[analyzer] Model lifetime of a variable declared in for condition in CFG correctly

[tomasz-kaminski-sonarsource]

Summary

Per [stmt.for] p1 (https://eel.is/c++draft/stmt.for#1) the following
for and while statements are equivalent

for (; A c = b; b.c) {
  A d;
}

while (A c = b) {
  A d;
  b.c;
}

As a consequence, the variable declared for the condition expression
should be destroyed after the increment expression.

This fixed the handling of the object lifetime continue, and now
destructors, scope and lifetime elements are present for continue
path in following code:

for (; A c = b; b.c) {
  if (cond)
     continue;
  A d;
}

[tomasz-kaminski-sonarsource]

clang/test/Analysis/lifetime-cfg-output.cpp

607

Note that the lifetime ends for [B10.4]/c was missing here for the continue case, as we jumped to increment block. Same happens for the automatic object destructor that was not called in this case.

[xazax.hun]

clang/test/Analysis/auto-obj-dtors-cfg-output.cpp

1228

Would there be any value in also keeping a couple of the original test cases? (When we have empty increment blocks).

How about a test case where the increment operation generates multiple basic blocks (e.g., have a ternary)?

[tomasz-kaminski-sonarsource]

Updated unit tests

clang/test/Analysis/auto-obj-dtors-cfg-output.cpp

1228

Would there be any value in also keeping a couple of the original test cases? (When we have empty increment blocks).

I have removed the increment op from test_for_jumps, to cover both situation without extending the number of test.

How about a test case where the increment operation generates multiple basic blocks (e.g., have a ternary)?

Added, check test_for_inc_conditional.

[tomasz-kaminski-sonarsource]

clang/lib/Analysis/CFG.cpp

3511

To help clarify, the code always created a transition block, that could be empty.
This block will either contain an increment statement or be the successor for any blocks created from increment statements.
And we are filling this transition block with the handling of the condition variable.

[xazax.hun]

LG, thanks!

[tomasz-kaminski-sonarsource]

clang/test/Analysis/lifetime-cfg-output.cpp

1

@xazax.hun
A side question, this test disables cfg-temporary-dtors, cfg-rich-constructors, and cfg-implicit-dtors that are enabled by default for the analyzer.
This was done because our changes D153273 these functionalities were incompatible, and there were assertions triggering.
I would like to update the test to just enable cfg-lifetime similarly to what cfg-scopes do, so we catch any regressions, however, we will not test this functionality alone.
Is this something you (upstream) would accept? If so I can create NFC patch.

[steakhal]

clang/test/Analysis/lifetime-cfg-output.cpp

1

Makes sense to me.

[xazax.hun]

clang/test/Analysis/lifetime-cfg-output.cpp

1

Sounds good to me.

[tomasz-kaminski-sonarsource]

clang/test/Analysis/lifetime-cfg-output.cpp

1

This is https://reviews.llvm.org/D155694.

clang/lib/Analysis/CFG.cpp

// Now create the loop body.
 
     // Save the current values for Block, Succ, continue and break targets.
     SaveAndRestore save_Block(Block), save_Succ(Succ);
     SaveAndRestore save_continue(ContinueJumpTarget);
 
     // Create an empty block to represent the transition block for looping back
     // to the head of the loop.  If we have increment code, it will
     // go in this block as well.
     Block = Succ = TransitionBlock = createBlock(false);
     TransitionBlock->setLoopTarget(F);
 
+
+    // Loop iteration (after increment) should end with destructor of Condition
+    // variable (if any).
+    addAutomaticObjHandling(ScopePos, LoopBeginScopePos, F);
+
     if (Stmt *I = F->getInc()) {
       // Generate increment code in its own basic block.  This is the target of
       // continue statements.
       Succ = addStmt(I);
     }
 
     // Finish up the increment (or empty) block if it hasn't been already.
     if (Block) {
       assert(Block == Succ);
       if (badCFG)
         return nullptr;
       Block = nullptr;
     }
 
    // The starting block for the loop increment is the block that should
    // represent the 'loop target' for looping back to the start of the loop.
    ContinueJumpTarget = JumpTarget(Succ, ContinueScopePos);
    ContinueJumpTarget.block->setLoopTarget(F);
 
