nice catch!

282

Done.

290

Not yet, for that we need to switch on inlining of destructors.

[jordan_rose]

This generally looks good to me but I'd like to take one more look when I'm a bit more awake.

lib/StaticAnalyzer/Core/ExprEngine.cpp

1488

No need for llvm:: qualification here.

test/Analysis/temporaries.cpp

285

clang_analyzer_checkReached is probably better here. Old habits.

292–295

Yeah, I can't think of a way to fix this without inlining destructors. But that's the next thing to turn on!

[klimek]

Apply review comments.

[klimek]

The question where to put the FoldingSetTraits is still open (see http://reviews.llvm.org/D3895 and my reply on-list (I really need to sit down and implement better mail parsing for phab)).

lib/StaticAnalyzer/Core/ExprEngine.cpp

1488

Done.

test/Analysis/temporaries.cpp

285

Assuming you mean clang_analyzer_warnIfReached, done.

292–295

\o/

[klimek]

lib/Analysis/CFG.cpp

3678

I found a test case where conditional operators are still broken - working on a fix.

[klimek]

lib/Analysis/CFG.cpp

3628–3632

The actual problem was here:
Instead of unconditionally setting Succ to B, we have to do:
if (B) Succ = B;
(like below).

The problem is that this leads to new regressions (which are correct to regress :P).

Consider:
struct abort {

abort();
~abort() __attribute__((noreturn));

};

int f1(int x) {

switch (x)
default:
abort();

}

The problem is that with the new way the CFG is built for temp dtors, we'll get a "branch" at destruction time of the abort, that either doesn't return (good), or falls through to the normal path (oh noes).
Of course there is no path where the constructor wasn't executed, but a simple path based analysis doesn't know that (UnreachableCode.cpp).

The idea to fix that would be to only insert the decision blocks for temporary destructors if we are at a branching point, and otherwise just flow up like normal.

Other ideas / thoughts?

[klimek]

Fixes regression found when running over large internal codebase.

[klimek]

Comment and restructuring.

[klimek]

Ok, I think I've got a solution I'm somewhat happy with - this now implements one of the ideas I had in the very beginning - we only insert branches for temp dtors when they are needed, thus giving the simple analyses better information to rely on.

Please take another look...

[klimek]

Remove dead variable in non-debug mode.

[jordan_rose]

Maybe this is a bit paranoid, but I'm confused as to how we can only save one LastBindTemporary value instead of a stack. What's the purpose of that particular variable again? It seems to be used for more than just "if there are no temporaries, we don't need a cleanup block".

include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h

98–99

Now that I think about it, this name is wrong. It's really "HandleCleanupTemporaryBranch" or something. The CXXBindTemporaryExpr just tells you which temporary it is. (And similar for similarly-named functions.)

lib/Analysis/CFG.cpp

472–481

You might as well make this a proper doc comment.

lib/StaticAnalyzer/Core/ExprEngine.cpp

822–823

Calling this VisitCXXBindTemporaryExpr but then only having it actually be called when the flag is set seems like a bad idea if anyone ever needs to add behavior that should happen all the time. Either the check should be moved inside the method or it should be called something else.

test/Analysis/temporaries.cpp

349

This and the true ? ... below will get optimized out at CFG construction time. If that's correct, you should comment it; if you want to test path sensitivity, you should take a boolean input variable and then fully constrain it at the top of the function.

[alexmc]

I'm also confused by the use of LastBindTemporary, and why we only need to save the last one. A clearer name might help make this more understandable.

[klimek]

Apply review comments.

[klimek]

Regarding LastBindTemporary and stacks:
My initial thought was that if VisitForTemporaryDtors can hit nested full-statements, it'd be incorrect anyway, so I assumed it can't happen.

Now that I look into it, it seems like I might be able to create a case where that happens (using a lambda inside an expression which itself of course has new full statements). I'm not sure yet what the right fix is, or whether there is something I'm not aware of yet that catches that. I'll investigate some more.

Generally, the idea is that the "stack" state is kept in the VisitXXXForTemporaryDtors, specifically VisitForTemporaryDtorsBranch, which:

1. Calls VisitForTemporaryDtors(E):

a) If that does not hit another VisitForTemporaryDtorsBranch, we'll just aggregate all temporary dtors below in a single block; the guard for that block now will be the topmost temporary dtor in that block, which is the last one we visited (due insert-at-top for blocks), thus LastBindTemporary.
b) If that does hit another VisitForTemporaryDtorsBranch, that one will have run through (a), and then have added all temporary dtors that need to run before the inner branch point, if any; if we found any after the inner branch (that should be executed before the inner branch), it will be in LastBindTemporary, and we'll add the branch; otherwise, we know that there was no temporary added since the inner branch, so we do not need to add another branch

I should probably add an implementation comment with that exact content for VisitForTemporaryDtorsBranch, unless you guys come up with a better idea on how to implement the behavior.

include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h

98–99

Done.

lib/Analysis/CFG.cpp

472–481

Done.

lib/StaticAnalyzer/Core/ExprEngine.cpp

822–823

Good point. Moved the if inside.

test/Analysis/temporaries.cpp

349

This was a regression test that broke with the last version of the patch... Funnily enough it only broke with the conditional operator case, not the if() case. I'll run the CFG for both and verify what they do / did in the patch, and update this with my findings...

[klimek]

Add comments in the tests as to what we're trying to test.

[klimek]

Yeppers:
[]() { check(NoReturnDtor()); } != nullptr || check(Dtor());
is wrong (we think we always die, while nothing is being executed...)

Working on a fix...

[klimek]

Do not recursively visit lambdas for temporaries. This fixes the CFG, but does
not yet fix what we can reach.

[jordan_rose]

We should treat blocks the same as lambdas. How about GNU StmtExprs?

if (check(OtherDtor()) &&
    ({ int x = 1; NoReturnDtor(); x + 1})) { ... }

To be fair, I'm not even sure how those are supposed to behave.

I'm not sure how your last-bind trick really works. In this code:

First() && (Second() || Second()) && Third()

none of the temporaries can be aggregated, but I'm not sure how LastBoundTemporary accomplishes that, even given your explanation.

Can we start with the inefficient version that tests every temporary individually, and then consolidate afterwards?

test/Analysis/temporaries.cpp

362–364

If this is the right test, then the comment was all I really wanted. There is of course a difference between this and the if-statement — the destructor here is in the same full-expression as the condition.

[klimek]

Another try at solving the temporary destructor CFG.

[jordan_rose]

The passing of conditionality up and down the stack via references is weirding me out, but I think I've convinced myself it's correct. You still need a test case with a block expr, though.

I'll try to look this over one more time this afternoon or evening.

[jordan_rose]

Still missing a blocks example. :-)

lib/StaticAnalyzer/Core/ExprEngine.cpp

821–822

Why is Pred being passed here? The PreVisit set has the same information.

lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

521–527 ↗

(On Diff #9886)

Right, this is not correct. We need to iterate over the nodes in the pre-visit set and update all of them to generate Dst.

test/Analysis/temporaries.cpp

291–294

I don't think we assume that lambda-exprs are always non-null. We should.

[klimek]

Clean up lambdas; add test for statement expressions
Explode all nodes.

[klimek]

We still have the question about what to do with the FoldingSetNode for pairs in the other patch open.

lib/StaticAnalyzer/Core/ExprEngine.cpp

821–822

Done.

lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

521–527 ↗

(On Diff #9886)

/me headdesks. Done. I'm still not sure I understand all the necessary pieces to generate new nodes (and have no idea how to write tests that trigger the corner cases), so I'd appreciate another careful look (or some test ideas).

test/Analysis/temporaries.cpp

291–294

It's much worse. We currently ignore lambdas. I updated the test / added a comment.

[jordan_rose]

Let's bring it home!

Thanks again for working on this. I'm excited to have it in trunk and hopefully soon to turn it on by default.

lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

521–527 ↗

(On Diff #9886)

I'm not sure about the tests offhand, either—most likely it's currently untestable because we have no pre-statement checkers looking for CXXBindTemporaryExprs. The general principle, though, is that anything that has an ExplodedNodeSet out parameter has the potential to generate new nodes.

test/Analysis/temporaries.cpp

283–288

I know this was my example, but I'm concerned that testRecursiveFrames will be evaluated as top-level as well, in which case the inner case is trivially reached. Let's make sure it is trying the !isInner case around with a little hack:

if (isInner ||
    (clang_analyzer_warnIfReached(), false) || // expected-warning{{REACHABLE}}
    check(NoReturnDtor()) ||
    testRecursiveFrames(true)) {

[klimek]

Update recursive frames test for temp dtor tracking.

[klimek]

Sometimes it helps to try to write a nice commit message to find the flaws in one's thinking.

Consider:

void testSequencingOfConditionalTempDtors(bool b) {
   b || (check(Dtor()), check(NoReturnDtor()));
   clang_analyzer_warnIfReached();  // expected-warning{{REACHABLE}}
 }

I assume this should pass. We need to put the decision point before the full sequence of unconditional we find. I got confused by the 'normal-order/bottom-up' build (/me headdesks appropriately to punish himself).
I'll continue working on it.

[klimek]

Fix taking track of sequences of temporary destructors.

[jordan_rose]

At first I misread that as

void testSequencingOfConditionalTempDtors(bool b) {
   (b || check(Dtor())), check(NoReturnDtor());
   clang_analyzer_warnIfReached();  // expected-warning{{REACHABLE}}
 }

which should NOT be reachable. That's probably also a good test case. The comma operator is a real pain.

[klimek]

More tests...

[klimek]

In D3627#56, @jordan_rose wrote:

At first I misread that as

void testSequencingOfConditionalTempDtors(bool b) {
   (b || check(Dtor())), check(NoReturnDtor());
   clang_analyzer_warnIfReached();  // expected-warning{{REACHABLE}}
 }

which should NOT be reachable. That's probably also a good test case. The comma operator is a real pain.

Funnily enough I had 10 minutes where I debugged why the CFG was looking incorrect, only to detect that in my small repro I had actually forgotten the parens for the comma operator.

[klimek]

Jordan: do you want some time for a pass on the changed algorithm, or does it still LG?

Cheers,
/Manuel

[jordan_rose]

Can you describe the new algorithm in a comment somewhere? I really don't quite have the hang of it, and that makes me worried about maintaining it.

[klimek]

Simplify implementation and document it.

[jordan_rose]

I think the algorithm makes sense. I'm not sure it's different, though, than just passing up the first (or last) CXXBindTemporaryExpr visited for a given expression, which would look like this:

// For a logical expression...
VisitForTemporaryDtors(E->getLHS(), false, &LastBTE);
const CXXBindTemporaryExpr *InnerBTE = nullptr;
VisitForTemporaryDtors(E->getRHS(), false, &InnerBTE);
InsertTempDtorDecisionBlock(InnerBTE);

Are there any cases that wouldn't cover?

[klimek]

Fix cleaning up of the temporary state.

[jordan_rose]

Can you add an assertion at the end of a block that there are no outstanding temporary destructors in the current stack frame? That seems useful.

lib/Analysis/CFG.cpp

3583

Lost a newline here.

lib/StaticAnalyzer/Core/ExprEngine.cpp

681–686

I'm not sure you're supposed to reuse Dst with multiple builders. However, you know there's only one node in CleanDtorState, so you should be able to just skip the loop.

