CFG: Add CFGElement for automatic variables that leave the scope

[mgehre]

Summary

This mimics the implementation for the implicit destructors. The
generation of this scope leaving elements is hidden behind
a flag to the CFGBuilder, thus it should not affect existing code.

[mgehre]

The lifetime checker that needs this is at D15032

[alexfh]

Richard, can you review this?

[rsmith]

Please add a test that builds and dumps a CFG and checks it has the right shape. It's generally not sufficient for the only tests for one LLVM project to exist in a different LLVM project. See test/Analysis/cfg.cpp for an example of how to do this.

include/clang/Analysis/CFG.h

170 ↗

(On Diff #41278)

What is this intended to model? There seem to be a few options here:

1. The point at which the destructor would run if the object had a non-trivial destructor
2. The point at which the storage duration for the underlying storage ends
3. The point at which the lifetime of the object ends

Note that these are all different -- for an object with a non-trivial destructor, (1) and (3) are the same and for any other object (2) and (3) are the same; (2) occurs after all destructors for the scope have run.

This matters for cases like:

void f() {
  struct A { int *p; ~A() { *p = 0; } } a;
  int n;
  a.p = &n;
}

Here, the lifetime of n would end before the lifetime of a if n had a non-trivial destructor. If ns lifetime actually ended there, this code would have undefined behavior. But because the destruction of n is trivial, the lifetime of n instead ends when its storage duration ends, which is *after* A's destructor runs, so the code is valid.

Please add a comment to this class to describe what it means.

728 ↗

(On Diff #41278)

Why must reverse order be used? It's not possible for the effects of these operations to interact with each other, is it? At least according to the C++ standard, the "end of storage duration" effects all occur simultaneously.

lib/Analysis/CFG.cpp

1233 ↗

(On Diff #41278)

thats -> that

1447 ↗

(On Diff #41278)

This will sometimes bail out without adding a scope; if both AddAutomaticObjLeavesScope and AddImplicitDtors are set, this seems like the wrong behavior. You should check for AddAutomaticObjLeavesScope first and unconditionally ensure there is a scope for that case.

1490–1491 ↗

(On Diff #41278)

This is not a mechanism for adding automatic destructors. This FIXME seems unnecessary.

1501 ↗

(On Diff #41278)

Bad indentation

[mgehre]

Thank you very much for your review. I'm sorry that I'm currently quite busy, but I will find some time to answer at the end of this week.

[a.sidorin]

Matthias,

Could you take a look at http://reviews.llvm.org/D16403? It looks like a duplicating work but it should cover not Objective-C only.

[mgehre]

include/clang/Analysis/CFG.h

170 ↗

(On Diff #41278)

The intend is to show the point after which it is undefined behavior to refer to an object, i.e.

3. The point at which the lifetime of the object ends

I will add a comment to clarify this. I propose to rename the class to "CFGLifetimeEnds", okay?

728 ↗

(On Diff #41278)

The order is important as you showed in your example above. The liftetime checker should be able to detect the undefined behavior in

struct B { B() {}; int n; };
void f() {
  struct A {B *p; ~A() { b->n = 0; } } a;
  B b;
  a.p = &b;
}

[mgehre]

By the way, is there a tool to generate parts of the test based on clang output, i.e.
something that will prefix the output of clang with "CHECK: " and "CHECK-NEXT:" so I can copy-and-paste
it into my test file?

[mgehre]

Update for review comments

• Change name from ObjLeavesScope to LifetimeEnds
• Make sure that trivially destructible objects end their lifetime after non-trivial destructible objects
• Add test
• Add analyzer option to enable LifetimeEnds CFG entries (disabled by default)

Note that AddImplicitDtors is mutally exclusive with AddLifetime (may be changed by a later patch)

[mgehre]

Fix assert in LocalScope::const_iterator::distance when using goto to jump over trivially constructable variable declarations
Added two test cases for this

[mgehre]

Remove unused CFGBuilder::prependLifetimeEndsWithTerminator

[mgehre]

Ping

[mgehre]

Friendly ping

[dcoughlin]

Thanks for patch! Some comments inline.

You don't have to do it in this patch, but I think it would be good to get this working with AddImplicitDtors. I think it would also be good to (eventually) add CFGElements marking when the storage duration for underlying storage ends. This would allow the static analyzer to warn when writing to storage that no longer exists, which is something I believe a.sidorin is working on in D19979.

lib/Analysis/CFG.cpp

285 ↗

(On Diff #53261)

I think you can make this linear time by walking up the spine of *this until you find either L or the root and caching the ancestors along the way. If you found L, you are done. If not, you can then walk up the spine from L until you find a scope in the cache.

While this approach is unlikely to be needed for human-written code, we do want to make sure to gracefully handle bizarre, deeply-nested scopes that have been programmatically generated.

1091 ↗

(On Diff #53261)

I don't think you handle back-patched gotos yet. For example, consider:

void foo() {
  int i;
  label:
  B b;
  goto label;
  i++;
}

Here the lifetime of b should end immediately before the goto (right?) but your patch says it ends after i++.

1260 ↗

(On Diff #53261)

Nit: Missing word here. "To *go* from B to E ..."?

[mgehre]

Handle back-patches gotos and add test case
Turned LocalScope::const_iterator::shared_parent from O(N^2) into O(N) time
The combination with AddImplicitDtors will be added in a separate patch

[mgehre]

I'm sorry for the long delay!

Regarding " I think it would also be good to (eventually) add CFGElements marking when the storage duration for underlying storage ends.":
From what I understand, this only differs from the end of lifetime in case of objects with non-trivial destructors, where the lifetime ends before
the destructor is called and the storage duration ends afterwards.
In which case is this difference important to the static analyzer? Accessing an object after its lifetime ended is already UB, so the static analyzer could warn on this,
even before the storage duration for underlying storage ends.

[mgehre]

Friendly ping

[dcoughlin]

Sorry for the long delay! This looks good to me. Do you have commit access, or do you need someone to commit it for you?

Regarding " I think it would also be good to (eventually) add CFGElements marking when the storage duration for underlying storage ends.":
From what I understand, this only differs from the end of lifetime in case of objects with non-trivial destructors, where the lifetime ends before
the destructor is called and the storage duration ends afterwards.
In which case is this difference important to the static analyzer? Accessing an object after its lifetime ended is already UB, so the static analyzer could warn on this,
even before the storage duration for underlying storage ends.

There a couple of cases where the difference between storage duration and lifetime could be important to the analyzer. For example, you can end the lifetime of an object prematurely by calling its destructor explicitly. Then, you can later create a new object in its place with new -- but only if the storage is still around. So

  F f;
  f.~F();
// lifetime of object in 'f' ends
  new (&f) F;
// lifetime of new object in 'f' begins

is fine, but

F *p;
{
  F f;
  f.~F();
  p = &f;
}
new (p) F;

is not.

cfe/trunk/include/clang/Analysis/AnalysisContext.h

class AnalysisDeclContextManager {
   /// for well-known functions.
   bool SynthesizeBodies;
 
 public:
   AnalysisDeclContextManager(bool useUnoptimizedCFG = false,
                              bool addImplicitDtors = false,
                              bool addInitializers = false,
                              bool addTemporaryDtors = false,
+                             bool addLifetime = false,
                              bool synthesizeBodies = false,
                              bool addStaticInitBranches = false,
                              bool addCXXNewAllocator = true,
                              CodeInjector* injector = nullptr);
 
   ~AnalysisDeclContextManager();
 
   AnalysisDeclContext *getContext(const Decl *D);

cfe/trunk/include/clang/Analysis/CFG.h

 /// CFGElement - Represents a top-level expression in a basic block.
 class CFGElement {
 public:
   enum Kind {
     // main kind
     Statement,
     Initializer,
     NewAllocator,
+    LifetimeEnds,
     // dtor kind
     AutomaticObjectDtor,
     DeleteDtor,
     BaseDtor,
     MemberDtor,
     TemporaryDtor,
     DTOR_BEGIN = AutomaticObjectDtor,
     DTOR_END = TemporaryDtor

 private:
   friend class CFGElement;
   CFGNewAllocator() {}
   static bool isKind(const CFGElement &elem) {
     return elem.getKind() == NewAllocator;
   }
 };
 
+/// Represents the point where the lifetime of an automatic object ends
+class CFGLifetimeEnds : public CFGElement {
+public:
+  explicit CFGLifetimeEnds(const VarDecl *var, const Stmt *stmt)
+      : CFGElement(LifetimeEnds, var, stmt) {}
+
+  const VarDecl *getVarDecl() const {
+    return static_cast<VarDecl *>(Data1.getPointer());
+  }
+
+  const Stmt *getTriggerStmt() const {
+    return static_cast<Stmt *>(Data2.getPointer());
+  }
+
+private:
+  friend class CFGElement;
+  CFGLifetimeEnds() {}
+  static bool isKind(const CFGElement &elem) {
+    return elem.getKind() == LifetimeEnds;
+  }
+};
+
 /// CFGImplicitDtor - Represents C++ object destructor implicitly generated
 /// by compiler on various occasions.
 class CFGImplicitDtor : public CFGElement {
 protected:
   CFGImplicitDtor() {}
   CFGImplicitDtor(Kind kind, const void *data1, const void *data2 = nullptr)
     : CFGElement(kind, data1, data2) {
     assert(kind >= DTOR_BEGIN && kind <= DTOR_END);
public:
   void appendTemporaryDtor(CXXBindTemporaryExpr *E, BumpVectorContext &C) {
     Elements.push_back(CFGTemporaryDtor(E), C);
   }
 
   void appendAutomaticObjDtor(VarDecl *VD, Stmt *S, BumpVectorContext &C) {
     Elements.push_back(CFGAutomaticObjDtor(VD, S), C);
   }
 
+  void appendLifetimeEnds(VarDecl *VD, Stmt *S, BumpVectorContext &C) {
+    Elements.push_back(CFGLifetimeEnds(VD, S), C);
+  }
+
   void appendDeleteDtor(CXXRecordDecl *RD, CXXDeleteExpr *DE, BumpVectorContext &C) {
     Elements.push_back(CFGDeleteDtor(RD, DE), C);
   }
 
   // Destructors must be inserted in reversed order. So insertion is in two
   // steps. First we prepare space for some number of elements, then we insert
   // the elements beginning at the last position in prepared space.
   iterator beginAutomaticObjDtorsInsert(iterator I, size_t Cnt,
       BumpVectorContext &C) {
     return iterator(Elements.insert(I.base(), Cnt,
                                     CFGAutomaticObjDtor(nullptr, nullptr), C));
   }
   iterator insertAutomaticObjDtor(iterator I, VarDecl *VD, Stmt *S) {
     *I = CFGAutomaticObjDtor(VD, S);
     return ++I;
   }
+
+  // Scope leaving must be performed in reversed order. So insertion is in two
+  // steps. First we prepare space for some number of elements, then we insert
+  // the elements beginning at the last position in prepared space.
+  iterator beginLifetimeEndsInsert(iterator I, size_t Cnt,
+                                   BumpVectorContext &C) {
+    return iterator(
+        Elements.insert(I.base(), Cnt, CFGLifetimeEnds(nullptr, nullptr), C));
+  }
+  iterator insertLifetimeEnds(iterator I, VarDecl *VD, Stmt *S) {
+    *I = CFGLifetimeEnds(VD, S);
+    return ++I;
+  }
 };
 