-    // Loop body should end with destructor of Condition variable (if any).
-   addAutomaticObjHandling(ScopePos, LoopBeginScopePos, F);
 
     // If body is not a compound statement create implicit scope
     // and add destructors.
     if (!isa<CompoundStmt>(F->getBody()))
       addLocalScopeAndDtors(F->getBody());
 
     // Now populate the body block, and in the process create new blocks as we
     // walk the body of the loop.

clang/test/Analysis/auto-obj-dtors-cfg-output.cpp

 // CHECK:      [B6 (ENTRY)]
 // CHECK-NEXT:   Succs (1): B5
 // CHECK:      [B1]
 // CHECK-NEXT:   1: [B4.4].~A() (Implicit destructor)
 // CHECK-NEXT:   2: [B5.2].~A() (Implicit destructor)
 // CHECK-NEXT:   Preds (1): B4
 // CHECK-NEXT:   Succs (1): B0
 // CHECK:      [B2]
+// CHECK-NEXT:   1: b
+// CHECK-NEXT:   2: [B2.1].x
+// CHECK-NEXT:   3: ++[B2.2]
+// CHECK-NEXT:   4: [B4.4].~A() (Implicit destructor)
 // CHECK-NEXT:   Preds (1): B3
 // CHECK-NEXT:   Succs (1): B4
 // CHECK:      [B3]
 // WARNINGS-NEXT:   1:  (CXXConstructExpr, A)
 // ANALYZER-NEXT:   1:  (CXXConstructExpr, [B3.2], A)
 // CHECK-NEXT:   2: A c;
 // CHECK-NEXT:   3: [B3.2].~A() (Implicit destructor)
-// CHECK-NEXT:   4: [B4.4].~A() (Implicit destructor)
 // CHECK-NEXT:   Preds (1): B4
 // CHECK-NEXT:   Succs (1): B2
 // CHECK:      [B4]
 // CHECK-NEXT:   1: a
 // CHECK-NEXT:   2: [B4.1] (ImplicitCastExpr, NoOp, const A)
 // WARNINGS-NEXT:   3: [B4.2] (CXXConstructExpr, A)
 // ANALYZER-NEXT:   3: [B4.2] (CXXConstructExpr, [B4.4], A)
 // CHECK-NEXT:   4: A b = a;
 // CHECK-NEXT:   5: b
 // CHECK-NEXT:   6: [B4.5] (ImplicitCastExpr, NoOp, const class A)
 // CHECK-NEXT:   7: [B4.6].operator int
 // CHECK-NEXT:   8: [B4.6]
 // CHECK-NEXT:   9: [B4.8] (ImplicitCastExpr, UserDefinedConversion, int)
 // CHECK:       10: [B4.9] (ImplicitCastExpr, IntegralToBoolean, _Bool)
-// CHECK-NEXT:   T: for (...; [B4.10]; )
+// CHECK-NEXT:   T: for (...; [B4.10]; ...)
 // CHECK-NEXT:   Preds (2): B2 B5
 // CHECK-NEXT:   Succs (2): B3 B1
 // CHECK:      [B5]
 // WARNINGS-NEXT:   1:  (CXXConstructExpr, A)
 // ANALYZER-NEXT:   1:  (CXXConstructExpr, [B5.2], A)
 // CHECK-NEXT:   2: A a;
 // CHECK-NEXT:   Preds (1): B6
 // CHECK-NEXT:   Succs (1): B4
 // CHECK:      [B0 (EXIT)]
 // CHECK-NEXT:   Preds (1): B1
 void test_for_implicit_scope() {
-  for (A a; A b = a; )
+  for (A a; A b = a; ++b.x)
     A c;
 }
 
 // CHECK-LABEL: void test_for_range_implicit_scope()
 // CHECK:      [B5 (ENTRY)]
 // CHECK-NEXT:   Succs (1): B4
 // CHECK:      [B1]
 // CHECK-NEXT:   1: __begin1