[klimek]

Thx! Landed as r214962.

lib/Analysis/CFG.cpp

3583

Done.

lib/StaticAnalyzer/Core/ExprEngine.cpp

681–686

Done.

include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h

private:
 
   void HandleBlockEdge(const BlockEdge &E, ExplodedNode *Pred);
   void HandleBlockEntrance(const BlockEntrance &E, ExplodedNode *Pred);
   void HandleBlockExit(const CFGBlock *B, ExplodedNode *Pred);
   void HandlePostStmt(const CFGBlock *B, unsigned StmtIdx, ExplodedNode *Pred);
 
   void HandleBranch(const Stmt *Cond, const Stmt *Term, const CFGBlock *B,
                     ExplodedNode *Pred);
+  void HandleCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
+                                    const CFGBlock *B, ExplodedNode *Pred);
 
   /// Handle conditional logic for running static initializers.
   void HandleStaticInit(const DeclStmt *DS, const CFGBlock *B,
                         ExplodedNode *Pred);
 
 private:
   CoreEngine(const CoreEngine &) LLVM_DELETED_FUNCTION;
   void operator=(const CoreEngine &) LLVM_DELETED_FUNCTION;

include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

public:
   ///  nodes by processing the 'effects' of a branch condition.
   void processBranch(const Stmt *Condition, const Stmt *Term, 
                      NodeBuilderContext& BuilderCtx,
                      ExplodedNode *Pred,
                      ExplodedNodeSet &Dst,
                      const CFGBlock *DstT,
                      const CFGBlock *DstF) override;
 
+  /// Called by CoreEngine.
+  /// Used to generate successor nodes for temporary destructors depending
+  /// on whether the corresponding constructor was visited.
+  void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
+                                     NodeBuilderContext &BldCtx,
+                                     ExplodedNode *Pred, ExplodedNodeSet &Dst,
+                                     const CFGBlock *DstT,
+                                     const CFGBlock *DstF) override;
+
   /// Called by CoreEngine.  Used to processing branching behavior
   /// at static initalizers.
   void processStaticInitializer(const DeclStmt *DS,
                                 NodeBuilderContext& BuilderCtx,
                                 ExplodedNode *Pred,
                                 ExplodedNodeSet &Dst,
                                 const CFGBlock *DstT,
                                 const CFGBlock *DstF) override;
public:
   /// VisitUnaryOperator - Transfer function logic for unary operators.
   void VisitUnaryOperator(const UnaryOperator* B, ExplodedNode *Pred, 
                           ExplodedNodeSet &Dst);
 
   /// Handle ++ and -- (both pre- and post-increment).
   void VisitIncrementDecrementOperator(const UnaryOperator* U,
                                        ExplodedNode *Pred,
                                        ExplodedNodeSet &Dst);
-  
+  void VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE,
+                                 ExplodedNodeSet &PreVisit,
+                                 ExplodedNodeSet &Dst);
+
   void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred,
                          ExplodedNodeSet &Dst);
 
   void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, 
                         ExplodedNodeSet & Dst);
 
   void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred,
                              ExplodedNodeSet &Dst);

include/clang/StaticAnalyzer/Core/PathSensitive/SubEngine.h

public:
   ///  nodes by processing the 'effects' of a branch condition.
   virtual void processBranch(const Stmt *Condition, const Stmt *Term,
                              NodeBuilderContext& BuilderCtx,
                              ExplodedNode *Pred,
                              ExplodedNodeSet &Dst,
                              const CFGBlock *DstT,
                              const CFGBlock *DstF) = 0;
 
+  /// Called by CoreEngine.
+  /// Used to generate successor nodes for temporary destructors depending
+  /// on whether the corresponding constructor was visited.
+  virtual void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
+                                             NodeBuilderContext &BldCtx,
+                                             ExplodedNode *Pred,
+                                             ExplodedNodeSet &Dst,
+                                             const CFGBlock *DstT,
+                                             const CFGBlock *DstF) = 0;
+
   /// Called by CoreEngine.  Used to processing branching behavior
   /// at static initalizers.
   virtual void processStaticInitializer(const DeclStmt *DS,
                                         NodeBuilderContext& BuilderCtx,
                                         ExplodedNode *Pred,
                                         ExplodedNodeSet &Dst,
                                         const CFGBlock *DstT,
                                         const CFGBlock *DstF) = 0;

lib/Analysis/CFG.cpp

class CFGBuilder {
 
   CFGBlock *Block;
   CFGBlock *Succ;
   JumpTarget ContinueJumpTarget;
   JumpTarget BreakJumpTarget;
   CFGBlock *SwitchTerminatedBlock;
   CFGBlock *DefaultCaseBlock;
   CFGBlock *TryTerminatedBlock;
-  
   // Current position in local scope.
   LocalScope::const_iterator ScopePos;
 
   // LabelMap records the mapping from Label expressions to their jump targets.
   typedef llvm::DenseMap<LabelDecl*, JumpTarget> LabelMapTy;
   LabelMapTy LabelMap;
 
   // A list of blocks that end with a "goto" that must be backpatched to their
private:
   CFGBlock *VisitUnaryOperator(UnaryOperator *U, AddStmtChoice asc);
   CFGBlock *VisitWhileStmt(WhileStmt *W);
 
   CFGBlock *Visit(Stmt *S, AddStmtChoice asc = AddStmtChoice::NotAlwaysAdd);
   CFGBlock *VisitStmt(Stmt *S, AddStmtChoice asc);
   CFGBlock *VisitChildren(Stmt *S);
   CFGBlock *VisitNoRecurse(Expr *E, AddStmtChoice asc);
 
+  /// When creating the CFG for temporary destructors, we want to mirror the
+  /// branch structure of the corresponding constructor calls.
+  /// Thus, while visiting a statement for temporary destructors, we keep a
+  /// context to keep track of the following information:
+  /// - whether a subexpression is executed unconditionally
+  /// - if a subexpression is executed conditionally, the first
+  ///   CXXBindTemporaryExpr we encounter in that subexpression (which
+  ///   corresponds to the last temporary destructor we have to call for this
+  ///   subexpression) and the CFG block at that point (which will become the
+  ///   successor block when inserting the decision point).
+  ///
+  /// That way, we can build the branch structure for temporary destructors as
+  /// follows:
+  /// 1. If a subexpression is executed unconditionally, we add the temporary
+  ///    destructor calls to the current block.
+  /// 2. If a subexpression is executed conditionally, when we encounter a
+  ///    CXXBindTemporaryExpr:
+  ///    a) If it is the first temporary destructor call in the subexpression,
+  ///       we remember the CXXBindTemporaryExpr and the current block in the
+  ///       TempDtorContext; we start a new block, and insert the temporary
+  ///       destructor call.
+  ///    b) Otherwise, add the temporary destructor call to the current block.
+  ///  3. When we finished visiting a conditionally executed subexpression,
+  ///     and we found at least one temporary constructor during the visitation
+  ///     (2.a has executed), we insert a decision block that uses the
+  ///     CXXBindTemporaryExpr as terminator, and branches to the current block
+  ///     if the CXXBindTemporaryExpr was marked executed, and otherwise
+  ///     branches to the stored successor.
+  struct TempDtorContext {
+    TempDtorContext(bool IsConditional)
+        : IsConditional(IsConditional),
+          Succ(nullptr),
+          TerminatorExpr(nullptr) {}
+
+    /// Returns whether we need to start a new branch for a temporary destructor
+    /// call. This is the case when the the temporary destructor is
+    /// conditionally executed, and it is the first one we encounter while
+    /// visiting a subexpression - other temporary destructors at the same level
+    /// will be added to the same block and are executed under the same
+    /// condition.
+    bool needsTempDtorBranch() const {
+      return IsConditional && !TerminatorExpr;
+    }
+
+    /// Remember the successor S of a temporary destructor decision branch for
+    /// the corresponding CXXBindTemporaryExpr E.
+    void setDecisionPoint(CFGBlock *S, CXXBindTemporaryExpr *E) {
+      Succ = S;
+      TerminatorExpr = E;
+    }
+
+    const bool IsConditional;
+    CFGBlock *Succ;
+    CXXBindTemporaryExpr *TerminatorExpr;
+  };
+
   // Visitors to walk an AST and generate destructors of temporaries in
   // full expression.
-  CFGBlock *VisitForTemporaryDtors(Stmt *E, bool BindToTemporary = false);
-  CFGBlock *VisitChildrenForTemporaryDtors(Stmt *E);
-  CFGBlock *VisitBinaryOperatorForTemporaryDtors(BinaryOperator *E);
-  CFGBlock *VisitCXXBindTemporaryExprForTemporaryDtors(CXXBindTemporaryExpr *E,
-      bool BindToTemporary);
-  CFGBlock *
-  VisitConditionalOperatorForTemporaryDtors(AbstractConditionalOperator *E,
-                                            bool BindToTemporary);
+  CFGBlock *VisitForTemporaryDtors(Stmt *E, bool BindToTemporary,
+                                   TempDtorContext &Context);
+  CFGBlock *VisitChildrenForTemporaryDtors(Stmt *E, TempDtorContext &Context);
+  CFGBlock *VisitBinaryOperatorForTemporaryDtors(BinaryOperator *E,
+                                                 TempDtorContext &Context);
+  CFGBlock *VisitCXXBindTemporaryExprForTemporaryDtors(
+      CXXBindTemporaryExpr *E, bool BindToTemporary, TempDtorContext &Context);
+  CFGBlock *VisitConditionalOperatorForTemporaryDtors(
+      AbstractConditionalOperator *E, bool BindToTemporary,
+      TempDtorContext &Context);
+  void InsertTempDtorDecisionBlock(const TempDtorContext &Context);
 
   // NYS == Not Yet Supported
   CFGBlock *NYS() {
     badCFG = true;
     return Block;
   }
 
   void autoCreateBlock() { if (!Block) Block = createBlock(); }
CFGBlock *CFGBuilder::addInitializer(CXXCtorInitializer *I) {
   Expr *Init = I->getInit();
   if (Init) {
     if (FieldDecl *FD = I->getAnyMember())
       IsReference = FD->getType()->isReferenceType();
     HasTemporaries = isa<ExprWithCleanups>(Init);
 
     if (BuildOpts.AddTemporaryDtors && HasTemporaries) {
       // Generate destructors for temporaries in initialization expression.
+      TempDtorContext Context(/*IsConditional=*/false);
       VisitForTemporaryDtors(cast<ExprWithCleanups>(Init)->getSubExpr(),
-          IsReference);
+                             IsReference, Context);
     }
   }
 
   autoCreateBlock();
   appendInitializer(Block, I);
 
   if (Init) {
     if (HasTemporaries) {
CFGBlock *CFGBuilder::VisitDeclSubExpr(DeclStmt *DS) {
   // after initialization finishes.
   Expr *Init = VD->getInit();
   if (Init) {
     IsReference = VD->getType()->isReferenceType();
     HasTemporaries = isa<ExprWithCleanups>(Init);
 
     if (BuildOpts.AddTemporaryDtors && HasTemporaries) {
       // Generate destructors for temporaries in initialization expression.
+      TempDtorContext Context(/*IsConditional=*/false);
       VisitForTemporaryDtors(cast<ExprWithCleanups>(Init)->getSubExpr(),
-          IsReference);
+                             IsReference, Context);
     }
   }
 
   autoCreateBlock();
   appendStmt(Block, DS);
   
   // Keep track of the last non-null block, as 'Block' can be nulled out
   // if the initializer expression is something like a 'while' in a
CFGBlock *CFGBuilder::VisitCXXForRangeStmt(CXXForRangeStmt *S) {
   return addStmt(S->getRangeStmt());
 }
 
 CFGBlock *CFGBuilder::VisitExprWithCleanups(ExprWithCleanups *E,
     AddStmtChoice asc) {
   if (BuildOpts.AddTemporaryDtors) {
     // If adding implicit destructors visit the full expression for adding
     // destructors of temporaries.
-    VisitForTemporaryDtors(E->getSubExpr());
+    TempDtorContext Context(/*IsConditional=*/false);
+    VisitForTemporaryDtors(E->getSubExpr(), false, Context);
 
     // Full expression has to be added as CFGStmt so it will be sequenced
     // before destructors of it's temporaries.
     asc = asc.withAlwaysAdd(true);
   }
   return Visit(E->getSubExpr(), asc);
 }
 
if (badCFG)
     return nullptr;
 
   Block = createBlock(false);
   Block->setTerminator(I);
   addSuccessor(Block, IBlock);
   return addStmt(I->getTarget());
 }
 
-CFGBlock *CFGBuilder::VisitForTemporaryDtors(Stmt *E, bool BindToTemporary) {
+CFGBlock *CFGBuilder::VisitForTemporaryDtors(Stmt *E, bool BindToTemporary,
+                                             TempDtorContext &Context) {
   assert(BuildOpts.AddImplicitDtors && BuildOpts.AddTemporaryDtors);
 
 tryAgain:
   if (!E) {
     badCFG = true;
     return nullptr;
   }
   switch (E->getStmtClass()) {
     default:
-      return VisitChildrenForTemporaryDtors(E);
+      return VisitChildrenForTemporaryDtors(E, Context);
 
     case Stmt::BinaryOperatorClass:
-      return VisitBinaryOperatorForTemporaryDtors(cast<BinaryOperator>(E));
+      return VisitBinaryOperatorForTemporaryDtors(cast<BinaryOperator>(E),
+                                                  Context);
 
     case Stmt::CXXBindTemporaryExprClass:
       return VisitCXXBindTemporaryExprForTemporaryDtors(
-          cast<CXXBindTemporaryExpr>(E), BindToTemporary);
+          cast<CXXBindTemporaryExpr>(E), BindToTemporary, Context);
 
     case Stmt::BinaryConditionalOperatorClass:
     case Stmt::ConditionalOperatorClass:
       return VisitConditionalOperatorForTemporaryDtors(
-          cast<AbstractConditionalOperator>(E), BindToTemporary);
+          cast<AbstractConditionalOperator>(E), BindToTemporary, Context);
 
     case Stmt::ImplicitCastExprClass:
       // For implicit cast we want BindToTemporary to be passed further.
       E = cast<CastExpr>(E)->getSubExpr();
       goto tryAgain;
 
     case Stmt::ParenExprClass:
       E = cast<ParenExpr>(E)->getSubExpr();
       goto tryAgain;
       
     case Stmt::MaterializeTemporaryExprClass:
       E = cast<MaterializeTemporaryExpr>(E)->GetTemporaryExpr();
       goto tryAgain;
   }
 }
 
-CFGBlock *CFGBuilder::VisitChildrenForTemporaryDtors(Stmt *E) {
+CFGBlock *CFGBuilder::VisitChildrenForTemporaryDtors(Stmt *E,
+                                                     TempDtorContext &Context) {
+  if (isa<LambdaExpr>(E)) {
+    // Do not visit the children of lambdas; they have their own CFGs.
+    return Block;
+  }
+
   // When visiting children for destructors we want to visit them in reverse
   // order that they will appear in the CFG.  Because the CFG is built
   // bottom-up, this means we visit them in their natural order, which
   // reverses them in the CFG.
   CFGBlock *B = Block;
   for (Stmt::child_range I = E->children(); I; ++I) {
     if (Stmt *Child = *I)
-      if (CFGBlock *R = VisitForTemporaryDtors(Child))
-        B = R;
+      if (CFGBlock *R = VisitForTemporaryDtors(Child, false, Context)) B = R;
   }
   return B;
 }
 