 /// \brief CFGCallback defines methods that should be called when a logical
 /// operator error is found when building the CFG.
 class CFGCallback {
 public:
   CFGCallback() {}
   virtual void compareAlwaysTrue(const BinaryOperator *B, bool isAlwaysTrue) {}
public:
   public:
     typedef llvm::DenseMap<const Stmt *, const CFGBlock*> ForcedBlkExprs;
     ForcedBlkExprs **forcedBlkExprs;
     CFGCallback *Observer;
     bool PruneTriviallyFalseEdges;
     bool AddEHEdges;
     bool AddInitializers;
     bool AddImplicitDtors;
+    bool AddLifetime;
     bool AddTemporaryDtors;
     bool AddStaticInitBranches;
     bool AddCXXNewAllocator;
     bool AddCXXDefaultInitExprInCtors;
 
     bool alwaysAdd(const Stmt *stmt) const {
       return alwaysAddMask[stmt->getStmtClass()];
     }
 
     BuildOptions &setAlwaysAdd(Stmt::StmtClass stmtClass, bool val = true) {
       alwaysAddMask[stmtClass] = val;
       return *this;
     }
 
     BuildOptions &setAllAlwaysAdd() {
       alwaysAddMask.set();
       return *this;
     }
 
     BuildOptions()
       : forcedBlkExprs(nullptr), Observer(nullptr),
-        PruneTriviallyFalseEdges(true), AddEHEdges(false),
+        PruneTriviallyFalseEdges(true),
+        AddEHEdges(false),
         AddInitializers(false), AddImplicitDtors(false),
+        AddLifetime(false),
         AddTemporaryDtors(false), AddStaticInitBranches(false),
         AddCXXNewAllocator(false), AddCXXDefaultInitExprInCtors(false) {}
   };
 
   /// buildCFG - Builds a CFG from an AST.
   static std::unique_ptr<CFG> buildCFG(const Decl *D, Stmt *AST, ASTContext *C,
                                        const BuildOptions &BO);
 

cfe/trunk/include/clang/StaticAnalyzer/Core/AnalyzerOptions.h

private:
   UserModeKind UserMode;
 
   /// Controls the mode of inter-procedural analysis.
   IPAKind IPAMode;
 
   /// Controls which C++ member functions will be considered for inlining.
   CXXInlineableMemberKind CXXMemberInliningMode;
   
+  /// \sa includeImplicitDtorsInCFG
+  Optional<bool> IncludeImplicitDtorsInCFG;
+
   /// \sa includeTemporaryDtorsInCFG
   Optional<bool> IncludeTemporaryDtorsInCFG;
-  
+  /// \sa IncludeLifetimeInCFG
+  Optional<bool> IncludeLifetimeInCFG;
+
   /// \sa mayInlineCXXStandardLibrary
   Optional<bool> InlineCXXStandardLibrary;
   
   /// \sa mayInlineTemplateFunctions
   Optional<bool> InlineTemplateFunctions;
 
   /// \sa mayInlineCXXAllocator
   Optional<bool> InlineCXXAllocator;
public:
 
   /// Returns whether or not the destructors for C++ temporary objects should
   /// be included in the CFG.
   ///
   /// This is controlled by the 'cfg-temporary-dtors' config option, which
   /// accepts the values "true" and "false".
   bool includeTemporaryDtorsInCFG();
 
+  /// Returns whether or not implicit destructors for C++ objects should
+  /// be included in the CFG.
+  ///
+  /// This is controlled by the 'cfg-implicit-dtors' config option, which
+  /// accepts the values "true" and "false".
+  bool includeImplicitDtorsInCFG();
+
+  /// Returns whether or not end-of-lifetime information should be included in
+  /// the CFG.
+  ///
+  /// This is controlled by the 'cfg-lifetime' config option, which accepts
+  /// the values "true" and "false".
+  bool includeLifetimeInCFG();
+
   /// Returns whether or not C++ standard library functions may be considered
   /// for inlining.
   ///
   /// This is controlled by the 'c++-stdlib-inlining' config option, which
   /// accepts the values "true" and "false".
   bool mayInlineCXXStandardLibrary();
 
   /// Returns whether or not templated functions may be considered for inlining.

cfe/trunk/lib/Analysis/AnalysisDeclContext.cpp

 {  
   cfgBuildOptions.forcedBlkExprs = &forcedBlkExprs;
 }
 
 AnalysisDeclContextManager::AnalysisDeclContextManager(bool useUnoptimizedCFG,
                                                        bool addImplicitDtors,
                                                        bool addInitializers,
                                                        bool addTemporaryDtors,
+                                                       bool addLifetime,
                                                        bool synthesizeBodies,
                                                        bool addStaticInitBranch,
                                                        bool addCXXNewAllocator,
                                                        CodeInjector *injector)
   : Injector(injector), SynthesizeBodies(synthesizeBodies)
 {
   cfgBuildOptions.PruneTriviallyFalseEdges = !useUnoptimizedCFG;
   cfgBuildOptions.AddImplicitDtors = addImplicitDtors;
   cfgBuildOptions.AddInitializers = addInitializers;
   cfgBuildOptions.AddTemporaryDtors = addTemporaryDtors;
+  cfgBuildOptions.AddLifetime = addLifetime;
   cfgBuildOptions.AddStaticInitBranches = addStaticInitBranch;
   cfgBuildOptions.AddCXXNewAllocator = addCXXNewAllocator;
 }
 
 void AnalysisDeclContextManager::clear() { Contexts.clear(); }
 
 static BodyFarm &getBodyFarm(ASTContext &C, CodeInjector *injector = nullptr) {
   static BodyFarm *BF = new BodyFarm(C, injector);

cfe/trunk/lib/Analysis/CFG.cpp

bool operator!=(const const_iterator &rhs) const {
       return !(*this == rhs);
     }
 
     explicit operator bool() const {
       return *this != const_iterator();
     }
 
     int distance(const_iterator L);
+    const_iterator shared_parent(const_iterator L);
   };
 
   friend class const_iterator;
 
 private:
   BumpVectorContext ctx;
   
   /// Automatic variables in order of declaration.
assert (F != const_iterator()
         && "L iterator is not reachable from F iterator.");
     D += F.VarIter;
     F = F.Scope->Prev;
   }
   D += F.VarIter - L.VarIter;
   return D;
 }
 
+/// Calculates the closest parent of this iterator
+/// that is in a scope reachable through the parents of L.
+/// I.e. when using 'goto' from this to L, the lifetime of all variables
+/// between this and shared_parent(L) end.
+LocalScope::const_iterator
+LocalScope::const_iterator::shared_parent(LocalScope::const_iterator L) {
+  llvm::SmallPtrSet<const LocalScope *, 4> ScopesOfL;
+  while (true) {
+    ScopesOfL.insert(L.Scope);
+    if (L == const_iterator())
+      break;
+    L = L.Scope->Prev;
+  }
+
+  const_iterator F = *this;
+  while (true) {
+    if (ScopesOfL.count(F.Scope))
+      return F;
+    assert(F != const_iterator() &&
+           "L iterator is not reachable from F iterator.");
+    F = F.Scope->Prev;
+  }
+}
+
 /// Structure for specifying position in CFG during its build process. It
 /// consists of CFGBlock that specifies position in CFG and
 /// LocalScope::const_iterator that specifies position in LocalScope graph.
 struct BlockScopePosPair {
   BlockScopePosPair() : block(nullptr) {}
   BlockScopePosPair(CFGBlock *b, LocalScope::const_iterator scopePos)
       : block(b), scopePosition(scopePos) {}
 
private:
   CFGBlock *createNoReturnBlock();
 
   CFGBlock *addStmt(Stmt *S) {
     return Visit(S, AddStmtChoice::AlwaysAdd);
   }
   CFGBlock *addInitializer(CXXCtorInitializer *I);
   void addAutomaticObjDtors(LocalScope::const_iterator B,
                             LocalScope::const_iterator E, Stmt *S);
+  void addLifetimeEnds(LocalScope::const_iterator B,
+                       LocalScope::const_iterator E, Stmt *S);
+  void addAutomaticObjHandling(LocalScope::const_iterator B,
+                               LocalScope::const_iterator E, Stmt *S);
   void addImplicitDtorsForDestructor(const CXXDestructorDecl *DD);
 
   // Local scopes creation.
   LocalScope* createOrReuseLocalScope(LocalScope* Scope);
 
   void addLocalScopeForStmt(Stmt *S);
   LocalScope* addLocalScopeForDeclStmt(DeclStmt *DS,
                                        LocalScope* Scope = nullptr);
private:
   }
   void appendTemporaryDtor(CFGBlock *B, CXXBindTemporaryExpr *E) {
     B->appendTemporaryDtor(E, cfg->getBumpVectorContext());
   }
   void appendAutomaticObjDtor(CFGBlock *B, VarDecl *VD, Stmt *S) {
     B->appendAutomaticObjDtor(VD, S, cfg->getBumpVectorContext());
   }
 
+  void appendLifetimeEnds(CFGBlock *B, VarDecl *VD, Stmt *S) {
+    B->appendLifetimeEnds(VD, S, cfg->getBumpVectorContext());
+  }
+
   void appendDeleteDtor(CFGBlock *B, CXXRecordDecl *RD, CXXDeleteExpr *DE) {
     B->appendDeleteDtor(RD, DE, cfg->getBumpVectorContext());
   }
 
   void prependAutomaticObjDtorsWithTerminator(CFGBlock *Blk,
       LocalScope::const_iterator B, LocalScope::const_iterator E);
 
+  void prependAutomaticObjLifetimeWithTerminator(CFGBlock *Blk,
+                                                 LocalScope::const_iterator B,
+                                                 LocalScope::const_iterator E);
+
   void addSuccessor(CFGBlock *B, CFGBlock *S, bool IsReachable = true) {
     B->addSuccessor(CFGBlock::AdjacentBlock(S, IsReachable),
                     cfg->getBumpVectorContext());
   }
 
   /// Add a reachable successor to a block, with the alternate variant that is
   /// unreachable.
   void addSuccessor(CFGBlock *B, CFGBlock *ReachableBlock, CFGBlock *AltBlock) {
TryResult evaluateAsBooleanConditionNoCache(Expr *E) {
     }
 
     bool Result;
     if (E->EvaluateAsBooleanCondition(Result, *Context))
       return Result;
 
     return TryResult();
   }
-  
+  bool hasTrivialDestructor(VarDecl *VD);
 };
 
 inline bool AddStmtChoice::alwaysAdd(CFGBuilder &builder,
                                      const Stmt *stmt) const {
   return builder.alwaysAdd(stmt) || kind == AlwaysAdd;
 }
 
 bool CFGBuilder::alwaysAdd(const Stmt *stmt) {
std::unique_ptr<CFG> CFGBuilder::buildCFG(const Decl *D, Stmt *Statement) {
 
   // Create an empty block that will serve as the exit block for the CFG.  Since
   // this is the first block added to the CFG, it will be implicitly registered
   // as the exit block.
   Succ = createBlock();
   assert(Succ == &cfg->getExit());
   Block = nullptr;  // the EXIT block is empty.  Create all other blocks lazily.
 