 // WARNINGS-NEXT:   3:  (CXXConstructExpr, A)
 // ANALYZER-NEXT:   3:  (CXXConstructExpr, [B1.4], A)
 // CHECK-NEXT:   4: A f;
 // CHECK-NEXT:   5: [B1.4].~A() (Implicit destructor)
 // CHECK-NEXT:   6: [B11.2].~A() (Implicit destructor)
 // CHECK-NEXT:   Preds (2): B8 B10
 // CHECK-NEXT:   Succs (1): B0
 // CHECK:      [B2]
+// CHECK-NEXT:   1: [B10.4].~A() (Implicit destructor)
 // CHECK-NEXT:   Preds (2): B3 B6
 // CHECK-NEXT:   Succs (1): B10
 // CHECK:      [B3]
 // WARNINGS-NEXT:   1:  (CXXConstructExpr, A)
 // ANALYZER-NEXT:   1:  (CXXConstructExpr, [B3.2], A)
 // CHECK-NEXT:   2: A e;
 // CHECK-NEXT:   3: [B3.2].~A() (Implicit destructor)
 // CHECK-NEXT:   4: [B9.2].~A() (Implicit destructor)
-// CHECK-NEXT:   5: [B10.4].~A() (Implicit destructor)
 // CHECK-NEXT:   Preds (1): B5
 // CHECK-NEXT:   Succs (1): B2
 // CHECK:      [B4]
 // CHECK-NEXT:   1: return;
 // CHECK-NEXT:   2: [B9.2].~A() (Implicit destructor)
 // CHECK-NEXT:   3: [B10.4].~A() (Implicit destructor)
 // CHECK-NEXT:   4: [B11.4].~A() (Implicit destructor)
 // CHECK-NEXT:   5: [B11.2].~A() (Implicit destructor)

 // ANALYZER-NEXT:   3:  (CXXConstructExpr, [B11.4], A)
 // CHECK-NEXT:   4: A b;
 // CHECK-NEXT:   Preds (1): B12
 // CHECK-NEXT:   Succs (1): B10
 // CHECK:      [B0 (EXIT)]
 // CHECK-NEXT:   Preds (2): B1 B4
 void test_for_jumps() {
   A a;
-  for (A b; A c = b; ) {
+  for (A b; A c = b;) {
     A d;
     if (UV) break;
     if (UV) continue;
     if (UV) return;
     A e;
   }
   A f;
 }
 
