[clang][dataflow] Add transfer functions for constructors

[sgatev]

Summary

This is part of the implementation of the dataflow analysis framework.
See "[RFC] A dataflow analysis framework for Clang AST" on cfe-dev.

[xazax.hun]

clang/lib/Analysis/FlowSensitive/Transfer.cpp

114

An alternative way to handle Noop operations would be to make location lookup function always skip certain nodes, so we do not need to store locations for those subexpressions. I don't have a strong feeling for either solution, this is fine as it is, just wanted to be sure that both were considered.

280

Interesting, I only see isCallToStdMove in the CallExpr API, although I imagine, std::forward has a similar level of importance.

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

40

Shouldn't we piggyback on clang::LangStandard::Kind? If it is not easy to convert that to the appropriate command line flag feel free to ignore this.

[sgatev]

Address reviewers' comments.

[sgatev]

clang/lib/Analysis/FlowSensitive/Transfer.cpp

114

It makes sense to consider it. Right now I don't have signals that one is better than the other. I think the current implementation fits the general model a bit better. Nevertheless, I added a FIXME to keep this option in mind.

280

I haven't looked into std::forward yet, but happy to do that in the next patch.

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

40

Makes sense. Thanks for pointing this out!

[xazax.hun]

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

1362

I think this changed from 14 to 17 in the last revision. Is this intentional?

[sgatev]

Address reviewers' comments.

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

1362

Not intentional. Thanks for catching it!

[ymandel]

clang/lib/Analysis/FlowSensitive/Transfer.cpp

105

use a switch?

[sgatev]

Address reviewers' comments.

[sgatev]

clang/lib/Analysis/FlowSensitive/Transfer.cpp

105

Refactored to use a switch.

clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp

StorageLocation *Environment::getStorageLocation(const Expr &E,
   auto It = ExprToLoc.find(&E);
   return It == ExprToLoc.end() ? nullptr : &skip(*It->second, SP);
 }
 
 StorageLocation *Environment::getThisPointeeStorageLocation() const {
   return DACtx->getThisPointeeStorageLocation();
 }
 
-void Environment::setValue(const StorageLocation &Loc, Value &Value) {
-  LocToVal[&Loc] = &Value;
+void Environment::setValue(const StorageLocation &Loc, Value &Val) {
+  LocToVal[&Loc] = &Val;
+
+  if (auto *StructVal = dyn_cast<StructValue>(&Val)) {
+    auto &AggregateLoc = *cast<AggregateStorageLocation>(&Loc);
+
+    const QualType Type = AggregateLoc.getType();
+    assert(Type->isStructureOrClassType());
+
+    for (const FieldDecl *Field : Type->getAsRecordDecl()->fields()) {
+      assert(Field != nullptr);
+      setValue(AggregateLoc.getChild(*Field), StructVal->getChild(*Field));
+    }
+  }
 }
 
 Value *Environment::getValue(const StorageLocation &Loc) const {
   auto It = LocToVal.find(&Loc);
   return It == LocToVal.end() ? nullptr : It->second;
 }
 
 Value *Environment::getValue(const ValueDecl &D, SkipPast SP) const {

clang/lib/Analysis/FlowSensitive/Transfer.cpp

 //===-- Transfer.cpp --------------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines transfer functions that evaluate program statements and
 //  update an environment accordingly.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/Analysis/FlowSensitive/Transfer.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/DeclBase.h"
+#include "clang/AST/DeclCXX.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/OperationKinds.h"
 #include "clang/AST/Stmt.h"
 #include "clang/AST/StmtVisitor.h"
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
 #include "clang/Basic/OperatorKinds.h"
 #include "llvm/Support/Casting.h"
 #include <cassert>
 #include <memory>
 
 namespace clang {
 namespace dataflow {
 
+static const Expr *skipExprWithCleanups(const Expr *E) {
+  if (auto *C = dyn_cast_or_null<ExprWithCleanups>(E))
+    return C->getSubExpr();
+  return E;
+}
+
 class TransferVisitor : public ConstStmtVisitor<TransferVisitor> {
 public:
   TransferVisitor(Environment &Env) : Env(Env) {}
 