+  assert(!(BuildOpts.AddImplicitDtors && BuildOpts.AddLifetime) &&
+         "AddImplicitDtors and AddLifetime cannot be used at the same time");
+
   if (BuildOpts.AddImplicitDtors)
     if (const CXXDestructorDecl *DD = dyn_cast_or_null<CXXDestructorDecl>(D))
       addImplicitDtorsForDestructor(DD);
 
   // Visit the statements and create the CFG.
   CFGBlock *B = addStmt(Statement);
 
   if (badCFG)
for (BackpatchBlocksTy::iterator I = BackpatchBlocks.begin(),
     const GotoStmt *G = cast<GotoStmt>(B->getTerminator());
     LabelMapTy::iterator LI = LabelMap.find(G->getLabel());
 
     // If there is no target for the goto, then we are looking at an
     // incomplete AST.  Handle this by not registering a successor.
     if (LI == LabelMap.end()) continue;
 
     JumpTarget JT = LI->second;
+    prependAutomaticObjLifetimeWithTerminator(B, I->scopePosition,
+                                              JT.scopePosition);
     prependAutomaticObjDtorsWithTerminator(B, I->scopePosition,
                                            JT.scopePosition);
     addSuccessor(B, JT.block);
   }
 
   // Add successors to the Indirect Goto Dispatch block (if we have one).
   if (CFGBlock *B = cfg->getIndirectGotoBlock())
     for (LabelSetTy::iterator I = AddressTakenLabels.begin(),
if (const MemberExpr *ME = dyn_cast<MemberExpr>(Init)) {
       }
     }
     
     break;
   }
 
   return Init->getType();
 }
-  
+void CFGBuilder::addAutomaticObjHandling(LocalScope::const_iterator B,
+                                         LocalScope::const_iterator E,
+                                         Stmt *S) {
+  if (BuildOpts.AddImplicitDtors)
+    addAutomaticObjDtors(B, E, S);
+  if (BuildOpts.AddLifetime)
+    addLifetimeEnds(B, E, S);
+}
+
+/// Add to current block automatic objects that leave the scope.
+void CFGBuilder::addLifetimeEnds(LocalScope::const_iterator B,
+                                 LocalScope::const_iterator E, Stmt *S) {
+  if (!BuildOpts.AddLifetime)
+    return;
+
+  if (B == E)
+    return;
+
+  // To go from B to E, one first goes up the scopes from B to P
+  // then sideways in one scope from P to P' and then down
+  // the scopes from P' to E.
+  // The lifetime of all objects between B and P end.
+  LocalScope::const_iterator P = B.shared_parent(E);
+  int dist = B.distance(P);
+  if (dist <= 0)
+    return;
+
+  // We need to perform the scope leaving in reverse order
+  SmallVector<VarDecl *, 10> DeclsTrivial;
+  SmallVector<VarDecl *, 10> DeclsNonTrivial;
+  DeclsTrivial.reserve(dist);
+  DeclsNonTrivial.reserve(dist);
+
+  for (LocalScope::const_iterator I = B; I != P; ++I)
+    if (hasTrivialDestructor(*I))
+      DeclsTrivial.push_back(*I);
+    else
+      DeclsNonTrivial.push_back(*I);
+
+  autoCreateBlock();
+  // object with trivial destructor end their lifetime last (when storage
+  // duration ends)
+  for (SmallVectorImpl<VarDecl *>::reverse_iterator I = DeclsTrivial.rbegin(),
+                                                    E = DeclsTrivial.rend();
+       I != E; ++I)
+    appendLifetimeEnds(Block, *I, S);
+
+  for (SmallVectorImpl<VarDecl *>::reverse_iterator
+           I = DeclsNonTrivial.rbegin(),
+           E = DeclsNonTrivial.rend();
+       I != E; ++I)
+    appendLifetimeEnds(Block, *I, S);
+}
+
 /// addAutomaticObjDtors - Add to current block automatic objects destructors
 /// for objects in range of local scope positions. Use S as trigger statement
 /// for destructors.
 void CFGBuilder::addAutomaticObjDtors(LocalScope::const_iterator B,
                                       LocalScope::const_iterator E, Stmt *S) {
   if (!BuildOpts.AddImplicitDtors)
     return;
 
LocalScope* CFGBuilder::createOrReuseLocalScope(LocalScope* Scope) {
   llvm::BumpPtrAllocator &alloc = cfg->getAllocator();
   return new (alloc.Allocate<LocalScope>())
       LocalScope(BumpVectorContext(alloc), ScopePos);
 }
 
 /// addLocalScopeForStmt - Add LocalScope to local scopes tree for statement
 /// that should create implicit scope (e.g. if/else substatements). 
 void CFGBuilder::addLocalScopeForStmt(Stmt *S) {
-  if (!BuildOpts.AddImplicitDtors)
+  if (!BuildOpts.AddImplicitDtors && !BuildOpts.AddLifetime)
     return;
 
   LocalScope *Scope = nullptr;
 
   // For compound statement we will be creating explicit scope.
   if (CompoundStmt *CS = dyn_cast<CompoundStmt>(S)) {
     for (auto *BI : CS->body()) {
       Stmt *SI = BI->stripLabelLikeStatements();
       if (DeclStmt *DS = dyn_cast<DeclStmt>(SI))
         Scope = addLocalScopeForDeclStmt(DS, Scope);
     }
     return;
   }
 
   // For any other statement scope will be implicit and as such will be
   // interesting only for DeclStmt.
   if (DeclStmt *DS = dyn_cast<DeclStmt>(S->stripLabelLikeStatements()))
     addLocalScopeForDeclStmt(DS);
 }
 
 /// addLocalScopeForDeclStmt - Add LocalScope for declaration statement. Will
 /// reuse Scope if not NULL.
 LocalScope* CFGBuilder::addLocalScopeForDeclStmt(DeclStmt *DS,
                                                  LocalScope* Scope) {
-  if (!BuildOpts.AddImplicitDtors)
+  if (!BuildOpts.AddImplicitDtors && !BuildOpts.AddLifetime)
     return Scope;
 
   for (auto *DI : DS->decls())
     if (VarDecl *VD = dyn_cast<VarDecl>(DI))
       Scope = addLocalScopeForVarDecl(VD, Scope);
   return Scope;
 }
 
-/// addLocalScopeForVarDecl - Add LocalScope for variable declaration. It will
-/// create add scope for automatic objects and temporary objects bound to
-/// const reference. Will reuse Scope if not NULL.
-LocalScope* CFGBuilder::addLocalScopeForVarDecl(VarDecl *VD,
-                                                LocalScope* Scope) {
-  if (!BuildOpts.AddImplicitDtors)
-    return Scope;
-
-  // Check if variable is local.
-  switch (VD->getStorageClass()) {
-  case SC_None:
-  case SC_Auto:
-  case SC_Register:
-    break;
-  default: return Scope;
-  }
-
+bool CFGBuilder::hasTrivialDestructor(VarDecl *VD) {
   // Check for const references bound to temporary. Set type to pointee.
   QualType QT = VD->getType();
   if (QT.getTypePtr()->isReferenceType()) {
     // Attempt to determine whether this declaration lifetime-extends a
     // temporary.
     //
     // FIXME: This is incorrect. Non-reference declarations can lifetime-extend
     // temporaries, and a single declaration can extend multiple temporaries.
     // We should look at the storage duration on each nested
     // MaterializeTemporaryExpr instead.
+
     const Expr *Init = VD->getInit();
     if (!Init)
-      return Scope;
+      return true;
 
     // Lifetime-extending a temporary.
     bool FoundMTE = false;
     QT = getReferenceInitTemporaryType(*Context, Init, &FoundMTE);
     if (!FoundMTE)
-      return Scope;
+      return true;
   }
 
   // Check for constant size array. Set type to array element type.
   while (const ConstantArrayType *AT = Context->getAsConstantArrayType(QT)) {
     if (AT->getSize() == 0)
-      return Scope;
+      return true;
     QT = AT->getElementType();
   }
 
   // Check if type is a C++ class with non-trivial destructor.
   if (const CXXRecordDecl *CD = QT->getAsCXXRecordDecl())
-    if (CD->hasDefinition() && !CD->hasTrivialDestructor()) {
+    return !CD->hasDefinition() || CD->hasTrivialDestructor();
+  return true;
+}
+
+/// addLocalScopeForVarDecl - Add LocalScope for variable declaration. It will
+/// create add scope for automatic objects and temporary objects bound to
+/// const reference. Will reuse Scope if not NULL.
+LocalScope* CFGBuilder::addLocalScopeForVarDecl(VarDecl *VD,
+                                                LocalScope* Scope) {
+  assert(!(BuildOpts.AddImplicitDtors && BuildOpts.AddLifetime) &&
+         "AddImplicitDtors and AddLifetime cannot be used at the same time");
+  if (!BuildOpts.AddImplicitDtors && !BuildOpts.AddLifetime)
+    return Scope;
+
+  // Check if variable is local.
+  switch (VD->getStorageClass()) {
+  case SC_None:
+  case SC_Auto:
+  case SC_Register:
+    break;
+  default: return Scope;
+  }
+
+  if (BuildOpts.AddImplicitDtors) {
+    if (!hasTrivialDestructor(VD)) {
       // Add the variable to scope
       Scope = createOrReuseLocalScope(Scope);
       Scope->addVar(VD);
       ScopePos = Scope->begin();
     }
     return Scope;
   }
 
+  assert(BuildOpts.AddLifetime);
+  // Add the variable to scope
+  Scope = createOrReuseLocalScope(Scope);
+  Scope->addVar(VD);
+  ScopePos = Scope->begin();
+  return Scope;
+}
+
 /// addLocalScopeAndDtors - For given statement add local scope for it and
 /// add destructors that will cleanup the scope. Will reuse Scope if not NULL.
 void CFGBuilder::addLocalScopeAndDtors(Stmt *S) {
-  if (!BuildOpts.AddImplicitDtors)
-    return;
-
   LocalScope::const_iterator scopeBeginPos = ScopePos;
   addLocalScopeForStmt(S);
-  addAutomaticObjDtors(ScopePos, scopeBeginPos, S);
+  addAutomaticObjHandling(ScopePos, scopeBeginPos, S);
 }
 