-CFGBlock *CFGBuilder::VisitBinaryOperatorForTemporaryDtors(BinaryOperator *E) {
+CFGBlock *CFGBuilder::VisitBinaryOperatorForTemporaryDtors(
+    BinaryOperator *E, TempDtorContext &Context) {
   if (E->isLogicalOp()) {
-    // Destructors for temporaries in LHS expression should be called after
-    // those for RHS expression. Even if this will unnecessarily create a block,
-    // this block will be used at least by the full expression.
-    autoCreateBlock();
-    CFGBlock *ConfluenceBlock = VisitForTemporaryDtors(E->getLHS());
-    if (badCFG)
-      return nullptr;
-
-    Succ = ConfluenceBlock;
-    Block = nullptr;
-    CFGBlock *RHSBlock = VisitForTemporaryDtors(E->getRHS());
-
-    if (RHSBlock) {
-      if (badCFG)
-        return nullptr;
-
-      // If RHS expression did produce destructors we need to connect created
-      // blocks to CFG in same manner as for binary operator itself.
-      CFGBlock *LHSBlock = createBlock(false);
-      LHSBlock->setTerminator(CFGTerminator(E, true));
-
-      // For binary operator LHS block is before RHS in list of predecessors
-      // of ConfluenceBlock.
-      std::reverse(ConfluenceBlock->pred_begin(),
-          ConfluenceBlock->pred_end());
-
-      // See if this is a known constant.
-      TryResult KnownVal = tryEvaluateBool(E->getLHS());
-      if (KnownVal.isKnown() && (E->getOpcode() == BO_LOr))
-        KnownVal.negate();
-
-      // Link LHSBlock with RHSBlock exactly the same way as for binary operator
-      // itself.
-      if (E->getOpcode() == BO_LOr) {
-        addSuccessor(LHSBlock, KnownVal.isTrue() ? nullptr : ConfluenceBlock);
-        addSuccessor(LHSBlock, KnownVal.isFalse() ? nullptr : RHSBlock);
-      } else {
-        assert (E->getOpcode() == BO_LAnd);
-        addSuccessor(LHSBlock, KnownVal.isFalse() ? nullptr : RHSBlock);
-        addSuccessor(LHSBlock, KnownVal.isTrue() ? nullptr : ConfluenceBlock);
-      }
-
-      Block = LHSBlock;
-      return LHSBlock;
-    }
-
-    Block = ConfluenceBlock;
-    return ConfluenceBlock;
+    VisitForTemporaryDtors(E->getLHS(), false, Context);
+    // We do not know at CFG-construction time whether the right-hand-side was
+    // executed, thus we add a branch node that depends on the temporary
+    // constructor call.
+    TempDtorContext RHSContext(/*IsConditional=*/true);
+    VisitForTemporaryDtors(E->getRHS(), false, RHSContext);
+    InsertTempDtorDecisionBlock(RHSContext);
+    return Block;
   }
 
   if (E->isAssignmentOp()) {
     // For assignment operator (=) LHS expression is visited
     // before RHS expression. For destructors visit them in reverse order.
-    CFGBlock *RHSBlock = VisitForTemporaryDtors(E->getRHS());
-    CFGBlock *LHSBlock = VisitForTemporaryDtors(E->getLHS());
+    CFGBlock *RHSBlock = VisitForTemporaryDtors(E->getRHS(), false, Context);
+    CFGBlock *LHSBlock = VisitForTemporaryDtors(E->getLHS(), false, Context);
     return LHSBlock ? LHSBlock : RHSBlock;
   }
 
   // For any other binary operator RHS expression is visited before
   // LHS expression (order of children). For destructors visit them in reverse
   // order.
-  CFGBlock *LHSBlock = VisitForTemporaryDtors(E->getLHS());
-  CFGBlock *RHSBlock = VisitForTemporaryDtors(E->getRHS());
+  CFGBlock *LHSBlock = VisitForTemporaryDtors(E->getLHS(), false, Context);
+  CFGBlock *RHSBlock = VisitForTemporaryDtors(E->getRHS(), false, Context);
   return RHSBlock ? RHSBlock : LHSBlock;
 }
 
 CFGBlock *CFGBuilder::VisitCXXBindTemporaryExprForTemporaryDtors(
-    CXXBindTemporaryExpr *E, bool BindToTemporary) {
+    CXXBindTemporaryExpr *E, bool BindToTemporary, TempDtorContext &Context) {
   // First add destructors for temporaries in subexpression.
-  CFGBlock *B = VisitForTemporaryDtors(E->getSubExpr());
+  CFGBlock *B = VisitForTemporaryDtors(E->getSubExpr(), false, Context);
   if (!BindToTemporary) {
     // If lifetime of temporary is not prolonged (by assigning to constant
     // reference) add destructor for it.
 
-    // If the destructor is marked as a no-return destructor, we need to create
-    // a new block for the destructor which does not have as a successor
-    // anything built thus far. Control won't flow out of this block.
     const CXXDestructorDecl *Dtor = E->getTemporary()->getDestructor();
+
     if (Dtor->isNoReturn()) {
-      Succ = B;
+      // If the destructor is marked as a no-return destructor, we need to
+      // create a new block for the destructor which does not have as a
+      // successor anything built thus far. Control won't flow out of this
+      // block.
+      if (B) Succ = B;
       Block = createNoReturnBlock();
+    } else if (Context.needsTempDtorBranch()) {
+      // If we need to introduce a branch, we add a new block that we will hook
+      // up to a decision block later.
+      if (B) Succ = B;
+      Block = createBlock();
     } else {
       autoCreateBlock();
     }
-
+    if (Context.needsTempDtorBranch()) {
+      Context.setDecisionPoint(Succ, E);
+    }
     appendTemporaryDtor(Block, E);
+
     B = Block;
   }
   return B;
 }
 
-CFGBlock *CFGBuilder::VisitConditionalOperatorForTemporaryDtors(
-    AbstractConditionalOperator *E, bool BindToTemporary) {
-  // First add destructors for condition expression.  Even if this will
-  // unnecessarily create a block, this block will be used at least by the full
-  // expression.
-  autoCreateBlock();
-  CFGBlock *ConfluenceBlock = VisitForTemporaryDtors(E->getCond());
-  if (badCFG)
-    return nullptr;
-  if (BinaryConditionalOperator *BCO
-        = dyn_cast<BinaryConditionalOperator>(E)) {
-    ConfluenceBlock = VisitForTemporaryDtors(BCO->getCommon());
-    if (badCFG)
-      return nullptr;
-  }
-
-  // Try to add block with destructors for LHS expression.
-  CFGBlock *LHSBlock = nullptr;
-  Succ = ConfluenceBlock;
-  Block = nullptr;
-  LHSBlock = VisitForTemporaryDtors(E->getTrueExpr(), BindToTemporary);
-  if (badCFG)
-    return nullptr;
-
-  // Try to add block with destructors for RHS expression;
-  Succ = ConfluenceBlock;
-  Block = nullptr;
-  CFGBlock *RHSBlock = VisitForTemporaryDtors(E->getFalseExpr(),
-                                              BindToTemporary);
-  if (badCFG)
-    return nullptr;
-
-  if (!RHSBlock && !LHSBlock) {
-    // If neither LHS nor RHS expression had temporaries to destroy don't create
-    // more blocks.
-    Block = ConfluenceBlock;
-    return Block;
+void CFGBuilder::InsertTempDtorDecisionBlock(const TempDtorContext &Context) {
+  if (!Context.TerminatorExpr) {
+    // If no temporary was found, we do not need to insert a decision point.
+    return;
   }
-
-  Block = createBlock(false);
-  Block->setTerminator(CFGTerminator(E, true));
-  assert(Block->getTerminator().isTemporaryDtorsBranch());
-
-  // See if this is a known constant.
-  const TryResult &KnownVal = tryEvaluateBool(E->getCond());
-
-  if (LHSBlock) {
-    addSuccessor(Block, LHSBlock, !KnownVal.isFalse());
-  } else if (KnownVal.isFalse()) {
-    addSuccessor(Block, nullptr);
-  } else {
-    addSuccessor(Block, ConfluenceBlock);
-    std::reverse(ConfluenceBlock->pred_begin(), ConfluenceBlock->pred_end());
-  }
+  assert(Context.TerminatorExpr);
+  CFGBlock *Decision = createBlock(false);
+  Decision->setTerminator(CFGTerminator(Context.TerminatorExpr, true));
+  addSuccessor(Decision, Block);
+  addSuccessor(Decision, Context.Succ);
+  Block = Decision;
 
-  if (!RHSBlock)
-    RHSBlock = ConfluenceBlock;
-
-  addSuccessor(Block, RHSBlock, !KnownVal.isTrue());
-
+CFGBlock *CFGBuilder::VisitConditionalOperatorForTemporaryDtors(
+    AbstractConditionalOperator *E, bool BindToTemporary,
+    TempDtorContext &Context) {
+  VisitForTemporaryDtors(E->getCond(), false, Context);
+  TempDtorContext TrueContext(/*IsConditional=*/true);
+  VisitForTemporaryDtors(E->getTrueExpr(), BindToTemporary, TrueContext);
+  InsertTempDtorDecisionBlock(TrueContext);
+  TempDtorContext FalseContext(/*IsConditional=*/true);
+  VisitForTemporaryDtors(E->getFalseExpr(), BindToTemporary, FalseContext);
+  InsertTempDtorDecisionBlock(FalseContext);
   return Block;
 }
 
 } // end anonymous namespace
 
 /// createBlock - Constructs and adds a new CFGBlock to the CFG.  The block has
 ///  no successors or predecessors.  If this is the first block created in the
 ///  CFG, it is automatically set to be the Entry and Exit of the CFG.
 CFGBlock *CFG::createBlock() {
   bool first_block = begin() == end();
 
   // Create the block.

lib/StaticAnalyzer/Core/CoreEngine.cpp

 //==- CoreEngine.cpp - Path-Sensitive Dataflow Engine ------------*- C++ -*-//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines a generic engine for intraprocedural, path-sensitive,
 //  dataflow analysis via graph reachability engine.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"
 #include "clang/AST/Expr.h"
+#include "clang/AST/ExprCXX.h"
 #include "clang/AST/StmtCXX.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/Statistic.h"
 #include "llvm/Support/Casting.h"
 
 using namespace clang;

 
 void CoreEngine::HandleBlockExit(const CFGBlock * B, ExplodedNode *Pred) {
 
   if (const Stmt *Term = B->getTerminator()) {
     switch (Term->getStmtClass()) {
       default:
         llvm_unreachable("Analysis for this terminator not implemented.");
 
+      case Stmt::CXXBindTemporaryExprClass:
+        HandleCleanupTemporaryBranch(
+            cast<CXXBindTemporaryExpr>(B->getTerminator().getStmt()), B, Pred);
+        return;
+
       // Model static initializers.
       case Stmt::DeclStmtClass:
         HandleStaticInit(cast<DeclStmt>(Term), B, Pred);
         return;
 
       case Stmt::BinaryOperatorClass: // '&&' and '||'
         HandleBranch(cast<BinaryOperator>(Term)->getLHS(), Term, B, Pred);
         return;
void CoreEngine::HandleBranch(const Stmt *Cond, const Stmt *Term,
   NodeBuilderContext Ctx(*this, B, Pred);
   ExplodedNodeSet Dst;
   SubEng.processBranch(Cond, Term, Ctx, Pred, Dst,
                        *(B->succ_begin()), *(B->succ_begin()+1));
   // Enqueue the new frontier onto the worklist.
   enqueue(Dst);
 }
 
+void CoreEngine::HandleCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
+                                              const CFGBlock *B,
+                                              ExplodedNode *Pred) {
+  assert(B->succ_size() == 2);
+  NodeBuilderContext Ctx(*this, B, Pred);
+  ExplodedNodeSet Dst;
+  SubEng.processCleanupTemporaryBranch(BTE, Ctx, Pred, Dst, *(B->succ_begin()),
+                                       *(B->succ_begin() + 1));
+  // Enqueue the new frontier onto the worklist.
+  enqueue(Dst);
+}
 
 void CoreEngine::HandleStaticInit(const DeclStmt *DS, const CFGBlock *B,
                                   ExplodedNode *Pred) {
   assert(B->succ_size() == 2);
   NodeBuilderContext Ctx(*this, B, Pred);
   ExplodedNodeSet Dst;
   SubEng.processStaticInitializer(DS, Ctx, Pred, Dst,
                                   *(B->succ_begin()), *(B->succ_begin()+1));

lib/StaticAnalyzer/Core/ExprEngine.cpp

STATISTIC(NumMaxBlockCountReached,
             "The # of aborted paths due to reaching the maximum block count in "
             "a top level function");
 STATISTIC(NumMaxBlockCountReachedInInlined,
             "The # of aborted paths due to reaching the maximum block count in "
             "an inlined function");
 STATISTIC(NumTimesRetriedWithoutInlining,
             "The # of times we re-evaluated a call without inlining");
 