   void VisitBinaryOperator(const BinaryOperator *S) {
     if (S->getOpcode() == BO_Assign) {
       // The CFG does not contain `ParenExpr` as top-level statements in basic
       // blocks, however sub-expressions can still be of that type.
void VisitDeclStmt(const DeclStmt *S) {
     if (S->isSingleDecl()) {
       if (const auto *D = dyn_cast<VarDecl>(S->getSingleDecl())) {
         visitVarDecl(*D);
       }
     }
   }
 
   void VisitImplicitCastExpr(const ImplicitCastExpr *S) {
-    if (S->getCastKind() == CK_LValueToRValue) {
-      // The CFG does not contain `ParenExpr` as top-level statements in basic
-      // blocks, however sub-expressions can still be of that type.
-      assert(S->getSubExpr() != nullptr);
-      const Expr *SubExpr = S->getSubExpr()->IgnoreParens();
-
-      assert(SubExpr != nullptr);
+
+    if (S->getCastKind() == CK_LValueToRValue) {
       auto *SubExprVal = Env.getValue(*SubExpr, SkipPast::Reference);
       if (SubExprVal == nullptr)
         return;
 
       auto &ExprLoc = Env.createStorageLocation(*S);
       Env.setStorageLocation(*S, ExprLoc);
       Env.setValue(ExprLoc, *SubExprVal);
+    } else if (S->getCastKind() == CK_NoOp) {
+      // FIXME: Consider making `Environment::getStorageLocation` skip noop
+      // expressions (this and other similar expressions in the file) instead of
+      // assigning them storage locations.
+      auto *SubExprLoc = Env.getStorageLocation(*SubExpr, SkipPast::None);
+      if (SubExprLoc == nullptr)
+        return;
+
+      Env.setStorageLocation(*S, *SubExprLoc);
     }
     // FIXME: Add support for CK_NoOp, CK_UserDefinedConversion,
     // CK_ConstructorConversion, CK_UncheckedDerivedToBase.
   }
 
   void VisitUnaryOperator(const UnaryOperator *S) {
     if (S->getOpcode() == UO_Deref) {
       assert(S->getSubExpr() != nullptr);
void VisitCXXDefaultInitExpr(const CXXDefaultInitExpr *S) {
     assert(Field != nullptr);
 
     auto &ThisLoc =
         *cast<AggregateStorageLocation>(Env.getThisPointeeStorageLocation());
     auto &FieldLoc = ThisLoc.getChild(*Field);
     Env.setValue(FieldLoc, *InitExprVal);
   }
 