 /// prependAutomaticObjDtorsWithTerminator - Prepend destructor CFGElements for
 /// variables with automatic storage duration to CFGBlock's elements vector.
 /// Elements will be prepended to physical beginning of the vector which
 /// happens to be logical end. Use blocks terminator as statement that specifies
 /// destructors call site.
 /// FIXME: This mechanism for adding automatic destructors doesn't handle
 /// no-return destructors properly.
 void CFGBuilder::prependAutomaticObjDtorsWithTerminator(CFGBlock *Blk,
     LocalScope::const_iterator B, LocalScope::const_iterator E) {
+  if (!BuildOpts.AddImplicitDtors)
+    return;
   BumpVectorContext &C = cfg->getBumpVectorContext();
   CFGBlock::iterator InsertPos
     = Blk->beginAutomaticObjDtorsInsert(Blk->end(), B.distance(E), C);
   for (LocalScope::const_iterator I = B; I != E; ++I)
     InsertPos = Blk->insertAutomaticObjDtor(InsertPos, *I,
                                             Blk->getTerminator());
 }
 
+/// prependAutomaticObjLifetimeWithTerminator - Prepend lifetime CFGElements for
+/// variables with automatic storage duration to CFGBlock's elements vector.
+/// Elements will be prepended to physical beginning of the vector which
+/// happens to be logical end. Use blocks terminator as statement that specifies
+/// where lifetime ends.
+void CFGBuilder::prependAutomaticObjLifetimeWithTerminator(
+    CFGBlock *Blk, LocalScope::const_iterator B, LocalScope::const_iterator E) {
+  if (!BuildOpts.AddLifetime)
+    return;
+  BumpVectorContext &C = cfg->getBumpVectorContext();
+  CFGBlock::iterator InsertPos =
+      Blk->beginLifetimeEndsInsert(Blk->end(), B.distance(E), C);
+  for (LocalScope::const_iterator I = B; I != E; ++I)
+    InsertPos = Blk->insertLifetimeEnds(InsertPos, *I, Blk->getTerminator());
+}
 /// Visit - Walk the subtree of a statement and add extra
 ///   blocks for ternary operators, &&, and ||.  We also process "," and
 ///   DeclStmts (which may contain nested control-flow).
 CFGBlock *CFGBuilder::Visit(Stmt * S, AddStmtChoice asc) {
   if (!S) {
     badCFG = true;
     return nullptr;
   }
CFGBlock *CFGBuilder::VisitBreakStmt(BreakStmt *B) {
 
   // Now create a new block that ends with the break statement.
   Block = createBlock(false);
   Block->setTerminator(B);
 
   // If there is no target for the break, then we are looking at an incomplete
   // AST.  This means that the CFG cannot be constructed.
   if (BreakJumpTarget.block) {
-    addAutomaticObjDtors(ScopePos, BreakJumpTarget.scopePosition, B);
+    addAutomaticObjHandling(ScopePos, BreakJumpTarget.scopePosition, B);
     addSuccessor(Block, BreakJumpTarget.block);
   } else
     badCFG = true;
 
 
   return Block;
 }
 
CFGBlock *CFGBuilder::VisitChooseExpr(ChooseExpr *C,
   addSuccessor(Block, KnownVal.isTrue() ? nullptr : RHSBlock);
   Block->setTerminator(C);
   return addStmt(C->getCond());
 }
 
 
 CFGBlock *CFGBuilder::VisitCompoundStmt(CompoundStmt *C) {
   LocalScope::const_iterator scopeBeginPos = ScopePos;
-  if (BuildOpts.AddImplicitDtors) {
-    addLocalScopeForStmt(C);
-  }
+
   if (!C->body_empty() && !isa<ReturnStmt>(*C->body_rbegin())) {
     // If the body ends with a ReturnStmt, the dtors will be added in
     // VisitReturnStmt.
-    addAutomaticObjDtors(ScopePos, scopeBeginPos, C);
+    addAutomaticObjHandling(ScopePos, scopeBeginPos, C);
   }
 
   CFGBlock *LastBlock = Block;
 
   for (CompoundStmt::reverse_body_iterator I=C->body_rbegin(), E=C->body_rend();
        I != E; ++I ) {
     // If we hit a segment of code just containing ';' (NullStmts), we can
     // get a null block back.  In such cases, just use the LastBlock
CFGBlock *CFGBuilder::VisitIfStmt(IfStmt *I) {
   if (Stmt *Init = I->getInit())
     addLocalScopeForStmt(Init);
 
   // Create local scope for possible condition variable.
   // Store scope position. Add implicit destructor.
   if (VarDecl *VD = I->getConditionVariable())
     addLocalScopeForVarDecl(VD);
 
-  addAutomaticObjDtors(ScopePos, save_scope_pos.get(), I);
+  addAutomaticObjHandling(ScopePos, save_scope_pos.get(), I);
 
   // The block we were processing is now finished.  Make it the successor
   // block.
   if (Block) {
     Succ = Block;
     if (badCFG)
       return nullptr;
   }
CFGBlock *CFGBuilder::VisitReturnStmt(ReturnStmt *R) {
   // NOTE: If a "return" appears in the middle of a block, this means that the
   //       code afterwards is DEAD (unreachable).  We still keep a basic block
   //       for that code; a simple "mark-and-sweep" from the entry block will be
   //       able to report such dead blocks.
 
   // Create the new block.
   Block = createBlock(false);
 
-  addAutomaticObjDtors(ScopePos, LocalScope::const_iterator(), R);
+  addAutomaticObjHandling(ScopePos, LocalScope::const_iterator(), R);
 
   // If the one of the destructors does not return, we already have the Exit
   // block as a successor.
   if (!Block->hasNoReturnElement())
     addSuccessor(Block, &cfg->getExit());
 
   // Add the return statement to the block.  This may create new blocks if R
   // contains control-flow (short-circuit operations).
CFGBlock *CFGBuilder::VisitGotoStmt(GotoStmt *G) {
   // If we already know the mapping to the label block add the successor now.
   LabelMapTy::iterator I = LabelMap.find(G->getLabel());
 
   if (I == LabelMap.end())
     // We will need to backpatch this block later.
     BackpatchBlocks.push_back(JumpSource(Block, ScopePos));
   else {
     JumpTarget JT = I->second;
-    addAutomaticObjDtors(ScopePos, JT.scopePosition, G);
+    addAutomaticObjHandling(ScopePos, JT.scopePosition, G);
     addSuccessor(Block, JT.block);
   }
 
   return Block;
 }
 
 CFGBlock *CFGBuilder::VisitForStmt(ForStmt *F) {
   CFGBlock *LoopSuccessor = nullptr;
 
   // Save local scope position because in case of condition variable ScopePos
   // won't be restored when traversing AST.
   SaveAndRestore<LocalScope::const_iterator> save_scope_pos(ScopePos);
 
   // Create local scope for init statement and possible condition variable.
   // Add destructor for init statement and condition variable.
   // Store scope position for continue statement.
   if (Stmt *Init = F->getInit())
     addLocalScopeForStmt(Init);
   LocalScope::const_iterator LoopBeginScopePos = ScopePos;
 
   if (VarDecl *VD = F->getConditionVariable())
     addLocalScopeForVarDecl(VD);
   LocalScope::const_iterator ContinueScopePos = ScopePos;
 
-  addAutomaticObjDtors(ScopePos, save_scope_pos.get(), F);
+  addAutomaticObjHandling(ScopePos, save_scope_pos.get(), F);
 
   // "for" is a control-flow statement.  Thus we stop processing the current
   // block.
   if (Block) {
     if (badCFG)
       return nullptr;
     LoopSuccessor = Block;
   } else
// Now create the loop body.
     }
 
    // The starting block for the loop increment is the block that should
    // represent the 'loop target' for looping back to the start of the loop.
    ContinueJumpTarget = JumpTarget(Succ, ContinueScopePos);
    ContinueJumpTarget.block->setLoopTarget(F);
 
     // Loop body should end with destructor of Condition variable (if any).
-    addAutomaticObjDtors(ScopePos, LoopBeginScopePos, F);
+   addAutomaticObjHandling(ScopePos, LoopBeginScopePos, F);
 
     // If body is not a compound statement create implicit scope
     // and add destructors.
     if (!isa<CompoundStmt>(F->getBody()))
       addLocalScopeAndDtors(F->getBody());
 
     // Now populate the body block, and in the process create new blocks as we
     // walk the body of the loop.
CFGBlock *CFGBuilder::VisitWhileStmt(WhileStmt *W) {
   // won't be restored when traversing AST.
   SaveAndRestore<LocalScope::const_iterator> save_scope_pos(ScopePos);
 
   // Create local scope for possible condition variable.
   // Store scope position for continue statement.
   LocalScope::const_iterator LoopBeginScopePos = ScopePos;
   if (VarDecl *VD = W->getConditionVariable()) {
     addLocalScopeForVarDecl(VD);
-    addAutomaticObjDtors(ScopePos, LoopBeginScopePos, W);
+    addAutomaticObjHandling(ScopePos, LoopBeginScopePos, W);
   }
 
   // "while" is a control-flow statement.  Thus we stop processing the current
   // block.
   if (Block) {
     if (badCFG)
       return nullptr;
     LoopSuccessor = Block;
// Process the loop body.
     Succ = TransitionBlock = createBlock(false);
     TransitionBlock->setLoopTarget(W);
     ContinueJumpTarget = JumpTarget(Succ, LoopBeginScopePos);
 
     // All breaks should go to the code following the loop.
     BreakJumpTarget = JumpTarget(LoopSuccessor, ScopePos);
 
     // Loop body should end with destructor of Condition variable (if any).
-    addAutomaticObjDtors(ScopePos, LoopBeginScopePos, W);
+    addAutomaticObjHandling(ScopePos, LoopBeginScopePos, W);
 
     // If body is not a compound statement create implicit scope
     // and add destructors.
     if (!isa<CompoundStmt>(W->getBody()))
       addLocalScopeAndDtors(W->getBody());
 
     // Create the body.  The returned block is the entry to the loop body.
     BodyBlock = addStmt(W->getBody());
CFGBlock *CFGBuilder::VisitContinueStmt(ContinueStmt *C) {
 
   // Now create a new block that ends with the continue statement.
   Block = createBlock(false);
   Block->setTerminator(C);
 
   // If there is no target for the continue, then we are looking at an
   // incomplete AST.  This means the CFG cannot be constructed.
   if (ContinueJumpTarget.block) {
-    addAutomaticObjDtors(ScopePos, ContinueJumpTarget.scopePosition, C);
+    addAutomaticObjHandling(ScopePos, ContinueJumpTarget.scopePosition, C);
     addSuccessor(Block, ContinueJumpTarget.block);
   } else
     badCFG = true;
 
   return Block;
 }
 
 CFGBlock *CFGBuilder::VisitUnaryExprOrTypeTraitExpr(UnaryExprOrTypeTraitExpr *E,
CFGBlock *CFGBuilder::VisitSwitchStmt(SwitchStmt *Terminator) {
   if (Stmt *Init = Terminator->getInit())
     addLocalScopeForStmt(Init);
 