+typedef std::pair<const CXXBindTemporaryExpr *, const StackFrameContext *>
+    CXXBindTemporaryContext;
+
+// Keeps track of whether CXXBindTemporaryExpr nodes have been evaluated.
+// The StackFrameContext assures that nested calls due to inlined recursive
+// functions do not interfere.
+REGISTER_TRAIT_WITH_PROGRAMSTATE(InitializedTemporariesSet,
+                                 llvm::ImmutableSet<CXXBindTemporaryContext>);
+
 //===----------------------------------------------------------------------===//
 // Engine construction and deletion.
 //===----------------------------------------------------------------------===//
 
 static const char* TagProviderName = "ExprEngine";
 
 ExprEngine::ExprEngine(AnalysisManager &mgr, bool gcEnabled,
                        SetOfConstDecls *VisitedCalleesIn,
void ExprEngine::ProcessMemberDtor(const CFGMemberDtor D,
   VisitCXXDestructor(Member->getType(),
                      FieldVal.castAs<loc::MemRegionVal>().getRegion(),
                      CurDtor->getBody(), /*IsBase=*/false, Pred, Dst);
 }
 
 void ExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D,
                                       ExplodedNode *Pred,
                                       ExplodedNodeSet &Dst) {
+  ExplodedNodeSet CleanDtorState;
+  StmtNodeBuilder StmtBldr(Pred, CleanDtorState, *currBldrCtx);
+  ProgramStateRef State = Pred->getState();
+  assert(State->contains<InitializedTemporariesSet>(
+      std::make_pair(D.getBindTemporaryExpr(), Pred->getStackFrame())));
+  State = State->remove<InitializedTemporariesSet>(
+      std::make_pair(D.getBindTemporaryExpr(), Pred->getStackFrame()));
+  StmtBldr.generateNode(D.getBindTemporaryExpr(), Pred, State);
 
   QualType varType = D.getBindTemporaryExpr()->getSubExpr()->getType();
-
-  // FIXME: Inlining of temporary destructors is not supported yet anyway, so we
-  // just put a NULL region for now. This will need to be changed later.
+  for (ExplodedNode *Node : CleanDtorState) {
+    // FIXME: Inlining of temporary destructors is not supported yet anyway, so
+    // we just put a NULL region for now. This will need to be changed later.
     VisitCXXDestructor(varType, nullptr, D.getBindTemporaryExpr(),
-                     /*IsBase=*/ false, Pred, Dst);
+                       /*IsBase=*/false, Node, Dst);
+  }
+}
+
+void ExprEngine::processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
+                                               NodeBuilderContext &BldCtx,
+                                               ExplodedNode *Pred,
+                                               ExplodedNodeSet &Dst,
+                                               const CFGBlock *DstT,
+                                               const CFGBlock *DstF) {
+  BranchNodeBuilder TempDtorBuilder(Pred, Dst, BldCtx, DstT, DstF);
+  if (Pred->getState()->contains<InitializedTemporariesSet>(
+          std::make_pair(BTE, Pred->getStackFrame()))) {
+    TempDtorBuilder.markInfeasible(false);
+    TempDtorBuilder.generateNode(Pred->getState(), true, Pred);
+  } else {
+    TempDtorBuilder.markInfeasible(true);
+    TempDtorBuilder.generateNode(Pred->getState(), false, Pred);
+  }
+}
+
+void ExprEngine::VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE,
+                                           ExplodedNodeSet &PreVisit,
+                                           ExplodedNodeSet &Dst) {
+  if (!getAnalysisManager().options.includeTemporaryDtorsInCFG()) {
+    // In case we don't have temporary destructors in the CFG, do not mark
+    // the initialization - we would otherwise never clean it up.
+    Dst = PreVisit;
+    return;
+  }
+  StmtNodeBuilder StmtBldr(PreVisit, Dst, *currBldrCtx);
+  for (ExplodedNode *Node : PreVisit) {
+    ProgramStateRef State = Node->getState();
+    assert(!State->contains<InitializedTemporariesSet>(
+        std::make_pair(BTE, Node->getStackFrame())));
+    State = State->add<InitializedTemporariesSet>(
+        std::make_pair(BTE, Node->getStackFrame()));
+    StmtBldr.generateNode(BTE, Node, State);
+  }
 }
 
 void ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred,
                        ExplodedNodeSet &DstTop) {
   PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
                                 S->getLocStart(),
                                 "Error evaluating statement");
   ExplodedNodeSet Dst;
case Stmt::ObjCAtSynchronizedStmtClass:
       VisitObjCAtSynchronizedStmt(cast<ObjCAtSynchronizedStmt>(S), Pred, Dst);
       Bldr.addNodes(Dst);
       break;
 
     case Stmt::ExprWithCleanupsClass:
       // Handled due to fully linearised CFG.
       break;
 
+    case Stmt::CXXBindTemporaryExprClass: {
+      Bldr.takeNodes(Pred);
+      ExplodedNodeSet PreVisit;
+      getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this);
+      ExplodedNodeSet Next;
+      VisitCXXBindTemporaryExpr(cast<CXXBindTemporaryExpr>(S), PreVisit, Next);
+      getCheckerManager().runCheckersForPostStmt(Dst, Next, S, *this);
+      Bldr.addNodes(Dst);
+      break;
+    }
+
     // Cases not handled yet; but will handle some day.
     case Stmt::DesignatedInitExprClass:
     case Stmt::ExtVectorElementExprClass:
     case Stmt::ImaginaryLiteralClass:
     case Stmt::ObjCAtCatchStmtClass:
     case Stmt::ObjCAtFinallyStmtClass:
     case Stmt::ObjCAtTryStmtClass:
     case Stmt::ObjCAutoreleasePoolStmtClass:
switch (S->getStmtClass()) {
     case Stmt::ImplicitValueInitExprClass:
     case Stmt::CXXScalarValueInitExprClass:
     case Stmt::CXXBoolLiteralExprClass:
     case Stmt::ObjCBoolLiteralExprClass:
     case Stmt::FloatingLiteralClass:
     case Stmt::SizeOfPackExprClass:
     case Stmt::StringLiteralClass:
     case Stmt::ObjCStringLiteralClass:
-    case Stmt::CXXBindTemporaryExprClass:
     case Stmt::CXXPseudoDestructorExprClass:
     case Stmt::SubstNonTypeTemplateParmExprClass:
     case Stmt::CXXNullPtrLiteralExprClass: {
       Bldr.takeNodes(Pred);
       ExplodedNodeSet preVisit;
       getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this);
       getCheckerManager().runCheckersForPostStmt(Dst, preVisit, S, *this);
       Bldr.addNodes(Dst);
static const Stmt *ResolveCondition(const Stmt *Condition,
                                     const CFGBlock *B) {
   if (const Expr *Ex = dyn_cast<Expr>(Condition))
     Condition = Ex->IgnoreParens();
 
   const BinaryOperator *BO = dyn_cast<BinaryOperator>(Condition);
   if (!BO || !BO->isLogicalOp())
     return Condition;
 
-  // FIXME: This is a workaround until we handle temporary destructor branches
-  // correctly; currently, temporary destructor branches lead to blocks that
-  // only have a terminator (and no statements). These blocks violate the
-  // invariant this function assumes.
-  if (B->getTerminator().isTemporaryDtorsBranch()) return Condition;
+  assert(!B->getTerminator().isTemporaryDtorsBranch() &&
+         "Temporary destructor branches handled by processBindTemporary.");
 
   // For logical operations, we still have the case where some branches
   // use the traditional "merge" approach and others sink the branch
   // directly into the basic blocks representing the logical operation.
   // We need to distinguish between those two cases here.
 
   // The invariants are still shifting, but it is possible that the
   // last element in a CFGBlock is not a CFGStmt.  Look for the last

 }
 
 void ExprEngine::processBranch(const Stmt *Condition, const Stmt *Term,
                                NodeBuilderContext& BldCtx,
                                ExplodedNode *Pred,
                                ExplodedNodeSet &Dst,
                                const CFGBlock *DstT,
                                const CFGBlock *DstF) {
+  assert((!Condition || !isa<CXXBindTemporaryExpr>(Condition)) &&
+         "CXXBindTemporaryExprs are handled by processBindTemporary.");
   const LocationContext *LCtx = Pred->getLocationContext();
   PrettyStackTraceLocationContext StackCrashInfo(LCtx);
   currBldrCtx = &BldCtx;
 
   // Check for NULL conditions; e.g. "for(;;)"
   if (!Condition) {
     BranchNodeBuilder NullCondBldr(Pred, Dst, BldCtx, DstT, DstF);
     NullCondBldr.markInfeasible(false);
     NullCondBldr.generateNode(Pred->getState(), true, Pred);
     return;
   }
 
 
   if (const Expr *Ex = dyn_cast<Expr>(Condition))
     Condition = Ex->IgnoreParens();
 
   Condition = ResolveCondition(Condition, BldCtx.getBlock());
   PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
                                 Condition->getLocStart(),
                                 "Error evaluating branch");
 

test/Analysis/temp-obj-dtors-cfg-output.cpp

 // CHECK:     Succs (1): B0
 // CHECK:   [B2]
 // CHECK:     1: ~B() (Temporary object destructor)
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B1
 // CHECK:   [B3]
 // CHECK:     1: [B5.8] && [B4.5]
 // CHECK:     2: [B5.3]([B3.1])
-// CHECK:     T: (Temp Dtor) [B5.8] && ...
+// CHECK:     T: (Temp Dtor) [B4.2]
 // CHECK:     Preds (2): B4 B5
 // CHECK:     Succs (2): B2 B1
 // CHECK:   [B4]
 // CHECK:     1: B() (CXXConstructExpr, class B)
 // CHECK:     2: [B4.1] (BindTemporary)
 // CHECK:     3: [B4.2].operator bool
 // CHECK:     4: [B4.2]
 // CHECK:     5: [B4.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)

 // CHECK:     Succs (2): B4 B3
 // CHECK:   [B6]
 // CHECK:     1: ~B() (Temporary object destructor)
 // CHECK:     Preds (1): B7
 // CHECK:     Succs (1): B5
 // CHECK:   [B7]
 // CHECK:     1: [B9.5] && [B8.5]
 // CHECK:     2: bool a = A() && B();
-// CHECK:     T: (Temp Dtor) [B9.5] && ...
+// CHECK:     T: (Temp Dtor) [B8.2]
 // CHECK:     Preds (2): B8 B9
 // CHECK:     Succs (2): B6 B5
 // CHECK:   [B8]
 // CHECK:     1: B() (CXXConstructExpr, class B)
 // CHECK:     2: [B8.1] (BindTemporary)
 // CHECK:     3: [B8.2].operator bool
 // CHECK:     4: [B8.2]
 // CHECK:     5: [B8.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)

 // CHECK:     Succs (1): B0
 // CHECK:   [B2]
 // CHECK:     1: ~B() (Temporary object destructor)
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B1
 // CHECK:   [B3]
 // CHECK:     1: [B5.8] || [B4.5]
 // CHECK:     2: [B5.3]([B3.1])
-// CHECK:     T: (Temp Dtor) [B5.8] || ...
+// CHECK:     T: (Temp Dtor) [B4.2]
 // CHECK:     Preds (2): B4 B5
-// CHECK:     Succs (2): B1 B2
+// CHECK:     Succs (2): B2 B1
 // CHECK:   [B4]
 // CHECK:     1: B() (CXXConstructExpr, class B)
 // CHECK:     2: [B4.1] (BindTemporary)
 // CHECK:     3: [B4.2].operator bool
 // CHECK:     4: [B4.2]
 // CHECK:     5: [B4.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
 // CHECK:     Preds (1): B5
 // CHECK:     Succs (1): B3

 // CHECK:     Succs (2): B3 B4
 // CHECK:   [B6]
 // CHECK:     1: ~B() (Temporary object destructor)
 // CHECK:     Preds (1): B7
 // CHECK:     Succs (1): B5
 // CHECK:   [B7]
 // CHECK:     1: [B9.5] || [B8.5]
 // CHECK:     2: bool a = A() || B();
-// CHECK:     T: (Temp Dtor) [B9.5] || ...
+// CHECK:     T: (Temp Dtor) [B8.2]
 // CHECK:     Preds (2): B8 B9
-// CHECK:     Succs (2): B5 B6
+// CHECK:     Succs (2): B6 B5
 // CHECK:   [B8]
 // CHECK:     1: B() (CXXConstructExpr, class B)
 // CHECK:     2: [B8.1] (BindTemporary)
 // CHECK:     3: [B8.2].operator bool
 // CHECK:     4: [B8.2]
 // CHECK:     5: [B8.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
 // CHECK:     Preds (1): B9
 // CHECK:     Succs (1): B7
 // CHECK:   [B9]
 // CHECK:     1: A() (CXXConstructExpr, class A)
 // CHECK:     2: [B9.1] (BindTemporary)
 // CHECK:     3: [B9.2].operator bool
 // CHECK:     4: [B9.2]
 // CHECK:     5: [B9.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
 // CHECK:     T: [B9.5] || ...
 // CHECK:     Preds (1): B10
 // CHECK:     Succs (2): B7 B8
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (1): B1
-// CHECK:   [B11 (ENTRY)]
-// CHECK:     Succs (1): B10
+// CHECK:   [B12 (ENTRY)]
+// CHECK:     Succs (1): B11
 // CHECK:   [B1]
 // CHECK:     1: int b;
-// CHECK:     2: [B7.5].~A() (Implicit destructor)
+// CHECK:     2: [B8.5].~A() (Implicit destructor)
 // CHECK:     Preds (2): B2 B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B2]
 // CHECK:     1: foo
 // CHECK:     2: [B2.1] (ImplicitCastExpr, FunctionToPointerDecay, void (*)(int))
 // CHECK:     3: 0
 // CHECK:     4: [B2.2]([B2.3])
 // CHECK:     Preds (1): B4