+  void VisitCXXConstructExpr(const CXXConstructExpr *S) {
+    const CXXConstructorDecl *ConstructorDecl = S->getConstructor();
+    assert(ConstructorDecl != nullptr);
+
+    if (ConstructorDecl->isCopyOrMoveConstructor()) {
+      assert(S->getNumArgs() == 1);
+
+      const Expr *Arg = S->getArg(0);
+      assert(Arg != nullptr);
+
+      if (S->isElidable()) {
+        auto *ArgLoc = Env.getStorageLocation(*Arg, SkipPast::Reference);
+        if (ArgLoc == nullptr)
+          return;
+
+        Env.setStorageLocation(*S, *ArgLoc);
+      } else if (auto *ArgVal = Env.getValue(*Arg, SkipPast::Reference)) {
+        auto &Loc = Env.createStorageLocation(*S);
+        Env.setStorageLocation(*S, Loc);
+        Env.setValue(Loc, *ArgVal);
+      }
+      return;
+    }
+
+    auto &Loc = Env.createStorageLocation(*S);
+    Env.setStorageLocation(*S, Loc);
+    Env.initValueInStorageLocation(Loc, S->getType());
+  }
+
+  void VisitCXXOperatorCallExpr(const CXXOperatorCallExpr *S) {
+    if (S->getOperator() == OO_Equal) {
+      assert(S->getNumArgs() == 2);
+
+      const Expr *Arg0 = S->getArg(0);
+      assert(Arg0 != nullptr);
+
+      const Expr *Arg1 = S->getArg(1);
+      assert(Arg1 != nullptr);
+
+      // Evaluate only copy and move assignment operators.
+      auto *Arg0Type = Arg0->getType()->getUnqualifiedDesugaredType();
+      auto *Arg1Type = Arg1->getType()->getUnqualifiedDesugaredType();
+      if (Arg0Type != Arg1Type)
+        return;
+
+      auto *ObjectLoc = Env.getStorageLocation(*Arg0, SkipPast::Reference);
+      if (ObjectLoc == nullptr)
+        return;
+
+      auto *Val = Env.getValue(*Arg1, SkipPast::Reference);
+      if (Val == nullptr)
+        return;
+
+      Env.setValue(*ObjectLoc, *Val);
+    }
+  }
+
+  void VisitCXXFunctionalCastExpr(const CXXFunctionalCastExpr *S) {
+    if (S->getCastKind() == CK_ConstructorConversion) {
+      // The CFG does not contain `ParenExpr` as top-level statements in basic
+      // blocks, however sub-expressions can still be of that type.
+      assert(S->getSubExpr() != nullptr);
+      const Expr *SubExpr = S->getSubExpr();
+      assert(SubExpr != nullptr);
+
+      auto *SubExprLoc = Env.getStorageLocation(*SubExpr, SkipPast::None);
+      if (SubExprLoc == nullptr)
+        return;
+
+      Env.setStorageLocation(*S, *SubExprLoc);
+    }
+  }
+
+  void VisitCXXTemporaryObjectExpr(const CXXTemporaryObjectExpr *S) {
+    auto &Loc = Env.createStorageLocation(*S);
+    Env.setStorageLocation(*S, Loc);
+    Env.initValueInStorageLocation(Loc, S->getType());
+  }
+
+  void VisitCallExpr(const CallExpr *S) {
+    if (S->isCallToStdMove()) {
+      assert(S->getNumArgs() == 1);
+
+      const Expr *Arg = S->getArg(0);
+      assert(Arg != nullptr);
+
+      auto *ArgLoc = Env.getStorageLocation(*Arg, SkipPast::None);
+      if (ArgLoc == nullptr)
+        return;
+
+      Env.setStorageLocation(*S, *ArgLoc);
+    }
+  }
+
+  void VisitMaterializeTemporaryExpr(const MaterializeTemporaryExpr *S) {
+    const Expr *SubExpr = S->getSubExpr();
+    assert(SubExpr != nullptr);
+
+    auto *SubExprLoc = Env.getStorageLocation(*SubExpr, SkipPast::None);
+    if (SubExprLoc == nullptr)
+      return;
+
+    Env.setStorageLocation(*S, *SubExprLoc);
+  }
+
   // FIXME: Add support for:
-  // - CallExpr
   // - CXXBindTemporaryExpr
   // - CXXBoolLiteralExpr
-  // - CXXConstructExpr
-  // - CXXFunctionalCastExpr
-  // - CXXOperatorCallExpr
   // - CXXStaticCastExpr
-  // - MaterializeTemporaryExpr
 
 private:
   void visitVarDecl(const VarDecl &D) {
     auto &Loc = Env.createStorageLocation(D);
     Env.setStorageLocation(D, Loc);
 
     const Expr *InitExpr = D.getInit();
     if (InitExpr == nullptr) {
       // No initializer expression - associate `Loc` with a new value.
       Env.initValueInStorageLocation(Loc, D.getType());
       return;
     }
 
+    // The CFG does not contain `ParenExpr` as top-level statements in basic
+    // blocks, however sub-expressions can still be of that type.
+    InitExpr = skipExprWithCleanups(D.getInit()->IgnoreParens());
+    assert(InitExpr != nullptr);
+
     if (D.getType()->isReferenceType()) {
       // Initializing a reference variable - do not create a reference to
       // reference.
       if (auto *InitExprLoc =
               Env.getStorageLocation(*InitExpr, SkipPast::Reference)) {
         auto &Val =
             Env.takeOwnership(std::make_unique<ReferenceValue>(*InitExprLoc));
         Env.setValue(Loc, Val);
       } else {
         // FIXME: The initializer expression must always be assigned a value.
         // Replace this with an assert when we have sufficient coverage of
         // language features.
         Env.initValueInStorageLocation(Loc, D.getType());
       }
       return;
     }
 
     if (auto *InitExprVal = Env.getValue(*InitExpr, SkipPast::None)) {
       Env.setValue(Loc, *InitExprVal);
-    } else {
+    } else if (!D.getType()->isStructureOrClassType()) {
       // FIXME: The initializer expression must always be assigned a value.
       // Replace this with an assert when we have sufficient coverage of
       // language features.
       Env.initValueInStorageLocation(Loc, D.getType());
+    } else {
+      llvm_unreachable("structs and classes must always be assigned values");
     }
   }
 