   // Create local scope for possible condition variable.
   // Store scope position. Add implicit destructor.
   if (VarDecl *VD = Terminator->getConditionVariable())
     addLocalScopeForVarDecl(VD);
 
-  addAutomaticObjDtors(ScopePos, save_scope_pos.get(), Terminator);
+  addAutomaticObjHandling(ScopePos, save_scope_pos.get(), Terminator);
 
   if (Block) {
     if (badCFG)
       return nullptr;
     SwitchSuccessor = Block;
   } else SwitchSuccessor = Succ;
 
   // Save the current "switch" context.
CFGBlock *CFGBuilder::VisitCXXCatchStmt(CXXCatchStmt *CS) {
   // won't be restored when traversing AST.
   SaveAndRestore<LocalScope::const_iterator> save_scope_pos(ScopePos);
 
   // Create local scope for possible exception variable.
   // Store scope position. Add implicit destructor.
   if (VarDecl *VD = CS->getExceptionDecl()) {
     LocalScope::const_iterator BeginScopePos = ScopePos;
     addLocalScopeForVarDecl(VD);
-    addAutomaticObjDtors(ScopePos, BeginScopePos, CS);
+    addAutomaticObjHandling(ScopePos, BeginScopePos, CS);
   }
 
   if (CS->getHandlerBlock())
     addStmt(CS->getHandlerBlock());
 
   CFGBlock *CatchBlock = Block;
   if (!CatchBlock)
     CatchBlock = createBlock();
CFGBlock *CFGBuilder::VisitCXXForRangeStmt(CXXForRangeStmt *S) {
 
   // Create local scopes and destructors for range, begin and end variables.
   if (Stmt *Range = S->getRangeStmt())
     addLocalScopeForStmt(Range);
   if (Stmt *Begin = S->getBeginStmt())
     addLocalScopeForStmt(Begin);
   if (Stmt *End = S->getEndStmt())
     addLocalScopeForStmt(End);
-  addAutomaticObjDtors(ScopePos, save_scope_pos.get(), S);
+  addAutomaticObjHandling(ScopePos, save_scope_pos.get(), S);
 
   LocalScope::const_iterator ContinueScopePos = ScopePos;
 
   // "for" is a control-flow statement.  Thus we stop processing the current
   // block.
   CFGBlock *LoopSuccessor = nullptr;
   if (Block) {
     if (badCFG)

 }
 
 const CXXDestructorDecl *
 CFGImplicitDtor::getDestructorDecl(ASTContext &astContext) const {
   switch (getKind()) {
     case CFGElement::Statement:
     case CFGElement::Initializer:
     case CFGElement::NewAllocator:
+    case CFGElement::LifetimeEnds:
       llvm_unreachable("getDestructorDecl should only be used with "
                        "ImplicitDtors");
     case CFGElement::AutomaticObjectDtor: {
       const VarDecl *var = castAs<CFGAutomaticObjDtor>().getVarDecl();
       QualType ty = var->getType();
 
       // FIXME: See CFGBuilder::addLocalScopeForVarDecl.
       //
if (Optional<CFGStmt> CS = E.getAs<CFGStmt>()) {
     const Type* T = VD->getType().getTypePtr();
     if (const ReferenceType* RT = T->getAs<ReferenceType>())
       T = RT->getPointeeType().getTypePtr();
     T = T->getBaseElementTypeUnsafe();
 
     OS << ".~" << T->getAsCXXRecordDecl()->getName().str() << "()";
     OS << " (Implicit destructor)\n";
 
+  } else if (Optional<CFGLifetimeEnds> DE = E.getAs<CFGLifetimeEnds>()) {
+    const VarDecl *VD = DE->getVarDecl();
+    Helper.handleDecl(VD, OS);
+
+    OS << " (Lifetime ends)\n";
+
   } else if (Optional<CFGNewAllocator> NE = E.getAs<CFGNewAllocator>()) {
     OS << "CFGNewAllocator(";
     if (const CXXNewExpr *AllocExpr = NE->getAllocatorExpr())
       AllocExpr->getType().print(OS, PrintingPolicy(Helper.getLangOpts()));
     OS << ")\n";
   } else if (Optional<CFGDeleteDtor> DE = E.getAs<CFGDeleteDtor>()) {
     const CXXRecordDecl *RD = DE->getCXXRecordDecl();
     if (!RD)

cfe/trunk/lib/StaticAnalyzer/Core/AnalysisManager.cpp

AnalysisManager::AnalysisManager(ASTContext &ctx, DiagnosticsEngine &diags,
                                  const LangOptions &lang,
                                  const PathDiagnosticConsumers &PDC,
                                  StoreManagerCreator storemgr,
                                  ConstraintManagerCreator constraintmgr,
                                  CheckerManager *checkerMgr,
                                  AnalyzerOptions &Options,
                                  CodeInjector *injector)
   : AnaCtxMgr(Options.UnoptimizedCFG,
-              /*AddImplicitDtors=*/true,
+              Options.includeImplicitDtorsInCFG(),
               /*AddInitializers=*/true,
               Options.includeTemporaryDtorsInCFG(),
+        Options.includeLifetimeInCFG(),
               Options.shouldSynthesizeBodies(),
               Options.shouldConditionalizeStaticInitializers(),
               /*addCXXNewAllocator=*/true,
               injector),
     Ctx(ctx),
     Diags(diags),
     LangOpts(lang),
     PathConsumers(PDC),

cfe/trunk/lib/StaticAnalyzer/Core/AnalyzerOptions.cpp

 }
 
 bool AnalyzerOptions::includeTemporaryDtorsInCFG() {
   return getBooleanOption(IncludeTemporaryDtorsInCFG,
                           "cfg-temporary-dtors",
                           /* Default = */ false);
 }
 
+bool AnalyzerOptions::includeImplicitDtorsInCFG() {
+  return getBooleanOption(IncludeImplicitDtorsInCFG,
+                          "cfg-implicit-dtors",
+                          /* Default = */ true);
+}
+
+bool AnalyzerOptions::includeLifetimeInCFG() {
+  return getBooleanOption(IncludeLifetimeInCFG, "cfg-lifetime",
+                          /* Default = */ false);
+}
+
 bool AnalyzerOptions::mayInlineCXXStandardLibrary() {
   return getBooleanOption(InlineCXXStandardLibrary,
                           "c++-stdlib-inlining",
                           /*Default=*/true);
 }
 
 bool AnalyzerOptions::mayInlineTemplateFunctions() {
   return getBooleanOption(InlineTemplateFunctions,

cfe/trunk/lib/StaticAnalyzer/Core/ExprEngine.cpp

case CFGElement::NewAllocator:
       return;
     case CFGElement::AutomaticObjectDtor:
     case CFGElement::DeleteDtor:
     case CFGElement::BaseDtor:
     case CFGElement::MemberDtor:
     case CFGElement::TemporaryDtor:
       ProcessImplicitDtor(E.castAs<CFGImplicitDtor>(), Pred);
       return;
+    case CFGElement::LifetimeEnds:
+      return;
   }
 }
 
 static bool shouldRemoveDeadBindings(AnalysisManager &AMgr,
                                      const CFGStmt S,
                                      const ExplodedNode *Pred,
                                      const LocationContext *LC) {
 

cfe/trunk/lib/StaticAnalyzer/Core/PathDiagnostic.cpp

getLocationForCaller(const StackFrameContext *SFC,
   case CFGElement::MemberDtor: {
     const AnalysisDeclContext *CallerInfo = CallerCtx->getAnalysisDeclContext();
     if (const Stmt *CallerBody = CallerInfo->getBody())
       return PathDiagnosticLocation::createEnd(CallerBody, SM, CallerCtx);
     return PathDiagnosticLocation::create(CallerInfo->getDecl(), SM);
   }
   case CFGElement::TemporaryDtor:
   case CFGElement::NewAllocator:
+  case CFGElement::LifetimeEnds:
     llvm_unreachable("not yet implemented!");
   }
 
   llvm_unreachable("Unknown CFGElement kind");
 }
 
 PathDiagnosticLocation
 PathDiagnosticLocation::createBegin(const Decl *D,

cfe/trunk/test/Analysis/analyzer-config.c

 // RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin10 %s -o /dev/null -analyzer-checker=core,osx.cocoa,debug.ConfigDumper -analyzer-max-loop 34 > %t 2>&1
 // RUN: FileCheck --input-file=%t %s
 
 void bar() {}
 void foo() {
   // Call bar 33 times so max-times-inline-large is met and
   // min-blocks-for-inline-large is checked
   for (int i = 0; i < 34; ++i) {
     bar();
   }
 }
 
 // CHECK: [config]
 // CHECK-NEXT: cfg-conditional-static-initializers = true
+// CHECK-NEXT: cfg-implicit-dtors = true
+// CHECK-NEXT: cfg-lifetime = false
 // CHECK-NEXT: cfg-temporary-dtors = false
 // CHECK-NEXT: faux-bodies = true
 // CHECK-NEXT: graph-trim-interval = 1000
 // CHECK-NEXT: inline-lambdas = true
 // CHECK-NEXT: ipa = dynamic-bifurcate
 // CHECK-NEXT: ipa-always-inline-size = 3
 // CHECK-NEXT: leak-diagnostics-reference-allocation = false
 // CHECK-NEXT: max-inlinable-size = 100
 // CHECK-NEXT: max-nodes = 225000
 // CHECK-NEXT: max-times-inline-large = 32
 // CHECK-NEXT: min-cfg-size-treat-functions-as-large = 14
 // CHECK-NEXT: mode = deep
 // CHECK-NEXT: region-store-small-struct-limit = 2
 // CHECK-NEXT: widen-loops = false
 // CHECK-NEXT: [stats]
-// CHECK-NEXT: num-entries = 15
-
+// CHECK-NEXT: num-entries = 17