 // CHECK:     6: [B4.5] (ImplicitCastExpr, UserDefinedConversion, _Bool)
 // CHECK:     7: ~B() (Temporary object destructor)
 // CHECK:     T: if [B4.6]
 // CHECK:     Preds (2): B5 B6
 // CHECK:     Succs (2): B3 B2
 // CHECK:   [B5]
 // CHECK:     1: ~A() (Temporary object destructor)
 // CHECK:     2: ~A() (Temporary object destructor)
-// CHECK:     Preds (1): B7
+// CHECK:     Preds (1): B6
 // CHECK:     Succs (1): B4
 // CHECK:   [B6]
+// CHECK:     T: (Temp Dtor) [B9.2]
+// CHECK:     Preds (2): B7 B8
+// CHECK:     Succs (2): B5 B4
+// CHECK:   [B7]
 // CHECK:     1: ~A() (Temporary object destructor)
 // CHECK:     2: ~A() (Temporary object destructor)
 // CHECK:     3: ~A() (Temporary object destructor)
 // CHECK:     4: ~B() (Temporary object destructor)
-// CHECK:     Preds (1): B7
-// CHECK:     Succs (1): B4
-// CHECK:   [B7]
-// CHECK:     1: [B10.5] ? [B8.6] : [B9.15]
-// CHECK:     2: [B7.1] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     3: [B7.2]
-// CHECK:     4: [B7.3] (CXXConstructExpr, class A)
-// CHECK:     5: A a = B() ? A() : A(B());
-// CHECK:     T: (Temp Dtor) [B10.5] ? ... : ...
-// CHECK:     Preds (2): B8 B9
-// CHECK:     Succs (2): B5 B6
+// CHECK:     Preds (1): B8
+// CHECK:     Succs (1): B6
 // CHECK:   [B8]
-// CHECK:     1: A() (CXXConstructExpr, class A)
-// CHECK:     2: [B8.1] (BindTemporary)
-// CHECK:     3: [B8.2] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     4: [B8.3]
-// CHECK:     5: [B8.4] (CXXConstructExpr, class A)
-// CHECK:     6: [B8.5] (BindTemporary)
-// CHECK:     Preds (1): B10
-// CHECK:     Succs (1): B7
+// CHECK:     1: [B11.5] ? [B9.6] : [B10.15]
+// CHECK:     2: [B8.1] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     3: [B8.2]
+// CHECK:     4: [B8.3] (CXXConstructExpr, class A)
+// CHECK:     5: A a = B() ? A() : A(B());
+// CHECK:     T: (Temp Dtor) [B10.2]
+// CHECK:     Preds (2): B9 B10
+// CHECK:     Succs (2): B7 B6
 // CHECK:   [B9]
-// CHECK:     1: B() (CXXConstructExpr, class B)
+// CHECK:     1: A() (CXXConstructExpr, class A)
 // CHECK:     2: [B9.1] (BindTemporary)
-// CHECK:     3: [B9.2].operator A
-// CHECK:     4: [B9.2]
-// CHECK:     5: [B9.4] (ImplicitCastExpr, UserDefinedConversion, class A)
+// CHECK:     3: [B9.2] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     4: [B9.3]
+// CHECK:     5: [B9.4] (CXXConstructExpr, class A)
 // CHECK:     6: [B9.5] (BindTemporary)
-// CHECK:     7: [B9.6] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     8: [B9.7]
-// CHECK:     9: [B9.8] (CXXConstructExpr, class A)
-// CHECK:    10: [B9.9] (BindTemporary)
-// CHECK:    11: A([B9.10]) (CXXFunctionalCastExpr, ConstructorConversion, class A)
-// CHECK:    12: [B9.11] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:    13: [B9.12]
-// CHECK:    14: [B9.13] (CXXConstructExpr, class A)
-// CHECK:    15: [B9.14] (BindTemporary)
-// CHECK:     Preds (1): B10
-// CHECK:     Succs (1): B7
+// CHECK:     Preds (1): B11
+// CHECK:     Succs (1): B8
 // CHECK:   [B10]
 // CHECK:     1: B() (CXXConstructExpr, class B)
 // CHECK:     2: [B10.1] (BindTemporary)
-// CHECK:     3: [B10.2].operator bool
+// CHECK:     3: [B10.2].operator A
 // CHECK:     4: [B10.2]
-// CHECK:     5: [B10.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
-// CHECK:     T: [B10.5] ? ... : ...
+// CHECK:     5: [B10.4] (ImplicitCastExpr, UserDefinedConversion, class A)
+// CHECK:     6: [B10.5] (BindTemporary)
+// CHECK:     7: [B10.6] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     8: [B10.7]
+// CHECK:     9: [B10.8] (CXXConstructExpr, class A)
+// CHECK:    10: [B10.9] (BindTemporary)
+// CHECK:    11: A([B10.10]) (CXXFunctionalCastExpr, ConstructorConversion, class A)
+// CHECK:    12: [B10.11] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:    13: [B10.12]
+// CHECK:    14: [B10.13] (CXXConstructExpr, class A)
+// CHECK:    15: [B10.14] (BindTemporary)
 // CHECK:     Preds (1): B11
-// CHECK:     Succs (2): B8 B9
+// CHECK:     Succs (1): B8
+// CHECK:   [B11]
+// CHECK:     1: B() (CXXConstructExpr, class B)
+// CHECK:     2: [B11.1] (BindTemporary)
+// CHECK:     3: [B11.2].operator bool
+// CHECK:     4: [B11.2]
+// CHECK:     5: [B11.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
+// CHECK:     T: [B11.5] ? ... : ...
+// CHECK:     Preds (1): B12
+// CHECK:     Succs (2): B9 B10
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (1): B1
-// CHECK:  C() : b_(true)
 // CHECK:   [B2 (ENTRY)]
 // CHECK:     Succs (1): B1
 // CHECK:   [B1]
 // CHECK:     1: true
 // CHECK:     2: b_([B1.1]) (Member initializer)
 // CHECK:     Preds (1): B2
 // CHECK:     Succs (1): B0
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (1): B1
-// CHECK:  ~C()
 // CHECK:   [B1 (ENTRY)]
 // CHECK:     Succs (1): B0
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (1): B1
-// CHECK:  operator bool()
 // CHECK:   [B2 (ENTRY)]
 // CHECK:     Succs (1): B1
 // CHECK:   [B1]
 // CHECK:     1: this
 // CHECK:     2: [B1.1]->b_
 // CHECK:     3: [B1.2] (ImplicitCastExpr, LValueToRValue, _Bool)
 // CHECK:     4: return [B1.3];
 // CHECK:     Preds (1): B2
 // CHECK:     Succs (1): B0
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (1): B1
-// CHECK:  D() : b_(true)
 // CHECK:   [B2 (ENTRY)]
 // CHECK:     Succs (1): B1
 // CHECK:   [B1]
 // CHECK:     1: true
 // CHECK:     2: b_([B1.1]) (Member initializer)
 // CHECK:     Preds (1): B2
 // CHECK:     Succs (1): B0
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (1): B1
-// CHECK:  operator bool()
 // CHECK:   [B2 (ENTRY)]
 // CHECK:     Succs (1): B1
 // CHECK:   [B1]
 // CHECK:     1: this
 // CHECK:     2: [B1.1]->b_
 // CHECK:     3: [B1.2] (ImplicitCastExpr, LValueToRValue, _Bool)
 // CHECK:     4: return [B1.3];
 // CHECK:     Preds (1): B2
 // CHECK:     Succs (1): B0
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (1): B1
-// CHECK:  int test_cond_unnamed_custom_destructor()
 // CHECK:   [B4 (ENTRY)]
 // CHECK:     Succs (1): B3
 // CHECK:   [B1]
 // CHECK:     1: 0
 // CHECK:     2: return [B1.1];
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B2]
 // CHECK:     1: 1
 // CHECK:     2: return [B2.1];
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B3]
 // CHECK:     1: C() (CXXConstructExpr, struct C)
 // CHECK:     2: [B3.1] (BindTemporary)
 // CHECK:     3: [B3.2].operator bool
 // CHECK:     4: [B3.2]
 // CHECK:     5: [B3.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
 // CHECK:     6: ~C() (Temporary object destructor)
 // CHECK:     T: if [B3.5]
 // CHECK:     Preds (1): B4
 // CHECK:     Succs (2): B2 B1
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (2): B1 B2
-// CHECK:  int test_cond_named_custom_destructor()
 // CHECK:   [B5 (ENTRY)]
 // CHECK:     Succs (1): B4
 // CHECK:   [B1]
 // CHECK:     1: [B4.6].~C() (Implicit destructor)
 // CHECK:     Succs (1): B0
 // CHECK:   [B2]
 // CHECK:     1: 0
 // CHECK:     2: return [B2.1];

 // CHECK:     9: [B4.8].operator bool
 // CHECK:    10: [B4.8]
 // CHECK:    11: [B4.10] (ImplicitCastExpr, UserDefinedConversion, _Bool)
 // CHECK:     T: if [B4.11]
 // CHECK:     Preds (1): B5
 // CHECK:     Succs (2): B3 B2
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (3): B1 B2 B3
-// CHECK:  int test_cond_unnamed_auto_destructor()
 // CHECK:   [B4 (ENTRY)]
 // CHECK:     Succs (1): B3
 // CHECK:   [B1]
 // CHECK:     1: 0
 // CHECK:     2: return [B1.1];
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B2]
 // CHECK:     1: 1
 // CHECK:     2: return [B2.1];
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B3]
 // CHECK:     1: D() (CXXConstructExpr, struct D)
 // CHECK:     2: [B3.1].operator bool
 // CHECK:     3: [B3.1]
 // CHECK:     4: [B3.3] (ImplicitCastExpr, UserDefinedConversion, _Bool)
 // CHECK:     T: if [B3.4]
 // CHECK:     Preds (1): B4
 // CHECK:     Succs (2): B2 B1
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (2): B1 B2
-// CHECK:  int test_cond_named_auto_destructor()
 // CHECK:   [B4 (ENTRY)]
 // CHECK:     Succs (1): B3
 // CHECK:   [B1]
 // CHECK:     1: 0
 // CHECK:     2: return [B1.1];
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B2]