   Environment &Env;
 };
 
 void transfer(const Stmt &S, Environment &Env) {
   assert(!isa<ParenExpr>(&S));
   TransferVisitor(Env).Visit(&S);
 }
 
 } // namespace dataflow
 } // namespace clang

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

 #include "TestingSupport.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Decl.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/ASTMatchers/ASTMatchers.h"
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
 #include "clang/Analysis/FlowSensitive/StorageLocation.h"
 #include "clang/Analysis/FlowSensitive/Value.h"
+#include "clang/Basic/LangStandard.h"
 #include "llvm/ADT/ArrayRef.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/Support/Casting.h"
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include <cassert>
 #include <string>
 #include <utility>
 
 namespace {
 
 using namespace clang;
 using namespace dataflow;
 using ::testing::_;
 using ::testing::ElementsAre;
 using ::testing::IsNull;
 using ::testing::NotNull;
 using ::testing::Pair;
 
 class TransferTest : public ::testing::Test {
 protected:
   template <typename Matcher>
-  void runDataflow(llvm::StringRef Code, Matcher Match) {
+  void runDataflow(llvm::StringRef Code, Matcher Match,
+                   LangStandard::Kind Std = LangStandard::lang_cxx17) {
     test::checkDataflow<NoopAnalysis>(
         Code, "target",
         [](ASTContext &C, Environment &) { return NoopAnalysis(C); },
         [&Match](llvm::ArrayRef<
                      std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
                      Results,
                  ASTContext &ASTCtx) { Match(Results, ASTCtx); },
-        {"-fsyntax-only", "-std=c++17"});
+        {"-fsyntax-only",
+         "-std=" +
+             std::string(LangStandard::getLangStandardForKind(Std).getName())});
   }
 };
 
 /// Returns the `ValueDecl` for the given identifier.
 ///
 /// Requirements:
 ///
 ///  `Name` must be unique in `ASTCtx`.
runDataflow(
         ASSERT_THAT(QuxDecl, NotNull());
 
         const auto *QuxVal =
             cast<ReferenceValue>(Env.getValue(*QuxDecl, SkipPast::None));
         EXPECT_EQ(&QuxVal->getPointeeLoc(), &FooVal->getPointeeLoc());
       });
 }
 