cfe/trunk/test/Analysis/analyzer-config.cpp

 
 // CHECK: [config]
 // CHECK-NEXT: c++-container-inlining = false
 // CHECK-NEXT: c++-inlining = destructors
 // CHECK-NEXT: c++-shared_ptr-inlining = false
 // CHECK-NEXT: c++-stdlib-inlining = true
 // CHECK-NEXT: c++-template-inlining = true
 // CHECK-NEXT: cfg-conditional-static-initializers = true
+// CHECK-NEXT: cfg-implicit-dtors = true
+// CHECK-NEXT: cfg-lifetime = false
 // CHECK-NEXT: cfg-temporary-dtors = false
 // CHECK-NEXT: faux-bodies = true
 // CHECK-NEXT: graph-trim-interval = 1000
 // CHECK-NEXT: inline-lambdas = true
 // CHECK-NEXT: ipa = dynamic-bifurcate
 // CHECK-NEXT: ipa-always-inline-size = 3
 // CHECK-NEXT: leak-diagnostics-reference-allocation = false
 // CHECK-NEXT: max-inlinable-size = 100
 // CHECK-NEXT: max-nodes = 225000
 // CHECK-NEXT: max-times-inline-large = 32
 // CHECK-NEXT: min-cfg-size-treat-functions-as-large = 14
 // CHECK-NEXT: mode = deep
 // CHECK-NEXT: region-store-small-struct-limit = 2
 // CHECK-NEXT: widen-loops = false
 // CHECK-NEXT: [stats]
-// CHECK-NEXT: num-entries = 20
+// CHECK-NEXT: num-entries = 22