 // CHECK:     7: [B3.6].operator bool
 // CHECK:     8: [B3.6]
 // CHECK:     9: [B3.8] (ImplicitCastExpr, UserDefinedConversion, _Bool)
 // CHECK:     T: if [B3.9]
 // CHECK:     Preds (1): B4
 // CHECK:     Succs (2): B2 B1
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (2): B1 B2
-// CHECK:   [B14 (ENTRY)]
-// CHECK:     Succs (1): B13
+// CHECK:   [B16 (ENTRY)]
+// CHECK:     Succs (1): B15
 // CHECK:   [B1]
 // CHECK:     1: ~B() (Temporary object destructor)
 // CHECK:     2: int b;
-// CHECK:     3: [B10.4].~A() (Implicit destructor)
+// CHECK:     3: [B12.4].~A() (Implicit destructor)
 // CHECK:     Preds (2): B2 B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B2]
 // CHECK:     1: ~A() (Temporary object destructor)
 // CHECK:     2: ~A() (Temporary object destructor)
-// CHECK:     Preds (1): B4
+// CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B1
 // CHECK:   [B3]
+// CHECK:     T: (Temp Dtor) [B6.2]
+// CHECK:     Preds (2): B4 B5
+// CHECK:     Succs (2): B2 B1
+// CHECK:   [B4]
 // CHECK:     1: ~A() (Temporary object destructor)
 // CHECK:     2: ~A() (Temporary object destructor)
 // CHECK:     3: ~A() (Temporary object destructor)
 // CHECK:     4: ~B() (Temporary object destructor)
-// CHECK:     Preds (1): B4
-// CHECK:     Succs (1): B1
-// CHECK:   [B4]
-// CHECK:     1: [B7.8] ? [B5.6] : [B6.15]
-// CHECK:     2: [B4.1] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     3: [B4.2]
-// CHECK:     4: [B7.3]([B4.3])
-// CHECK:     T: (Temp Dtor) [B7.8] ? ... : ...
-// CHECK:     Preds (2): B5 B6
-// CHECK:     Succs (2): B2 B3
+// CHECK:     Preds (1): B5
+// CHECK:     Succs (1): B3
 // CHECK:   [B5]
-// CHECK:     1: A() (CXXConstructExpr, class A)
-// CHECK:     2: [B5.1] (BindTemporary)
-// CHECK:     3: [B5.2] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     4: [B5.3]
-// CHECK:     5: [B5.4] (CXXConstructExpr, class A)
-// CHECK:     6: [B5.5] (BindTemporary)
-// CHECK:     Preds (1): B7
-// CHECK:     Succs (1): B4
+// CHECK:     1: [B8.8] ? [B6.6] : [B7.15]
+// CHECK:     2: [B5.1] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     3: [B5.2]
+// CHECK:     4: [B8.3]([B5.3])
+// CHECK:     T: (Temp Dtor) [B7.2]
+// CHECK:     Preds (2): B6 B7
+// CHECK:     Succs (2): B4 B3
 // CHECK:   [B6]
-// CHECK:     1: B() (CXXConstructExpr, class B)
+// CHECK:     1: A() (CXXConstructExpr, class A)
 // CHECK:     2: [B6.1] (BindTemporary)
-// CHECK:     3: [B6.2].operator A
-// CHECK:     4: [B6.2]
-// CHECK:     5: [B6.4] (ImplicitCastExpr, UserDefinedConversion, class A)
+// CHECK:     3: [B6.2] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     4: [B6.3]
+// CHECK:     5: [B6.4] (CXXConstructExpr, class A)
 // CHECK:     6: [B6.5] (BindTemporary)
-// CHECK:     7: [B6.6] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     8: [B6.7]
-// CHECK:     9: [B6.8] (CXXConstructExpr, class A)
-// CHECK:    10: [B6.9] (BindTemporary)
-// CHECK:    11: A([B6.10]) (CXXFunctionalCastExpr, ConstructorConversion, class A)
-// CHECK:    12: [B6.11] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:    13: [B6.12]
-// CHECK:    14: [B6.13] (CXXConstructExpr, class A)
-// CHECK:    15: [B6.14] (BindTemporary)
-// CHECK:     Preds (1): B7
-// CHECK:     Succs (1): B4
+// CHECK:     Preds (1): B8
+// CHECK:     Succs (1): B5
 // CHECK:   [B7]
+// CHECK:     1: B() (CXXConstructExpr, class B)
+// CHECK:     2: [B7.1] (BindTemporary)
+// CHECK:     3: [B7.2].operator A
+// CHECK:     4: [B7.2]
+// CHECK:     5: [B7.4] (ImplicitCastExpr, UserDefinedConversion, class A)
+// CHECK:     6: [B7.5] (BindTemporary)
+// CHECK:     7: [B7.6] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     8: [B7.7]
+// CHECK:     9: [B7.8] (CXXConstructExpr, class A)
+// CHECK:    10: [B7.9] (BindTemporary)
+// CHECK:    11: A([B7.10]) (CXXFunctionalCastExpr, ConstructorConversion, class A)
+// CHECK:    12: [B7.11] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:    13: [B7.12]
+// CHECK:    14: [B7.13] (CXXConstructExpr, class A)
+// CHECK:    15: [B7.14] (BindTemporary)
+// CHECK:     Preds (1): B8
+// CHECK:     Succs (1): B5
+// CHECK:   [B8]
 // CHECK:     1: ~B() (Temporary object destructor)
 // CHECK:     2: foo
-// CHECK:     3: [B7.2] (ImplicitCastExpr, FunctionToPointerDecay, void (*)(const class A &))
+// CHECK:     3: [B8.2] (ImplicitCastExpr, FunctionToPointerDecay, void (*)(const class A &))
 // CHECK:     4: B() (CXXConstructExpr, class B)
-// CHECK:     5: [B7.4] (BindTemporary)
-// CHECK:     6: [B7.5].operator bool
-// CHECK:     7: [B7.5]
-// CHECK:     8: [B7.7] (ImplicitCastExpr, UserDefinedConversion, _Bool)
-// CHECK:     T: [B7.8] ? ... : ...
-// CHECK:     Preds (2): B8 B9
-// CHECK:     Succs (2): B5 B6
-// CHECK:   [B8]
-// CHECK:     1: ~A() (Temporary object destructor)
-// CHECK:     Preds (1): B10
-// CHECK:     Succs (1): B7
+// CHECK:     5: [B8.4] (BindTemporary)
+// CHECK:     6: [B8.5].operator bool
+// CHECK:     7: [B8.5]
+// CHECK:     8: [B8.7] (ImplicitCastExpr, UserDefinedConversion, _Bool)
+// CHECK:     T: [B8.8] ? ... : ...
+// CHECK:     Preds (2): B9 B10
+// CHECK:     Succs (2): B6 B7
 // CHECK:   [B9]
 // CHECK:     1: ~A() (Temporary object destructor)
-// CHECK:     2: ~A() (Temporary object destructor)
-// CHECK:     3: ~B() (Temporary object destructor)
 // CHECK:     Preds (1): B10
-// CHECK:     Succs (1): B7
+// CHECK:     Succs (1): B8
 // CHECK:   [B10]
-// CHECK:     1: [B13.5] ? [B11.6] : [B12.15]
-// CHECK:     2: [B10.1] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     3: [B10.2]
-// CHECK:     4: const A &a = B() ? A() : A(B());
-// CHECK:     T: (Temp Dtor) [B13.5] ? ... : ...
+// CHECK:     T: (Temp Dtor) [B13.2]
 // CHECK:     Preds (2): B11 B12
-// CHECK:     Succs (2): B8 B9
+// CHECK:     Succs (2): B9 B8
 // CHECK:   [B11]
-// CHECK:     1: A() (CXXConstructExpr, class A)
-// CHECK:     2: [B11.1] (BindTemporary)
-// CHECK:     3: [B11.2] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     4: [B11.3]
-// CHECK:     5: [B11.4] (CXXConstructExpr, class A)
-// CHECK:     6: [B11.5] (BindTemporary)
-// CHECK:     Preds (1): B13
+// CHECK:     1: ~A() (Temporary object destructor)
+// CHECK:     2: ~A() (Temporary object destructor)
+// CHECK:     3: ~B() (Temporary object destructor)
+// CHECK:     Preds (1): B12
 // CHECK:     Succs (1): B10
 // CHECK:   [B12]
-// CHECK:     1: B() (CXXConstructExpr, class B)
-// CHECK:     2: [B12.1] (BindTemporary)
-// CHECK:     3: [B12.2].operator A
-// CHECK:     4: [B12.2]
-// CHECK:     5: [B12.4] (ImplicitCastExpr, UserDefinedConversion, class A)
-// CHECK:     6: [B12.5] (BindTemporary)
-// CHECK:     7: [B12.6] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     8: [B12.7]
-// CHECK:     9: [B12.8] (CXXConstructExpr, class A)
-// CHECK:    10: [B12.9] (BindTemporary)
-// CHECK:    11: A([B12.10]) (CXXFunctionalCastExpr, ConstructorConversion, class A)
-// CHECK:    12: [B12.11] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:    13: [B12.12]
-// CHECK:    14: [B12.13] (CXXConstructExpr, class A)
-// CHECK:    15: [B12.14] (BindTemporary)
-// CHECK:     Preds (1): B13
-// CHECK:     Succs (1): B10
+// CHECK:     1: [B15.5] ? [B13.6] : [B14.15]
+// CHECK:     2: [B12.1] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     3: [B12.2]
+// CHECK:     4: const A &a = B() ? A() : A(B());
+// CHECK:     T: (Temp Dtor) [B14.2]
+// CHECK:     Preds (2): B13 B14
+// CHECK:     Succs (2): B11 B10
 // CHECK:   [B13]
-// CHECK:     1: B() (CXXConstructExpr, class B)
+// CHECK:     1: A() (CXXConstructExpr, class A)
 // CHECK:     2: [B13.1] (BindTemporary)
-// CHECK:     3: [B13.2].operator bool
-// CHECK:     4: [B13.2]
-// CHECK:     5: [B13.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
-// CHECK:     T: [B13.5] ? ... : ...
-// CHECK:     Preds (1): B14
-// CHECK:     Succs (2): B11 B12
+// CHECK:     3: [B13.2] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     4: [B13.3]
+// CHECK:     5: [B13.4] (CXXConstructExpr, class A)
+// CHECK:     6: [B13.5] (BindTemporary)
+// CHECK:     Preds (1): B15
+// CHECK:     Succs (1): B12
+// CHECK:   [B14]
+// CHECK:     1: B() (CXXConstructExpr, class B)
+// CHECK:     2: [B14.1] (BindTemporary)
+// CHECK:     3: [B14.2].operator A
+// CHECK:     4: [B14.2]
+// CHECK:     5: [B14.4] (ImplicitCastExpr, UserDefinedConversion, class A)
+// CHECK:     6: [B14.5] (BindTemporary)
+// CHECK:     7: [B14.6] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     8: [B14.7]
+// CHECK:     9: [B14.8] (CXXConstructExpr, class A)
+// CHECK:    10: [B14.9] (BindTemporary)
+// CHECK:    11: A([B14.10]) (CXXFunctionalCastExpr, ConstructorConversion, class A)
+// CHECK:    12: [B14.11] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:    13: [B14.12]
+// CHECK:    14: [B14.13] (CXXConstructExpr, class A)
+// CHECK:    15: [B14.14] (BindTemporary)
+// CHECK:     Preds (1): B15
+// CHECK:     Succs (1): B12
+// CHECK:   [B15]
+// CHECK:     1: B() (CXXConstructExpr, class B)
+// CHECK:     2: [B15.1] (BindTemporary)
+// CHECK:     3: [B15.2].operator bool
+// CHECK:     4: [B15.2]
+// CHECK:     5: [B15.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
+// CHECK:     T: [B15.5] ? ... : ...
+// CHECK:     Preds (1): B16
+// CHECK:     Succs (2): B13 B14
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (1): B1
-// CHECK:   [B8 (ENTRY)]
-// CHECK:     Succs (1): B7
+// CHECK:   [B9 (ENTRY)]
+// CHECK:     Succs (1): B8
 // CHECK:   [B1]
-// CHECK:     1: ~A() (Temporary object destructor)
-// CHECK:     2: int b;
-// CHECK:     3: [B4.5].~A() (Implicit destructor)
+// CHECK:     1: int b;
+// CHECK:     2: [B5.5].~A() (Implicit destructor)
 // CHECK:     Preds (2): B2 B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B2]
 // CHECK:     1: ~A() (Temporary object destructor)
-// CHECK:     Preds (1): B4
+// CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B1
 // CHECK:   [B3]
+// CHECK:     T: (Temp Dtor) [B6.4]
+// CHECK:     Preds (2): B4 B5
+// CHECK:     Succs (2): B2 B1
+// CHECK:   [B4]
 // CHECK:     1: ~A() (Temporary object destructor)
 // CHECK:     2: ~A() (Temporary object destructor)
-// CHECK:     Preds (1): B4
-// CHECK:     Succs (1): B1
-// CHECK:   [B4]
-// CHECK:     1: [B7.2] ?: [B6.6]
-// CHECK:     2: [B4.1] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     3: [B4.2]
-// CHECK:     4: [B4.3] (CXXConstructExpr, class A)
-// CHECK:     5: A a = A() ?: A();
-// CHECK:     T: (Temp Dtor) [B7.5] ? ... : ...
-// CHECK:     Preds (2): B5 B6
-// CHECK:     Succs (2): B2 B3
+// CHECK:     Preds (1): B5
+// CHECK:     Succs (1): B3
 // CHECK:   [B5]
-// CHECK:     1: [B7.2] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     2: [B5.1]
-// CHECK:     3: [B5.2] (CXXConstructExpr, class A)
-// CHECK:     4: [B5.3] (BindTemporary)
-// CHECK:     Preds (1): B7
-// CHECK:     Succs (1): B4
+// CHECK:     1: [B8.2] ?: [B7.6]
+// CHECK:     2: [B5.1] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     3: [B5.2]
+// CHECK:     4: [B5.3] (CXXConstructExpr, class A)
+// CHECK:     5: A a = A() ?: A();
+// CHECK:     T: (Temp Dtor) [B7.2]
+// CHECK:     Preds (2): B6 B7
+// CHECK:     Succs (2): B4 B3
 // CHECK:   [B6]
-// CHECK:     1: A() (CXXConstructExpr, class A)
-// CHECK:     2: [B6.1] (BindTemporary)
-// CHECK:     3: [B6.2] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     4: [B6.3]
-// CHECK:     5: [B6.4] (CXXConstructExpr, class A)
-// CHECK:     6: [B6.5] (BindTemporary)
-// CHECK:     Preds (1): B7
-// CHECK:     Succs (1): B4
+// CHECK:     1: [B8.2] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     2: [B6.1]
+// CHECK:     3: [B6.2] (CXXConstructExpr, class A)
+// CHECK:     4: [B6.3] (BindTemporary)
+// CHECK:     Preds (1): B8
+// CHECK:     Succs (1): B5
 // CHECK:   [B7]
 // CHECK:     1: A() (CXXConstructExpr, class A)
 // CHECK:     2: [B7.1] (BindTemporary)
-// CHECK:     3: [B7.2].operator bool
-// CHECK:     4: [B7.2]
-// CHECK:     5: [B7.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
-// CHECK:     T: [B7.5] ? ... : ...
+// CHECK:     3: [B7.2] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     4: [B7.3]
+// CHECK:     5: [B7.4] (CXXConstructExpr, class A)
+// CHECK:     6: [B7.5] (BindTemporary)
 // CHECK:     Preds (1): B8
-// CHECK:     Succs (2): B5 B6
+// CHECK:     Succs (1): B5
+// CHECK:   [B8]
+// CHECK:     1: A() (CXXConstructExpr, class A)
+// CHECK:     2: [B8.1] (BindTemporary)
+// CHECK:     3: [B8.2].operator bool
+// CHECK:     4: [B8.2]
+// CHECK:     5: [B8.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
+// CHECK:     T: [B8.5] ? ... : ...
+// CHECK:     Preds (1): B9
+// CHECK:     Succs (2): B6 B7
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (1): B1
-// CHECK:   [B13 (ENTRY)]
-// CHECK:     Succs (1): B12
+// CHECK:   [B14 (ENTRY)]
+// CHECK:     Succs (1): B13
 // CHECK:   [B1]
-// CHECK:     1: ~A() (Temporary object destructor)
-// CHECK:     2: int b;
-// CHECK:     3: [B9.4].~A() (Implicit destructor)
+// CHECK:     1: int b;
+// CHECK:     2: [B10.4].~A() (Implicit destructor)
 // CHECK:     Preds (2): B2 B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B2]
 // CHECK:     1: ~A() (Temporary object destructor)
-// CHECK:     Preds (1): B4
+// CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B1
 // CHECK:   [B3]
+// CHECK:     T: (Temp Dtor) [B6.4]
+// CHECK:     Preds (2): B4 B5
+// CHECK:     Succs (2): B2 B1
+// CHECK:   [B4]
 // CHECK:     1: ~A() (Temporary object destructor)
 // CHECK:     2: ~A() (Temporary object destructor)
-// CHECK:     Preds (1): B4
-// CHECK:     Succs (1): B1
-// CHECK:   [B4]
-// CHECK:     1: [B7.5] ?: [B6.6]
-// CHECK:     2: [B4.1] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     3: [B4.2]
-// CHECK:     4: [B7.3]([B4.3])
-// CHECK:     T: (Temp Dtor) [B7.8] ? ... : ...
-// CHECK:     Preds (2): B5 B6
-// CHECK:     Succs (2): B2 B3
+// CHECK:     Preds (1): B5
+// CHECK:     Succs (1): B3
 // CHECK:   [B5]
-// CHECK:     1: [B7.5] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     2: [B5.1]
-// CHECK:     3: [B5.2] (CXXConstructExpr, class A)
-// CHECK:     4: [B5.3] (BindTemporary)
-// CHECK:     Preds (1): B7
-// CHECK:     Succs (1): B4
+// CHECK:     1: [B8.4] ?: [B7.6]
+// CHECK:     2: [B5.1] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     3: [B5.2]
+// CHECK:     4: [B8.2]([B5.3])
+// CHECK:     T: (Temp Dtor) [B7.2]
+// CHECK:     Preds (2): B6 B7
+// CHECK:     Succs (2): B4 B3
 // CHECK:   [B6]
-// CHECK:     1: A() (CXXConstructExpr, class A)
-// CHECK:     2: [B6.1] (BindTemporary)
-// CHECK:     3: [B6.2] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     4: [B6.3]
-// CHECK:     5: [B6.4] (CXXConstructExpr, class A)
-// CHECK:     6: [B6.5] (BindTemporary)
-// CHECK:     Preds (1): B7
-// CHECK:     Succs (1): B4
+// CHECK:     1: [B8.4] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     2: [B6.1]
+// CHECK:     3: [B6.2] (CXXConstructExpr, class A)
+// CHECK:     4: [B6.3] (BindTemporary)
+// CHECK:     Preds (1): B8
+// CHECK:     Succs (1): B5
 // CHECK:   [B7]
-// CHECK:     1: ~A() (Temporary object destructor)
-// CHECK:     2: foo
-// CHECK:     3: [B7.2] (ImplicitCastExpr, FunctionToPointerDecay, void (*)(const class A &))
-// CHECK:     4: A() (CXXConstructExpr, class A)
-// CHECK:     5: [B7.4] (BindTemporary)
-// CHECK:     6: [B7.5].operator bool
-// CHECK:     7: [B7.5]
-// CHECK:     8: [B7.7] (ImplicitCastExpr, UserDefinedConversion, _Bool)
-// CHECK:     T: [B7.8] ? ... : ...
-// CHECK:     Preds (2): B9 B8
-// CHECK:     Succs (2): B5 B6
+// CHECK:     1: A() (CXXConstructExpr, class A)
+// CHECK:     2: [B7.1] (BindTemporary)
+// CHECK:     3: [B7.2] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     4: [B7.3]
+// CHECK:     5: [B7.4] (CXXConstructExpr, class A)
+// CHECK:     6: [B7.5] (BindTemporary)
+// CHECK:     Preds (1): B8
+// CHECK:     Succs (1): B5
 // CHECK:   [B8]
-// CHECK:     1: ~A() (Temporary object destructor)
-// CHECK:     Preds (1): B9
-// CHECK:     Succs (1): B7
+// CHECK:     1: foo
+// CHECK:     2: [B8.1] (ImplicitCastExpr, FunctionToPointerDecay, void (*)(const class A &))
+// CHECK:     3: A() (CXXConstructExpr, class A)
+// CHECK:     4: [B8.3] (BindTemporary)
+// CHECK:     5: [B8.4].operator bool
+// CHECK:     6: [B8.4]
+// CHECK:     7: [B8.6] (ImplicitCastExpr, UserDefinedConversion, _Bool)
+// CHECK:     T: [B8.7] ? ... : ...
+// CHECK:     Preds (2): B9 B10
+// CHECK:     Succs (2): B6 B7
 // CHECK:   [B9]
-// CHECK:     1: [B12.2] ?: [B11.6]
-// CHECK:     2: [B9.1] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     3: [B9.2]
-// CHECK:     4: const A &a = A() ?: A();
-// CHECK:     T: (Temp Dtor) [B12.5] ? ... : ...
-// CHECK:     Preds (2): B10 B11
-// CHECK:     Succs (2): B7 B8
+// CHECK:     1: ~A() (Temporary object destructor)
+// CHECK:     Preds (1): B10
+// CHECK:     Succs (1): B8
 // CHECK:   [B10]
-// CHECK:     1: [B12.2] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     2: [B10.1]
-// CHECK:     3: [B10.2] (CXXConstructExpr, class A)
-// CHECK:     4: [B10.3] (BindTemporary)
-// CHECK:     Preds (1): B12
-// CHECK:     Succs (1): B9
+// CHECK:     1: [B13.2] ?: [B12.6]
+// CHECK:     2: [B10.1] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     3: [B10.2]
+// CHECK:     4: const A &a = A() ?: A();
+// CHECK:     T: (Temp Dtor) [B12.2]
+// CHECK:     Preds (2): B11 B12
+// CHECK:     Succs (2): B9 B8
 // CHECK:   [B11]
-// CHECK:     1: A() (CXXConstructExpr, class A)
-// CHECK:     2: [B11.1] (BindTemporary)
-// CHECK:     3: [B11.2] (ImplicitCastExpr, NoOp, const class A)
-// CHECK:     4: [B11.3]
-// CHECK:     5: [B11.4] (CXXConstructExpr, class A)
-// CHECK:     6: [B11.5] (BindTemporary)
-// CHECK:     Preds (1): B12
-// CHECK:     Succs (1): B9
+// CHECK:     1: [B13.2] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     2: [B11.1]
+// CHECK:     3: [B11.2] (CXXConstructExpr, class A)
+// CHECK:     4: [B11.3] (BindTemporary)
+// CHECK:     Preds (1): B13
+// CHECK:     Succs (1): B10
 // CHECK:   [B12]
 // CHECK:     1: A() (CXXConstructExpr, class A)
 // CHECK:     2: [B12.1] (BindTemporary)
-// CHECK:     3: [B12.2].operator bool
-// CHECK:     4: [B12.2]
-// CHECK:     5: [B12.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
-// CHECK:     T: [B12.5] ? ... : ...
+// CHECK:     3: [B12.2] (ImplicitCastExpr, NoOp, const class A)
+// CHECK:     4: [B12.3]
+// CHECK:     5: [B12.4] (CXXConstructExpr, class A)
+// CHECK:     6: [B12.5] (BindTemporary)
 // CHECK:     Preds (1): B13
-// CHECK:     Succs (2): B10 B11
+// CHECK:     Succs (1): B10
+// CHECK:   [B13]
+// CHECK:     1: A() (CXXConstructExpr, class A)
+// CHECK:     2: [B13.1] (BindTemporary)
+// CHECK:     3: [B13.2].operator bool
+// CHECK:     4: [B13.2]
+// CHECK:     5: [B13.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
+// CHECK:     T: [B13.5] ? ... : ...
+// CHECK:     Preds (1): B14
+// CHECK:     Succs (2): B11 B12
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (1): B1
 // CHECK:   [B2 (ENTRY)]
 // CHECK:     Succs (1): B1
 // CHECK:   [B1]
 // CHECK:     1: A() (CXXConstructExpr, class A)
 // CHECK:     2: [B1.1] (BindTemporary)
 // CHECK:     3: [B1.2] (ImplicitCastExpr, NoOp, const class A)