+TEST_F(TransferTest, TemporaryObject) {
+  std::string Code = R"(
+    struct A {
+      int Bar;
+    };
+
+    void target() {
+      A Foo = A();
+      // [[p]]
+    }
+  )";
+  runDataflow(
+      Code, [](llvm::ArrayRef<
+                   std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                   Results,
+               ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+        const Environment &Env = Results[0].second.Env;
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
+        ASSERT_THAT(BarDecl, NotNull());
+
+        const auto *FooLoc = cast<AggregateStorageLocation>(
+            Env.getStorageLocation(*FooDecl, SkipPast::None));
+        const auto *BarLoc =
+            cast<ScalarStorageLocation>(&FooLoc->getChild(*BarDecl));
+
+        const auto *FooVal = cast<StructValue>(Env.getValue(*FooLoc));
+        const auto *BarVal = cast<IntegerValue>(&FooVal->getChild(*BarDecl));
+        EXPECT_EQ(Env.getValue(*BarLoc), BarVal);
+      });
+}
+
+TEST_F(TransferTest, ElidableConstructor) {
+  // This test is effectively the same as TransferTest.TemporaryObject, but
+  // the code is compiled as C++ 14.
+  std::string Code = R"(
+    struct A {
+      int Bar;
+    };
+
+    void target() {
+      A Foo = A();
+      // [[p]]
+    }
+  )";
+  runDataflow(
+      Code,
+      [](llvm::ArrayRef<
+             std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+             Results,
+         ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+        const Environment &Env = Results[0].second.Env;
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
+        ASSERT_THAT(BarDecl, NotNull());
+
+        const auto *FooLoc = cast<AggregateStorageLocation>(
+            Env.getStorageLocation(*FooDecl, SkipPast::None));
+        const auto *BarLoc =
+            cast<ScalarStorageLocation>(&FooLoc->getChild(*BarDecl));
+
+        const auto *FooVal = cast<StructValue>(Env.getValue(*FooLoc));
+        const auto *BarVal = cast<IntegerValue>(&FooVal->getChild(*BarDecl));
+        EXPECT_EQ(Env.getValue(*BarLoc), BarVal);
+      },
+      LangStandard::lang_cxx17);
+}
+
+TEST_F(TransferTest, AssignmentOperator) {
+  std::string Code = R"(
+    struct A {
+      int Baz;
+    };
+
+    void target() {
+      A Foo;
+      A Bar;
+      // [[p1]]
+      Foo = Bar;
+      // [[p2]]
+    }
+  )";
+  runDataflow(
+      Code, [](llvm::ArrayRef<
+                   std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                   Results,
+               ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p1", _), Pair("p2", _)));
+        const Environment &Env1 = Results[0].second.Env;
+        const Environment &Env2 = Results[1].second.Env;
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
+        ASSERT_THAT(BarDecl, NotNull());
+
+        const ValueDecl *BazDecl = findValueDecl(ASTCtx, "Baz");
+        ASSERT_THAT(BazDecl, NotNull());
+
+        const auto *FooLoc1 = cast<AggregateStorageLocation>(
+            Env1.getStorageLocation(*FooDecl, SkipPast::None));
+        const auto *BarLoc1 = cast<AggregateStorageLocation>(
+            Env1.getStorageLocation(*BarDecl, SkipPast::None));
+
+        const auto *FooVal1 = cast<StructValue>(Env1.getValue(*FooLoc1));
+        const auto *BarVal1 = cast<StructValue>(Env1.getValue(*BarLoc1));
+        EXPECT_NE(FooVal1, BarVal1);
+
+        const auto *FooBazVal1 =
+            cast<IntegerValue>(Env1.getValue(FooLoc1->getChild(*BazDecl)));
+        const auto *BarBazVal1 =
+            cast<IntegerValue>(Env1.getValue(BarLoc1->getChild(*BazDecl)));
+        EXPECT_NE(FooBazVal1, BarBazVal1);
+
+        const auto *FooLoc2 = cast<AggregateStorageLocation>(
+            Env2.getStorageLocation(*FooDecl, SkipPast::None));
+        const auto *BarLoc2 = cast<AggregateStorageLocation>(
+            Env2.getStorageLocation(*BarDecl, SkipPast::None));
+
+        const auto *FooVal2 = cast<StructValue>(Env2.getValue(*FooLoc2));
+        const auto *BarVal2 = cast<StructValue>(Env2.getValue(*BarLoc2));
+        EXPECT_EQ(FooVal2, BarVal2);
+
+        const auto *FooBazVal2 =
+            cast<IntegerValue>(Env2.getValue(FooLoc1->getChild(*BazDecl)));
+        const auto *BarBazVal2 =
+            cast<IntegerValue>(Env2.getValue(BarLoc1->getChild(*BazDecl)));
+        EXPECT_EQ(FooBazVal2, BarBazVal2);
+      });
+}
+
+TEST_F(TransferTest, CopyConstructor) {
+  std::string Code = R"(
+    struct A {
+      int Baz;
+    };
+
+    void target() {
+      A Foo;
+      A Bar = Foo;
+      // [[p]]
+    }
+  )";
+  runDataflow(
+      Code, [](llvm::ArrayRef<
+                   std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                   Results,