cfe/trunk/test/Analysis/lifetime-cfg-output.cpp

+// RUN: %clang_cc1 -fcxx-exceptions -fexceptions -analyze -analyzer-checker=debug.DumpCFG -analyzer-config cfg-lifetime=true -analyzer-config cfg-implicit-dtors=false %s > %t 2>&1
+// RUN: FileCheck --input-file=%t %s
+
+extern bool UV;
+class A {
+public:
+  // CHECK:       [B2 (ENTRY)]
+  // CHECK-NEXT:    Succs (1): B1
+  // CHECK:       [B1]
+  // CHECK-NEXT:    1: true
+  // CHECK-NEXT:    2: UV
+  // CHECK-NEXT:    3: [B1.2] = [B1.1]
+  // CHECK-NEXT:    Preds (1): B2
+  // CHECK-NEXT:    Succs (1): B0
+  // CHECK:       [B0 (EXIT)]
+  // CHECK-NEXT:    Preds (1): B1
+  A() {
+    UV = true;
+  }
+  // CHECK:       [B3 (ENTRY)]
+  // CHECK-NEXT:    Succs (1): B2
+  // CHECK:       [B1]
+  // CHECK-NEXT:    1: 0
+  // CHECK-NEXT:    2: this
+  // CHECK-NEXT:    3: [B1.2]->p
+  // CHECK-NEXT:    4: [B1.3] (ImplicitCastExpr, LValueToRValue, int *)
+  // CHECK-NEXT:    5: *[B1.4]
+  // CHECK-NEXT:    6: [B1.5] = [B1.1]
+  // CHECK-NEXT:    Preds (1): B2
+  // CHECK-NEXT:    Succs (1): B0
+  // CHECK:       [B2]
+  // CHECK-NEXT:    1: this
+  // CHECK-NEXT:    2: [B2.1]->p
+  // CHECK-NEXT:    3: [B2.2] (ImplicitCastExpr, LValueToRValue, int *)
+  // CHECK-NEXT:    4: [B2.3] (ImplicitCastExpr, PointerToBoolean, _Bool)
+  // CHECK-NEXT:    T: if [B2.4]
+  // CHECK-NEXT:    Preds (1): B3
+  // CHECK-NEXT:    Succs (2): B1 B0
+  // CHECK:       [B0 (EXIT)]
+  // CHECK-NEXT:    Preds (2): B1 B2
+  ~A() {
+    if (p)
+      *p = 0;
+  }
+  // CHECK:       [B2 (ENTRY)]
+  // CHECK-NEXT:    Succs (1): B1
+  // CHECK:       [B1]
+  // CHECK-NEXT:    1: 1
+  // CHECK-NEXT:    2: return [B1.1];
+  // CHECK-NEXT:    Preds (1): B2
+  // CHECK-NEXT:    Succs (1): B0
+  // CHECK:       [B0 (EXIT)]
+  // CHECK-NEXT:    Preds (1): B1
+  operator int() const { return 1; }
+  int *p;
+};
+
+// CHECK:       [B2 (ENTRY)]
+// CHECK-NEXT:    Succs (1): B1
+// CHECK:       [B1]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A a;
+// CHECK-NEXT:    3: a
+// CHECK-NEXT:    4: [B1.3] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    5: const A &b = a;
+// CHECK-NEXT:    6: A() (CXXConstructExpr, class A)
+// CHECK-NEXT:    7: [B1.6] (BindTemporary)
+// CHECK-NEXT:    8: [B1.7] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    9: [B1.8]
+// CHECK-NEXT:   10: const A &c = A();
+// CHECK-NEXT:   11: [B1.10] (Lifetime ends)
+// CHECK-NEXT:   12: [B1.2] (Lifetime ends)
+// CHECK-NEXT:   13: [B1.5] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B2
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B0 (EXIT)]
+// CHECK-NEXT:    Preds (1): B1
+void test_const_ref() {
+  A a;
+  const A &b = a;
+  const A &c = A();
+}
+
+// CHECK:      [B2 (ENTRY)]
+// CHECK-NEXT:   Succs (1): B1
+// CHECK:       [B1]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A [2])
+// CHECK-NEXT:    2: A a[2];
+// CHECK-NEXT:    3:  (CXXConstructExpr, class A [0])
+// CHECK-NEXT:    4: A b[0];
+// lifetime of a ends when its destructors are run
+// CHECK-NEXT:    5: [B1.2] (Lifetime ends)
+// lifetime of b ends when its storage duration ends
+// CHECK-NEXT:    6: [B1.4] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B2
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:      [B0 (EXIT)]
+// CHECK-NEXT:   Preds (1): B1
+void test_array() {
+  A a[2];
+  A b[0];
+}
+
+// CHECK:      [B2 (ENTRY)]
+// CHECK-NEXT:   Succs (1): B1
+// CHECK:       [B1]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A a;
+// CHECK-NEXT:    3:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    4: A c;
+// CHECK-NEXT:    5:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    6: A d;
+// CHECK-NEXT:    7: [B1.6] (Lifetime ends)
+// CHECK-NEXT:    8: [B1.4] (Lifetime ends)
+// CHECK-NEXT:    9:  (CXXConstructExpr, class A)
+// CHECK-NEXT:   10: A b;
+// CHECK-NEXT:   11: [B1.10] (Lifetime ends)
+// CHECK-NEXT:   12: [B1.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B2
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:      [B0 (EXIT)]
+// CHECK-NEXT:   Preds (1): B1
+void test_scope() {
+  A a;
+  {
+    A c;
+    A d;
+  }
+  A b;
+}
+
+// CHECK:      [B4 (ENTRY)]
+// CHECK-NEXT:   Succs (1): B3
+// CHECK:       [B1]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A c;
+// CHECK-NEXT:    3: [B1.2] (Lifetime ends)
+// CHECK-NEXT:    4: [B3.4] (Lifetime ends)
+// CHECK-NEXT:    5: [B3.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B3
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B2]
+// CHECK-NEXT:    1: return;
+// CHECK-NEXT:    2: [B3.4] (Lifetime ends)
+// CHECK-NEXT:    3: [B3.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B3
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B3]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A a;
+// CHECK-NEXT:    3:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    4: A b;
+// CHECK-NEXT:    5: UV
+// CHECK-NEXT:    6: [B3.5] (ImplicitCastExpr, LValueToRValue, _Bool)
+// CHECK-NEXT:    T: if [B3.6]
+// CHECK-NEXT:    Preds (1): B4
+// CHECK-NEXT:    Succs (2): B2 B1
+
+// CHECK:      [B0 (EXIT)]
+// CHECK-NEXT:   Preds (2): B1 B2
+void test_return() {
+  A a;
+  A b;
+  if (UV)
+    return;
+  A c;
+}
+
+// CHECK:       [B5 (ENTRY)]
+// CHECK-NEXT:    Succs (1): B4
+// CHECK:       [B1]
+// CHECK-NEXT:    1: [B4.6] (Lifetime ends)
+// CHECK-NEXT:    2: [B4.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (2): B2 B3
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B2]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A c;
+// CHECK-NEXT:    3: [B2.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B4
+// CHECK-NEXT:    Succs (1): B1
+// CHECK:       [B3]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A c;
+// CHECK-NEXT:    3: [B3.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B4
+// CHECK-NEXT:    Succs (1): B1
+// CHECK:       [B4]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A a;
+// CHECK-NEXT:    3: a
+// CHECK-NEXT:    4: [B4.3] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    5: [B4.4] (CXXConstructExpr, class A)
+// CHECK-NEXT:    6: A b = a;
+// CHECK-NEXT:    7: b
+// CHECK-NEXT:    8: [B4.7] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    9: [B4.8].operator int
+// CHECK-NEXT:   10: [B4.8]
+// CHECK-NEXT:   11: [B4.10] (ImplicitCastExpr, UserDefinedConversion, int)
+// CHECK-NEXT:   12: [B4.11] (ImplicitCastExpr, IntegralToBoolean, _Bool)
+// CHECK-NEXT:    T: if [B4.12]
+// CHECK-NEXT:    Preds (1): B5
+// CHECK-NEXT:    Succs (2): B3 B2
+// CHECK:       [B0 (EXIT)]
+// CHECK-NEXT:    Preds (1): B1
+void test_if_implicit_scope() {
+  A a;
+  if (A b = a)
+    A c;
+  else
+    A c;
+}
+
+// CHECK:       [B9 (ENTRY)]
+// CHECK-NEXT:    Succs (1): B8
+// CHECK:       [B1]
+// CHECK-NEXT:    1: [B8.6] (Lifetime ends)
+// CHECK-NEXT:    2:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    3: A e;
+// CHECK-NEXT:    4: [B1.3] (Lifetime ends)
+// CHECK-NEXT:    5: [B8.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (2): B2 B5
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B2]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A d;
+// CHECK-NEXT:    3: [B2.2] (Lifetime ends)
+// CHECK-NEXT:    4: [B4.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B4
+// CHECK-NEXT:    Succs (1): B1
+// CHECK:       [B3]
+// CHECK-NEXT:    1: return;
+// CHECK-NEXT:    2: [B4.2] (Lifetime ends)
+// CHECK-NEXT:    3: [B8.6] (Lifetime ends)
+// CHECK-NEXT:    4: [B8.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B4
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B4]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A c;
+// CHECK-NEXT:    3: UV
+// CHECK-NEXT:    4: [B4.3] (ImplicitCastExpr, LValueToRValue, _Bool)
+// CHECK-NEXT:    T: if [B4.4]
+// CHECK-NEXT:    Preds (1): B8
+// CHECK-NEXT:    Succs (2): B3 B2
+// CHECK:       [B5]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A d;
+// CHECK-NEXT:    3: [B5.2] (Lifetime ends)
+// CHECK-NEXT:    4: [B7.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B7
+// CHECK-NEXT:    Succs (1): B1
+// CHECK:       [B6]
+// CHECK-NEXT:    1: return;
+// CHECK-NEXT:    2: [B7.2] (Lifetime ends)
+// CHECK-NEXT:    3: [B8.6] (Lifetime ends)
+// CHECK-NEXT:    4: [B8.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B7
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B7]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A c;
+// CHECK-NEXT:    3: UV
+// CHECK-NEXT:    4: [B7.3] (ImplicitCastExpr, LValueToRValue, _Bool)
+// CHECK-NEXT:    T: if [B7.4]
+// CHECK-NEXT:    Preds (1): B8
+// CHECK-NEXT:    Succs (2): B6 B5
+// CHECK:       [B8]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A a;
+// CHECK-NEXT:    3: a
+// CHECK-NEXT:    4: [B8.3] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    5: [B8.4] (CXXConstructExpr, class A)
+// CHECK-NEXT:    6: A b = a;
+// CHECK-NEXT:    7: b
+// CHECK-NEXT:    8: [B8.7] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    9: [B8.8].operator int
+// CHECK-NEXT:   10: [B8.8]
+// CHECK-NEXT:   11: [B8.10] (ImplicitCastExpr, UserDefinedConversion, int)
+// CHECK-NEXT:   12: [B8.11] (ImplicitCastExpr, IntegralToBoolean, _Bool)
+// CHECK-NEXT:    T: if [B8.12]
+// CHECK-NEXT:    Preds (1): B9
+// CHECK-NEXT:    Succs (2): B7 B4
+// CHECK:       [B0 (EXIT)]
+// CHECK-NEXT:    Preds (3): B1 B3 B6
+void test_if_jumps() {
+  A a;
+  if (A b = a) {
+    A c;
+    if (UV)
+      return;
+    A d;
+  } else {
+    A c;
+    if (UV)
+      return;
+    A d;
+  }
+  A e;
+}
+
+// CHECK:       [B6 (ENTRY)]
+// CHECK-NEXT:    Succs (1): B5
+// CHECK:       [B1]
+// CHECK-NEXT:    1: [B4.4] (Lifetime ends)
+// CHECK-NEXT:    2: [B5.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B4
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B2]
+// CHECK-NEXT:    Preds (1): B3
+// CHECK-NEXT:    Succs (1): B4
+// CHECK:       [B3]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A c;
+// CHECK-NEXT:    3: [B3.2] (Lifetime ends)
+// CHECK-NEXT:    4: [B4.4] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B4
+// CHECK-NEXT:    Succs (1): B2
+// CHECK:       [B4]
+// CHECK-NEXT:    1: a
+// CHECK-NEXT:    2: [B4.1] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    3: [B4.2] (CXXConstructExpr, class A)
+// CHECK-NEXT:    4: A b = a;
+// CHECK-NEXT:    5: b
+// CHECK-NEXT:    6: [B4.5] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    7: [B4.6].operator int
+// CHECK-NEXT:    8: [B4.6]
+// CHECK-NEXT:    9: [B4.8] (ImplicitCastExpr, UserDefinedConversion, int)
+// CHECK-NEXT:   10: [B4.9] (ImplicitCastExpr, IntegralToBoolean, _Bool)
+// CHECK-NEXT:    T: while [B4.10]
+// CHECK-NEXT:    Preds (2): B2 B5
+// CHECK-NEXT:    Succs (2): B3 B1
+// CHECK:       [B5]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A a;
+// CHECK-NEXT:    Preds (1): B6
+// CHECK-NEXT:    Succs (1): B4
+// CHECK:       [B0 (EXIT)]
+// CHECK-NEXT:    Preds (1): B1
+void test_while_implicit_scope() {
+  A a;
+  while (A b = a)
+    A c;
+}
+
+// CHECK:       [B12 (ENTRY)]
+// CHECK-NEXT:    Succs (1): B11
+// CHECK:       [B1]
+// CHECK-NEXT:    1: [B10.4] (Lifetime ends)
+// CHECK-NEXT:    2:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    3: A e;
+// CHECK-NEXT:    4: [B1.3] (Lifetime ends)
+// CHECK-NEXT:    5: [B11.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (2): B8 B10
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B2]
+// CHECK-NEXT:    Preds (2): B3 B6
+// CHECK-NEXT:    Succs (1): B10
+// CHECK:       [B3]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A d;
+// CHECK-NEXT:    3: [B3.2] (Lifetime ends)
+// CHECK-NEXT:    4: [B9.2] (Lifetime ends)
+// CHECK-NEXT:    5: [B10.4] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B5
+// CHECK-NEXT:    Succs (1): B2
+// CHECK:       [B4]
+// CHECK-NEXT:    1: return;
+// CHECK-NEXT:    2: [B9.2] (Lifetime ends)
+// CHECK-NEXT:    3: [B10.4] (Lifetime ends)
+// CHECK-NEXT:    4: [B11.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B5
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B5]
+// CHECK-NEXT:    1: UV
+// CHECK-NEXT:    2: [B5.1] (ImplicitCastExpr, LValueToRValue, _Bool)
+// CHECK-NEXT:    T: if [B5.2]
+// CHECK-NEXT:    Preds (1): B7