 // CHECK:     Preds (1): B2
 // CHECK:     Succs (1): B0
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (1): B1
 // CHECK:   [B3 (ENTRY)]
 // CHECK:     Succs (1): B2
 // CHECK:   [B1]
 // CHECK:     1: int b;
+// CHECK:     Preds (1): B2(Unreachable)
 // CHECK:     Succs (1): B0
 // CHECK:   [B2 (NORETURN)]
 // CHECK:     1: int a;
 // CHECK:     2: NoReturn() (CXXConstructExpr, class NoReturn)
 // CHECK:     3: [B2.2] (BindTemporary)
 // CHECK:     4: [B2.3].f
 // CHECK:     5: [B2.4]()
 // CHECK:     6: ~NoReturn() (Temporary object destructor)
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (2): B1 B2
 // CHECK:   [B3 (ENTRY)]
 // CHECK:     Succs (1): B2
 // CHECK:   [B1]
 // CHECK:     1: int b;
+// CHECK:     Preds (1): B2(Unreachable)
 // CHECK:     Succs (1): B0
 // CHECK:   [B2 (NORETURN)]
 // CHECK:     1: int a;
 // CHECK:     2: NoReturn() (CXXConstructExpr, class NoReturn)
 // CHECK:     3: [B2.2] (BindTemporary)
 // CHECK:     4: 47
 // CHECK:     5: ... , [B2.4]
 // CHECK:     6: ~NoReturn() (Temporary object destructor)
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (2): B1 B2
-// CHECK:  int testConsistencyNestedSimple(bool value)
 // CHECK:   [B9 (ENTRY)]
 // CHECK:     Succs (1): B8
 // CHECK:   [B1]
 // CHECK:     1: 0
 // CHECK:     2: return [B1.1];
 // CHECK:     Preds (2): B3 B8
 // CHECK:     Succs (1): B0
 // CHECK:   [B2]
 // CHECK:     1: 1
 // CHECK:     2: return [B2.1];
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B3]
 // CHECK:     T: if [B5.1]
-// CHECK:     Preds (1): B5
+// CHECK:     Preds (2): B4(Unreachable) B5
 // CHECK:     Succs (2): B2 B1
 // CHECK:   [B4 (NORETURN)]
 // CHECK:     1: ~NoReturn() (Temporary object destructor)
 // CHECK:     Preds (1): B5
 // CHECK:     Succs (1): B0
 // CHECK:   [B5]
 // CHECK:     1: [B7.3] || [B6.7]
-// CHECK:     T: (Temp Dtor) [B7.3] || ...
+// CHECK:     T: (Temp Dtor) [B6.4]
 // CHECK:     Preds (2): B6 B7
-// CHECK:     Succs (2): B3 B4
+// CHECK:     Succs (2): B4 B3
 // CHECK:   [B6]
 // CHECK:     1: check
 // CHECK:     2: [B6.1] (ImplicitCastExpr, FunctionToPointerDecay, _Bool (*)(const class NoReturn &))
 // CHECK:     3: NoReturn() (CXXConstructExpr, class NoReturn)
 // CHECK:     4: [B6.3] (BindTemporary)
 // CHECK:     5: [B6.4] (ImplicitCastExpr, NoOp, const class NoReturn)
 // CHECK:     6: [B6.5]
 // CHECK:     7: [B6.2]([B6.6])