+               ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+        const Environment &Env = Results[0].second.Env;
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
+        ASSERT_THAT(BarDecl, NotNull());
+
+        const ValueDecl *BazDecl = findValueDecl(ASTCtx, "Baz");
+        ASSERT_THAT(BazDecl, NotNull());
+
+        const auto *FooLoc = cast<AggregateStorageLocation>(
+            Env.getStorageLocation(*FooDecl, SkipPast::None));
+        const auto *BarLoc = cast<AggregateStorageLocation>(
+            Env.getStorageLocation(*BarDecl, SkipPast::None));
+
+        const auto *FooVal = cast<StructValue>(Env.getValue(*FooLoc));
+        const auto *BarVal = cast<StructValue>(Env.getValue(*BarLoc));
+        EXPECT_EQ(FooVal, BarVal);
+
+        const auto *FooBazVal =
+            cast<IntegerValue>(Env.getValue(FooLoc->getChild(*BazDecl)));
+        const auto *BarBazVal =
+            cast<IntegerValue>(Env.getValue(BarLoc->getChild(*BazDecl)));
+        EXPECT_EQ(FooBazVal, BarBazVal);
+      });
+}
+
+TEST_F(TransferTest, CopyConstructorWithParens) {
+  std::string Code = R"(
+    struct A {
+      int Baz;
+    };
+
+    void target() {
+      A Foo;
+      A Bar((A(Foo)));
+      // [[p]]
+    }
+  )";
+  runDataflow(
+      Code, [](llvm::ArrayRef<
+                   std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                   Results,
+               ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+        const Environment &Env = Results[0].second.Env;
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
+        ASSERT_THAT(BarDecl, NotNull());
+
+        const ValueDecl *BazDecl = findValueDecl(ASTCtx, "Baz");
+        ASSERT_THAT(BazDecl, NotNull());
+
+        const auto *FooLoc = cast<AggregateStorageLocation>(
+            Env.getStorageLocation(*FooDecl, SkipPast::None));
+        const auto *BarLoc = cast<AggregateStorageLocation>(
+            Env.getStorageLocation(*BarDecl, SkipPast::None));
+
+        const auto *FooVal = cast<StructValue>(Env.getValue(*FooLoc));
+        const auto *BarVal = cast<StructValue>(Env.getValue(*BarLoc));
+        EXPECT_EQ(FooVal, BarVal);
+
+        const auto *FooBazVal =
+            cast<IntegerValue>(Env.getValue(FooLoc->getChild(*BazDecl)));
+        const auto *BarBazVal =
+            cast<IntegerValue>(Env.getValue(BarLoc->getChild(*BazDecl)));
+        EXPECT_EQ(FooBazVal, BarBazVal);
+      });
+}
+
+TEST_F(TransferTest, MoveConstructor) {
+  std::string Code = R"(
+    namespace std {
+
+    template <typename T> struct remove_reference      { using type = T; };
+    template <typename T> struct remove_reference<T&>  { using type = T; };
+    template <typename T> struct remove_reference<T&&> { using type = T; };
+
+    template <typename T>
+    using remove_reference_t = typename remove_reference<T>::type;
+
+    template <typename T>
+    std::remove_reference_t<T>&& move(T&& x);
+
+    } // namespace std
+
+    struct A {
+      int Baz;
+    };
+
+    void target() {
+      A Foo;
+      A Bar;
+      // [[p1]]
+      Foo = std::move(Bar);
+      // [[p2]]
+    }
+  )";
+  runDataflow(
+      Code, [](llvm::ArrayRef<
+                   std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                   Results,
+               ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p1", _), Pair("p2", _)));
+        const Environment &Env1 = Results[0].second.Env;
+        const Environment &Env2 = Results[1].second.Env;
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
+        ASSERT_THAT(BarDecl, NotNull());
+
+        const ValueDecl *BazDecl = findValueDecl(ASTCtx, "Baz");
+        ASSERT_THAT(BazDecl, NotNull());
+
+        const auto *FooLoc1 = cast<AggregateStorageLocation>(
+            Env1.getStorageLocation(*FooDecl, SkipPast::None));
+        const auto *BarLoc1 = cast<AggregateStorageLocation>(
+            Env1.getStorageLocation(*BarDecl, SkipPast::None));
+
+        const auto *FooVal1 = cast<StructValue>(Env1.getValue(*FooLoc1));
+        const auto *BarVal1 = cast<StructValue>(Env1.getValue(*BarLoc1));
+        EXPECT_NE(FooVal1, BarVal1);
+
+        const auto *FooBazVal1 =
+            cast<IntegerValue>(Env1.getValue(FooLoc1->getChild(*BazDecl)));
+        const auto *BarBazVal1 =
+            cast<IntegerValue>(Env1.getValue(BarLoc1->getChild(*BazDecl)));
+        EXPECT_NE(FooBazVal1, BarBazVal1);
+
+        const auto *FooLoc2 = cast<AggregateStorageLocation>(
+            Env2.getStorageLocation(*FooDecl, SkipPast::None));
+        const auto *FooVal2 = cast<StructValue>(Env2.getValue(*FooLoc2));
+        EXPECT_EQ(FooVal2, BarVal1);
+
+        const auto *FooBazVal2 =
+            cast<IntegerValue>(Env2.getValue(FooLoc1->getChild(*BazDecl)));
+        EXPECT_EQ(FooBazVal2, BarBazVal1);
+      });
+}
+
 } // namespace