+// CHECK-NEXT:    Succs (2): B4 B3
+// CHECK:       [B6]
+// CHECK-NEXT:    1: [B9.2] (Lifetime ends)
+// CHECK-NEXT:    2: [B10.4] (Lifetime ends)
+// CHECK-NEXT:    T: continue;
+// CHECK-NEXT:    Preds (1): B7
+// CHECK-NEXT:    Succs (1): B2
+// CHECK:       [B7]
+// CHECK-NEXT:    1: UV
+// CHECK-NEXT:    2: [B7.1] (ImplicitCastExpr, LValueToRValue, _Bool)
+// CHECK-NEXT:    T: if [B7.2]
+// CHECK-NEXT:    Preds (1): B9
+// CHECK-NEXT:    Succs (2): B6 B5
+// CHECK:       [B8]
+// CHECK-NEXT:    1: [B9.2] (Lifetime ends)
+// CHECK-NEXT:    T: break;
+// CHECK-NEXT:    Preds (1): B9
+// CHECK-NEXT:    Succs (1): B1
+// CHECK:       [B9]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A c;
+// CHECK-NEXT:    3: UV
+// CHECK-NEXT:    4: [B9.3] (ImplicitCastExpr, LValueToRValue, _Bool)
+// CHECK-NEXT:    T: if [B9.4]
+// CHECK-NEXT:    Preds (1): B10
+// CHECK-NEXT:    Succs (2): B8 B7
+// CHECK:       [B10]
+// CHECK-NEXT:    1: a
+// CHECK-NEXT:    2: [B10.1] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    3: [B10.2] (CXXConstructExpr, class A)
+// CHECK-NEXT:    4: A b = a;
+// CHECK-NEXT:    5: b
+// CHECK-NEXT:    6: [B10.5] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    7: [B10.6].operator int
+// CHECK-NEXT:    8: [B10.6]
+// CHECK-NEXT:    9: [B10.8] (ImplicitCastExpr, UserDefinedConversion, int)
+// CHECK-NEXT:   10: [B10.9] (ImplicitCastExpr, IntegralToBoolean, _Bool)
+// CHECK-NEXT:    T: while [B10.10]
+// CHECK-NEXT:    Preds (2): B2 B11
+// CHECK-NEXT:    Succs (2): B9 B1
+// CHECK:       [B11]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A a;
+// CHECK-NEXT:    Preds (1): B12
+// CHECK-NEXT:    Succs (1): B10
+// CHECK:       [B0 (EXIT)]
+// CHECK-NEXT:    Preds (2): B1 B4
+void test_while_jumps() {
+  A a;
+  while (A b = a) {
+    A c;
+    if (UV)
+      break;
+    if (UV)
+      continue;
+    if (UV)
+      return;
+    A d;
+  }
+  A e;
+}
+
+// CHECK:       [B12 (ENTRY)]
+// CHECK-NEXT:    Succs (1): B11
+// CHECK:       [B1]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A d;
+// CHECK-NEXT:    3: [B1.2] (Lifetime ends)
+// CHECK-NEXT:    4: [B11.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (2): B8 B2
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B2]
+// CHECK-NEXT:    1: UV
+// CHECK-NEXT:    2: [B2.1] (ImplicitCastExpr, LValueToRValue, _Bool)
+// CHECK-NEXT:    T: do ... while [B2.2]
+// CHECK-NEXT:    Preds (2): B3 B6
+// CHECK-NEXT:    Succs (2): B10 B1
+// CHECK:       [B3]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A c;
+// CHECK-NEXT:    3: [B3.2] (Lifetime ends)
+// CHECK-NEXT:    4: [B9.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B5
+// CHECK-NEXT:    Succs (1): B2
+// CHECK:       [B4]
+// CHECK-NEXT:    1: return;
+// CHECK-NEXT:    2: [B9.2] (Lifetime ends)
+// CHECK-NEXT:    3: [B11.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B5
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B5]
+// CHECK-NEXT:    1: UV
+// CHECK-NEXT:    2: [B5.1] (ImplicitCastExpr, LValueToRValue, _Bool)
+// CHECK-NEXT:    T: if [B5.2]
+// CHECK-NEXT:    Preds (1): B7
+// CHECK-NEXT:    Succs (2): B4 B3
+// CHECK:       [B6]
+// CHECK-NEXT:    1: [B9.2] (Lifetime ends)
+// CHECK-NEXT:    T: continue;
+// CHECK-NEXT:    Preds (1): B7
+// CHECK-NEXT:    Succs (1): B2
+// CHECK:       [B7]
+// CHECK-NEXT:    1: UV
+// CHECK-NEXT:    2: [B7.1] (ImplicitCastExpr, LValueToRValue, _Bool)
+// CHECK-NEXT:    T: if [B7.2]
+// CHECK-NEXT:    Preds (1): B9
+// CHECK-NEXT:    Succs (2): B6 B5
+// CHECK:       [B8]
+// CHECK-NEXT:    1: [B9.2] (Lifetime ends)
+// CHECK-NEXT:    T: break;
+// CHECK-NEXT:    Preds (1): B9
+// CHECK-NEXT:    Succs (1): B1
+// CHECK:       [B9]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A b;
+// CHECK-NEXT:    3: UV
+// CHECK-NEXT:    4: [B9.3] (ImplicitCastExpr, LValueToRValue, _Bool)
+// CHECK-NEXT:    T: if [B9.4]
+// CHECK-NEXT:    Preds (2): B10 B11
+// CHECK-NEXT:    Succs (2): B8 B7
+// CHECK:       [B10]
+// CHECK-NEXT:    Preds (1): B2
+// CHECK-NEXT:    Succs (1): B9
+// CHECK:       [B11]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A a;
+// CHECK-NEXT:    Preds (1): B12
+// CHECK-NEXT:    Succs (1): B9
+// CHECK:       [B0 (EXIT)]
+// CHECK-NEXT:    Preds (2): B1 B4
+void test_do_jumps() {
+  A a;
+  do {
+    A b;
+    if (UV)
+      break;
+    if (UV)
+      continue;
+    if (UV)
+      return;
+    A c;
+  } while (UV);
+  A d;
+}
+
+// CHECK:       [B6 (ENTRY)]
+// CHECK-NEXT:    Succs (1): B5
+// CHECK:       [B1]
+// CHECK-NEXT:    1: [B4.4] (Lifetime ends)
+// CHECK-NEXT:    2: [B5.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B4
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B2]
+// CHECK-NEXT:    Preds (1): B3
+// CHECK-NEXT:    Succs (1): B4
+// CHECK:       [B3]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A c;
+// CHECK-NEXT:    3: [B3.2] (Lifetime ends)
+// CHECK-NEXT:    4: [B4.4] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B4
+// CHECK-NEXT:    Succs (1): B2
+// CHECK:       [B4]
+// CHECK-NEXT:    1: a
+// CHECK-NEXT:    2: [B4.1] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    3: [B4.2] (CXXConstructExpr, class A)
+// CHECK-NEXT:    4: A b = a;
+// CHECK-NEXT:    5: b
+// CHECK-NEXT:    6: [B4.5] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    7: [B4.6].operator int
+// CHECK-NEXT:    8: [B4.6]
+// CHECK-NEXT:    9: [B4.8] (ImplicitCastExpr, UserDefinedConversion, int)
+// CHECK-NEXT:   10: [B4.9] (ImplicitCastExpr, IntegralToBoolean, _Bool)
+// CHECK-NEXT:    T: for (...; [B4.10]; )
+// CHECK-NEXT:    Preds (2): B2 B5
+// CHECK-NEXT:    Succs (2): B3 B1
+// CHECK:       [B5]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A a;
+// CHECK-NEXT:    Preds (1): B6
+// CHECK-NEXT:    Succs (1): B4
+// CHECK:       [B0 (EXIT)]
+// CHECK-NEXT:    Preds (1): B1
+void test_for_implicit_scope() {
+  for (A a; A b = a;)
+    A c;
+}
+
+// CHECK:       [B12 (ENTRY)]
+// CHECK-NEXT:    Succs (1): B11
+// CHECK:       [B1]
+// CHECK-NEXT:    1: [B10.4] (Lifetime ends)
+// CHECK-NEXT:    2: [B11.4] (Lifetime ends)
+// CHECK-NEXT:    3:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    4: A f;
+// CHECK-NEXT:    5: [B1.4] (Lifetime ends)
+// CHECK-NEXT:    6: [B11.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (2): B8 B10
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B2]
+// CHECK-NEXT:    Preds (2): B3 B6
+// CHECK-NEXT:    Succs (1): B10
+// CHECK:       [B3]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A e;
+// CHECK-NEXT:    3: [B3.2] (Lifetime ends)
+// CHECK-NEXT:    4: [B9.2] (Lifetime ends)
+// CHECK-NEXT:    5: [B10.4] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B5
+// CHECK-NEXT:    Succs (1): B2
+// CHECK:       [B4]
+// CHECK-NEXT:    1: return;
+// CHECK-NEXT:    2: [B9.2] (Lifetime ends)
+// CHECK-NEXT:    3: [B10.4] (Lifetime ends)
+// CHECK-NEXT:    4: [B11.4] (Lifetime ends)
+// CHECK-NEXT:    5: [B11.2] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B5
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B5]
+// CHECK-NEXT:    1: UV
+// CHECK-NEXT:    2: [B5.1] (ImplicitCastExpr, LValueToRValue, _Bool)
+// CHECK-NEXT:    T: if [B5.2]
+// CHECK-NEXT:    Preds (1): B7
+// CHECK-NEXT:    Succs (2): B4 B3
+// CHECK:       [B6]
+// CHECK-NEXT:    1: [B9.2] (Lifetime ends)
+// CHECK-NEXT:    T: continue;
+// CHECK-NEXT:    Preds (1): B7
+// CHECK-NEXT:    Succs (1): B2
+// CHECK:       [B7]
+// CHECK-NEXT:    1: UV
+// CHECK-NEXT:    2: [B7.1] (ImplicitCastExpr, LValueToRValue, _Bool)
+// CHECK-NEXT:    T: if [B7.2]
+// CHECK-NEXT:    Preds (1): B9
+// CHECK-NEXT:    Succs (2): B6 B5
+// CHECK:       [B8]
+// CHECK-NEXT:    1: [B9.2] (Lifetime ends)
+// CHECK-NEXT:    T: break;
+// CHECK-NEXT:    Preds (1): B9
+// CHECK-NEXT:    Succs (1): B1
+// CHECK:       [B9]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A d;
+// CHECK-NEXT:    3: UV
+// CHECK-NEXT:    4: [B9.3] (ImplicitCastExpr, LValueToRValue, _Bool)
+// CHECK-NEXT:    T: if [B9.4]
+// CHECK-NEXT:    Preds (1): B10
+// CHECK-NEXT:    Succs (2): B8 B7
+// CHECK:       [B10]
+// CHECK-NEXT:    1: b
+// CHECK-NEXT:    2: [B10.1] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    3: [B10.2] (CXXConstructExpr, class A)
+// CHECK-NEXT:    4: A c = b;
+// CHECK-NEXT:    5: c
+// CHECK-NEXT:    6: [B10.5] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    7: [B10.6].operator int
+// CHECK-NEXT:    8: [B10.6]
+// CHECK-NEXT:    9: [B10.8] (ImplicitCastExpr, UserDefinedConversion, int)
+// CHECK-NEXT:   10: [B10.9] (ImplicitCastExpr, IntegralToBoolean, _Bool)
+// CHECK-NEXT:    T: for (...; [B10.10]; )
+// CHECK-NEXT:    Preds (2): B2 B11
+// CHECK-NEXT:    Succs (2): B9 B1
+// CHECK:       [B11]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A a;
+// CHECK-NEXT:    3:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    4: A b;
+// CHECK-NEXT:    Preds (1): B12
+// CHECK-NEXT:    Succs (1): B10
+// CHECK:       [B0 (EXIT)]
+// CHECK-NEXT:    Preds (2): B1 B4
+void test_for_jumps() {
+  A a;
+  for (A b; A c = b;) {
+    A d;
+    if (UV)
+      break;
+    if (UV)
+      continue;
+    if (UV)
+      return;
+    A e;
+  }
+  A f;
+}
+
+// CHECK:       [B2 (ENTRY)]
+// CHECK-NEXT:    Succs (1): B1
+// CHECK:       [B1]
+// CHECK-NEXT:    1:  (CXXConstructExpr, class A)
+// CHECK-NEXT:    2: A a;
+// CHECK-NEXT:    3: int n;
+// CHECK-NEXT:    4: n
+// CHECK-NEXT:    5: &[B1.4]
+// CHECK-NEXT:    6: a
+// CHECK-NEXT:    7: [B1.6].p
+// CHECK-NEXT:    8: [B1.7] = [B1.5]
+// CHECK-NEXT:    9: [B1.2] (Lifetime ends)
+// CHECK-NEXT:   10: [B1.3] (Lifetime ends)
+// CHECK-NEXT:    Preds (1): B2
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B0 (EXIT)]
+// CHECK-NEXT:    Preds (1): B1
+void test_trivial_vs_non_trivial_order() {
+  A a;
+  int n;
+  a.p = &n;
+}
+
+// CHECK:       [B4 (ENTRY)]
+// CHECK-NEXT:    Succs (1): B3
+// CHECK:       [B1]
+// CHECK-NEXT:   a:
+// CHECK-NEXT:    1: 1
+// CHECK-NEXT:    2: i
+// CHECK-NEXT:    3: [B1.2] = [B1.1]
+// CHECK-NEXT:    4: [B2.1] (Lifetime ends)
+// CHECK-NEXT:    Preds (2): B2 B3
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B2]
+// CHECK-NEXT:    1: int i;
+// CHECK-NEXT:    Succs (1): B1
+// CHECK:       [B3]
+// CHECK-NEXT:    T: goto a;
+// CHECK-NEXT:    Preds (1): B4
+// CHECK-NEXT:    Succs (1): B1
+// CHECK:       [B0 (EXIT)]
+// CHECK-NEXT:    Preds (1): B1
+void goto_past_declaration() {
+  goto a;
+  int i;
+a:
+  i = 1;
+}
+
+// CHECK:       [B4 (ENTRY)]
+// CHECK-NEXT:    Succs (1): B3
+// CHECK:       [B1]
+// CHECK-NEXT:   a:
+// CHECK-NEXT:    1: 1
+// CHECK-NEXT:    2: k
+// CHECK-NEXT:    3: [B1.2] = [B1.1]
+// CHECK-NEXT:    4: [B2.4] (Lifetime ends)
+// CHECK-NEXT:    Preds (2): B2 B3
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B2]
+// CHECK-NEXT:    1: int j;
+// CHECK-NEXT:    2: [B2.1] (Lifetime ends)
+// CHECK-NEXT:    3: [B3.1] (Lifetime ends)
+// CHECK-NEXT:    4: int k;
+// CHECK-NEXT:    Succs (1): B1
+// CHECK:       [B3]
+// CHECK-NEXT:    1: int i;
+// CHECK-NEXT:    2: [B3.1] (Lifetime ends)
+// CHECK-NEXT:    T: goto a;
+// CHECK-NEXT:    Preds (1): B4
+// CHECK-NEXT:    Succs (1): B1
+// CHECK:       [B0 (EXIT)]
+// CHECK-NEXT:    Preds (1): B1
+void goto_past_declaration2() {
+  {
+    int i;
+    goto a;
+    int j;
+  }
+  {
+    int k;
+  a:
+    k = 1;
+  }
+}
+
+struct B {
+  ~B();
+};
+
+// CHECK:       [B4 (ENTRY)]
+// CHECK-NEXT:    Succs (1): B3
+// CHECK:       [B1]
+// CHECK-NEXT:    1: i
+// CHECK-NEXT:    2: [B1.1]++
+// CHECK-NEXT:    3: [B2.2] (Lifetime ends)
+// CHECK-NEXT:    4: [B3.1] (Lifetime ends)
+// CHECK-NEXT:    Succs (1): B0
+// CHECK:       [B2]
+// CHECK-NEXT:   label:
+// CHECK-NEXT:    1:  (CXXConstructExpr, struct B)
+// CHECK-NEXT:    2: B b;
+// CHECK-NEXT:    3: [B2.2] (Lifetime ends)
+// CHECK-NEXT:    T: goto label;
+// CHECK-NEXT:    Preds (2): B3 B2
+// CHECK-NEXT:    Succs (1): B2
+// CHECK:       [B3]
+// CHECK-NEXT:    1: int i;
+// CHECK-NEXT:    Preds (1): B4
+// CHECK-NEXT:    Succs (1): B2
+// CHECK:       [B0 (EXIT)]
+// CHECK-NEXT:    Preds (1): B1
+int backpatched_goto() {
+  int i;
+label:
+  B b;
+  goto label;
+  i++;
+}