 // CHECK:   [B8]
 // CHECK:     1: value
 // CHECK:     2: [B8.1] (ImplicitCastExpr, LValueToRValue, _Bool)
 // CHECK:     T: if [B8.2]
 // CHECK:     Preds (1): B9
 // CHECK:     Succs (2): B7 B1
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (3): B1 B2 B4
-// CHECK:  int testConsistencyNestedComplex(bool value)
 // CHECK:   [B10 (ENTRY)]
 // CHECK:     Succs (1): B9
 // CHECK:   [B1]
 // CHECK:     1: 0
 // CHECK:     2: return [B1.1];
 // CHECK:     Preds (2): B3 B9
 // CHECK:     Succs (1): B0
 // CHECK:   [B2]
 // CHECK:     1: 1
 // CHECK:     2: return [B2.1];
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B3]
 // CHECK:     T: if [B5.1]
-// CHECK:     Preds (1): B5
+// CHECK:     Preds (2): B4(Unreachable) B5
 // CHECK:     Succs (2): B2 B1
 // CHECK:   [B4 (NORETURN)]
 // CHECK:     1: ~NoReturn() (Temporary object destructor)
 // CHECK:     Preds (1): B5
 // CHECK:     Succs (1): B0
 // CHECK:   [B5]
 // CHECK:     1: [B8.3] || [B7.3] || [B6.7]
-// CHECK:     T: (Temp Dtor) [B8.3] || [B7.3] || ...
+// CHECK:     T: (Temp Dtor) [B6.4]
 // CHECK:     Preds (3): B6 B7 B8
-// CHECK:     Succs (2): B3 B4
+// CHECK:     Succs (2): B4 B3
 // CHECK:   [B6]
 // CHECK:     1: check
 // CHECK:     2: [B6.1] (ImplicitCastExpr, FunctionToPointerDecay, _Bool (*)(const class NoReturn &))
 // CHECK:     3: NoReturn() (CXXConstructExpr, class NoReturn)
 // CHECK:     4: [B6.3] (BindTemporary)
 // CHECK:     5: [B6.4] (ImplicitCastExpr, NoOp, const class NoReturn)
 // CHECK:     6: [B6.5]
 // CHECK:     7: [B6.2]([B6.6])

 // CHECK:   [B9]
 // CHECK:     1: value
 // CHECK:     2: [B9.1] (ImplicitCastExpr, LValueToRValue, _Bool)
 // CHECK:     T: if [B9.2]
 // CHECK:     Preds (1): B10
 // CHECK:     Succs (2): B8 B1
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (3): B1 B2 B4
-// CHECK:  int testConsistencyNestedNormalReturn(bool value)
 // CHECK:   [B10 (ENTRY)]
 // CHECK:     Succs (1): B9
 // CHECK:   [B1]
 // CHECK:     1: 0
 // CHECK:     2: return [B1.1];
 // CHECK:     Preds (2): B3 B9
 // CHECK:     Succs (1): B0
 // CHECK:   [B2]
 // CHECK:     1: 1
 // CHECK:     2: return [B2.1];
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B3]
 // CHECK:     T: if [B5.1]
-// CHECK:     Preds (1): B5
+// CHECK:     Preds (2): B4(Unreachable) B5
 // CHECK:     Succs (2): B2 B1
 // CHECK:   [B4 (NORETURN)]
 // CHECK:     1: ~NoReturn() (Temporary object destructor)
 // CHECK:     Preds (1): B5
 // CHECK:     Succs (1): B0
 // CHECK:   [B5]
 // CHECK:     1: [B8.3] || [B7.2] || [B6.7]
-// CHECK:     T: (Temp Dtor) [B8.3] || [B7.2] || ...
+// CHECK:     T: (Temp Dtor) [B6.4]
 // CHECK:     Preds (3): B6 B7 B8
-// CHECK:     Succs (2): B3 B4
+// CHECK:     Succs (2): B4 B3
 // CHECK:   [B6]
 // CHECK:     1: check
 // CHECK:     2: [B6.1] (ImplicitCastExpr, FunctionToPointerDecay, _Bool (*)(const class NoReturn &))
 // CHECK:     3: NoReturn() (CXXConstructExpr, class NoReturn)
 // CHECK:     4: [B6.3] (BindTemporary)
 // CHECK:     5: [B6.4] (ImplicitCastExpr, NoOp, const class NoReturn)
 // CHECK:     6: [B6.5]
 // CHECK:     7: [B6.2]([B6.6])

test/Analysis/temporaries.cpp

 // RUN: %clang_cc1 -analyze -analyzer-checker=core,debug.ExprInspection -verify -w -std=c++03 %s
 // RUN: %clang_cc1 -analyze -analyzer-checker=core,debug.ExprInspection -verify -w -std=c++11 %s
-// RUN: %clang_cc1 -analyze -analyzer-checker=core,debug.ExprInspection -DTEMPORARY_DTORS -verify -w -analyzer-config cfg-temporary-dtors=true %s 
+// RUN: %clang_cc1 -analyze -analyzer-checker=core,debug.ExprInspection -DTEMPORARY_DTORS -verify -w -analyzer-config cfg-temporary-dtors=true %s -std=c++11
 
 extern bool clang_analyzer_eval(bool);
+extern bool clang_analyzer_warnIfReached();
 
 struct Trivial {
   Trivial(int x) : value(x) {}
   int value;
 };
 
 struct NonTrivial : public Trivial {
   NonTrivial(int x) : Trivial(x) {}
#if __cplusplus >= 201103L
     // FIXME: should be TRUE, but we don't inline the constructors of
     // temporaries because we can't model their destructors yet.
     clang_analyzer_eval(((HasCtorDtor){1, 42}).y == 42); // expected-warning{{UNKNOWN}}
 #endif
   }
 }
 
 namespace destructors {
-  void testPR16664andPR18159Crash() {
-    struct Dtor {
-      ~Dtor();
-    };
-    extern bool coin();
-    extern bool check(const Dtor &);
 
+  void testPR16664andPR18159Crash() {
     // Regression test: we used to assert here when tmp dtors are enabled.
     // PR16664 and PR18159
     if (coin() && (coin() || coin() || check(Dtor()))) {
       Dtor();
     }
   }
 
 #ifdef TEMPORARY_DTORS
if (compute(i == 5 &&
         i != 4) {
       clang_analyzer_eval(true);  // expected-warning{{TRUE}}
     }
 
     if (compute(i == 5 &&
                 (i == 4 || i == 4 ||
                  compute(i == 5 && (i == 4 || check(NoReturnDtor()))))) ||
         i != 4) {
-      // FIXME: This shouldn't cause a warning.
-      clang_analyzer_eval(true);  // expected-warning{{TRUE}}
+      clang_analyzer_eval(true);  // no warning, unreachable code
     }
   }
 
   // PR16664 and PR18159
   void testConsistencyNestedSimple(bool value) {
     if (value) {
       if (!value || check(NoReturnDtor())) {
         clang_analyzer_eval(true); // no warning, unreachable code
       }
     }
   }
 
   // PR16664 and PR18159
   void testConsistencyNestedComplex(bool value) {
     if (value) {
       if (!value || !value || check(NoReturnDtor())) {
-        // FIXME: This shouldn't cause a warning.
-        clang_analyzer_eval(true); // expected-warning{{TRUE}}
+        clang_analyzer_eval(true);  // no warning, unreachable code
       }
     }
   }
 
   // PR16664 and PR18159
   void testConsistencyNestedWarning(bool value) {
     if (value) {
       if (!value || value || check(NoReturnDtor())) {
         clang_analyzer_eval(true); // expected-warning{{TRUE}}
       }
     }
   }
+  // PR16664 and PR18159
+  void testConsistencyNestedComplexMidBranch(bool value) {
+    if (value) {
+      if (!value || !value || check(NoReturnDtor()) || value) {
+        clang_analyzer_eval(true);  // no warning, unreachable code
+      }
+    }
+  }
+
+  // PR16664 and PR18159
+  void testConsistencyNestedComplexNestedBranch(bool value) {
+    if (value) {
+      if (!value || (!value || check(NoReturnDtor()) || value)) {
+        clang_analyzer_eval(true);  // no warning, unreachable code
+      }
+    }
+  }
+
+  // PR16664 and PR18159
+  void testConsistencyNestedVariableModification(bool value) {
+    bool other = true;
+    if (value) {
+      if (!other || !value || (other = false) || check(NoReturnDtor()) ||
+          !other) {
+        clang_analyzer_eval(true);  // no warning, unreachable code
+      }
+    }
+  }
+
+  void testTernaryNoReturnTrueBranch(bool value) {
+    if (value) {
+      bool b = value && value ? check(NoReturnDtor()) : true;
+      clang_analyzer_eval(true);  // no warning, unreachable code
+    }
+  }
+  void testTernaryNoReturnFalseBranch(bool value) {
+    if (value) {
+      bool b = !value && !value ? true : check(NoReturnDtor());
+      clang_analyzer_eval(true);  // no warning, unreachable code
+    }
+  }
+  void testTernaryIgnoreNoreturnBranch(bool value) {
+    if (value) {
+      bool b = !value && !value ? check(NoReturnDtor()) : true;
+      clang_analyzer_eval(true);  // expected-warning{{TRUE}}
+    }
+  }
+
+  void testLoop() {
+    for (int i = 0; i < 10; ++i) {
+      if (i < 3 && (i >= 2 || check(NoReturnDtor()))) {
+        clang_analyzer_eval(true);  // no warning, unreachable code
+      }
+    }
+  }
+
+  bool testRecursiveFrames(bool isInner) {
+    if (isInner ||
+        (clang_analyzer_warnIfReached(), false) || // expected-warning{{REACHABLE}}
+        check(NoReturnDtor()) ||
+        testRecursiveFrames(true)) {
+      clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
+    }
+  }
+  void testRecursiveFramesStart() { testRecursiveFrames(false); }
+
+  void testLambdas() {
+    // This is the test we would like to write:
+    // []() { check(NoReturnDtor()); } != nullptr || check(Dtor());
+    // But currently the analyzer stops when it encounters a lambda:
+    [] {};
+    // The CFG for this now looks correct, but we still do not reach the line
+    // below.
+    clang_analyzer_warnIfReached(); // FIXME: Should warn.
+  }
+
+  void testGnuExpressionStatements(int v) {
+    ({ ++v; v == 10 || check(NoReturnDtor()); v == 42; }) || v == 23;
+    clang_analyzer_warnIfReached();  // expected-warning{{REACHABLE}}
+
+    ({ ++v; check(NoReturnDtor()); v == 42; }) || v == 23;
+    clang_analyzer_warnIfReached();  // no warning, unreachable code
+  }
+
+  void testGnuExpressionStatementsDestructionPoint(int v) {
+    // In normal context, the temporary destructor runs at the end of the full
+    // statement, thus the last statement is reached.
+    (++v, check(NoReturnDtor()), v == 42),
+        clang_analyzer_warnIfReached();  // expected-warning{{REACHABLE}}
+
+    // GNU expression statements execute temporary destructors within the
+    // blocks, thus the last statement is not reached.
+    ({ ++v; check(NoReturnDtor()); v == 42; }),
+        clang_analyzer_warnIfReached();  // no warning, unreachable code
+  }
+
+  void testMultipleTemporaries(bool value) {
+    if (value) {
+      // FIXME: Find a way to verify construction order.
+      // ~Dtor should run before ~NoReturnDtor() because construction order is
+      // guaranteed by comma operator.
+      if (!value || check((NoReturnDtor(), Dtor())) || value) {
+        clang_analyzer_eval(true);  // no warning, unreachable code
+      }
+    }
+  }
 
   void testBinaryOperatorShortcut(bool value) {
     if (value) {
       if (false && false && check(NoReturnDtor()) && true) {
         clang_analyzer_eval(true);
       }
     }
   }
 
+  void testIfAtEndOfLoop() {
+    int y = 0;
+    while (true) {
+      if (y > 0) {
+        clang_analyzer_warnIfReached();  // expected-warning{{REACHABLE}}
+      }
+      ++y;
+      // Test that the CFG gets hooked up correctly when temporary destructors
+      // are handled after a statically known branch condition.
+      if (true) (void)0; else (void)check(NoReturnDtor());
+    }
+  }
+
+  void testTernaryAtEndOfLoop() {
+    int y = 0;
+    while (true) {
+      if (y > 0) {
+        clang_analyzer_warnIfReached();  // expected-warning{{REACHABLE}}
+      }
+      ++y;
+      // Test that the CFG gets hooked up correctly when temporary destructors
+      // are handled after a statically known branch condition.
+      true ? (void)0 : (void)check(NoReturnDtor());
+    }
+  }
+
+  void testNoReturnInComplexCondition() {
+    check(Dtor()) &&
+        (check(NoReturnDtor()) || check(NoReturnDtor())) && check(Dtor());
+    clang_analyzer_warnIfReached();  // expected-warning{{REACHABLE}}
+  }
+
+  void testSequencingOfConditionalTempDtors(bool b) {
+    b || (check(Dtor()), check(NoReturnDtor()));
+    clang_analyzer_warnIfReached();  // expected-warning{{REACHABLE}}
+  }
+
+  void testSequencingOfConditionalTempDtors2(bool b) {
+    (b || check(Dtor())), check(NoReturnDtor());
+    clang_analyzer_warnIfReached();  // no warning, unreachable code
+  }
+
+  void testSequencingOfConditionalTempDtorsWithinBinaryOperators(bool b) {
+    b || (check(Dtor()) + check(NoReturnDtor()));
+    clang_analyzer_warnIfReached();  // expected-warning{{REACHABLE}}
+  }
 #endif // TEMPORARY_DTORS
 }
 
 void testStaticMaterializeTemporaryExpr() {
   static const Trivial &ref = getTrivial();
   clang_analyzer_eval(ref.value == 42); // expected-warning{{TRUE}}
 
   static const Trivial &directRef = Trivial(42);