+// CHECK:        [B9 (ENTRY)]
+// CHECK-NEXT:     Succs (1): B8
+// CHECK:        [B1]
+// CHECK-NEXT:     1: [B7.4].~A() (Implicit destructor)
+// CHECK-NEXT:     2: [B8.2].~A() (Implicit destructor)
+// CHECK-NEXT:     Preds (1): B7
+// CHECK-NEXT:     Succs (1): B0
+// CHECK:        [B2]
+// CHECK-NEXT:     1: [B5.4] ? [B3.3] : [B4.1]
+// CHECK-NEXT:     2: [B7.4].~A() (Implicit destructor)
+// CHECK-NEXT:     Preds (2): B3 B4
+// CHECK-NEXT:     Succs (1): B7
+// CHECK:        [B3]
+// CHECK-NEXT:     1: b
+// CHECK-NEXT:     2: [B3.1].x
+// CHECK-NEXT:     3: [B3.2]++
+// CHECK-NEXT:     Preds (1): B5
+// CHECK-NEXT:     Succs (1): B2
+// CHECK:        [B4]
+// CHECK-NEXT:     1: 0
+// CHECK-NEXT:     Preds (1): B5
+// CHECK-NEXT:     Succs (1): B2
+// CHECK:        [B5]
+// CHECK-NEXT:     1: b
+// CHECK-NEXT:     2: [B5.1].x
+// CHECK-NEXT:     3: [B5.2] (ImplicitCastExpr, LValueToRValue, int)
+// CHECK-NEXT:     4: [B5.3] (ImplicitCastExpr, IntegralToBoolean, _Bool)
+// CHECK-NEXT:     T: [B5.4] ? ... : ...
+// CHECK-NEXT:     Preds (1): B6
+// CHECK-NEXT:     Succs (2): B3 B4
+// CHECK:        [B6]
+// CHECK-NEXT:     1: 0
+// CHECK-NEXT:     2: (void)[B6.1] (CStyleCastExpr, ToVoid, void)
+// CHECK-NEXT:     Preds (1): B7
+// CHECK-NEXT:     Succs (1): B5
+// CHECK:        [B7]
+// CHECK-NEXT:     1: a
+// CHECK-NEXT:     2: [B7.1] (ImplicitCastExpr, NoOp, const A)
+// WARNINGS-NEXT:  3: [B7.2] (CXXConstructExpr, A)
+// ANALYZER-NEXT:  3: [B7.2] (CXXConstructExpr, [B7.4], A)
+// CHECK-NEXT:     4: A b = a;
+// CHECK-NEXT:     5: b
+// CHECK-NEXT:     6: [B7.5] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:     7: [B7.6].operator int
+// CHECK-NEXT:     8: [B7.6]
+// CHECK-NEXT:     9: [B7.8] (ImplicitCastExpr, UserDefinedConversion, int)
+// CHECK-NEXT:    10: [B7.9] (ImplicitCastExpr, IntegralToBoolean, _Bool)
+// CHECK-NEXT:     T: for (...; [B7.10]; ...)
+// CHECK-NEXT:     Preds (2): B2 B8
+// CHECK-NEXT:     Succs (2): B6 B1
+// CHECK:        [B8]
+// WARNINGS-NEXT:  1:  (CXXConstructExpr, A)
+// ANALYZER-NEXT:  1:  (CXXConstructExpr, [B8.2], A)
+// CHECK-NEXT:     2: A a;
+// CHECK-NEXT:     Preds (1): B9
+// CHECK-NEXT:     Succs (1): B7
+void test_for_inc_conditional() {
+  for (A a; A b = a; b.x ? b.x++ : 0)
+    (void)0;
+}
+
 // CHECK:      [B3 (ENTRY)]
 // CHECK-NEXT:   Succs (1): B0
 // CHECK:      [B1]
 // CHECK-NEXT:   T: try ...
 // CHECK-NEXT:   Succs (2): B2 B0
 // CHECK:      [B2]
 // CHECK-NEXT:  catch (const A &e):
 // CHECK-NEXT:   1: catch (const A &e) {

clang/test/Analysis/lifetime-cfg-output.cpp

 // RUN: %clang_cc1 -fcxx-exceptions -fexceptions -analyze -analyzer-checker=debug.DumpCFG -analyzer-config cfg-lifetime=true,cfg-temporary-dtors=false,cfg-rich-constructors=false -analyzer-config cfg-implicit-dtors=false %s > %t 2>&1
 // RUN: FileCheck --input-file=%t %s
 
 extern bool UV;
 class A {
 public:
   // CHECK:       [B2 (ENTRY)]
   // CHECK-NEXT:    Succs (1): B1
   // CHECK:       [B1]

 // CHECK:       [B6 (ENTRY)]
 // CHECK-NEXT:    Succs (1): B5
 // CHECK:       [B1]
 // CHECK-NEXT:    1: [B4.4] (Lifetime ends)
 // CHECK-NEXT:    2: [B5.2] (Lifetime ends)
 // CHECK-NEXT:    Preds (1): B4
 // CHECK-NEXT:    Succs (1): B0
 // CHECK:       [B2]
+// CHECK-NEXT:    1: b
+// CHECK-NEXT:    2: [B2.1].p
+// CHECK-NEXT:    3: [B4.4] (Lifetime ends)
 // CHECK-NEXT:    Preds (1): B3
 // CHECK-NEXT:    Succs (1): B4
 // CHECK:       [B3]
 // CHECK-NEXT:    1:  (CXXConstructExpr, A)
 // CHECK-NEXT:    2: A c;
 // CHECK-NEXT:    3: [B3.2] (Lifetime ends)
-// CHECK-NEXT:    4: [B4.4] (Lifetime ends)
 // CHECK-NEXT:    Preds (1): B4
 // CHECK-NEXT:    Succs (1): B2
 // CHECK:       [B4]
 // CHECK-NEXT:    1: a
 // CHECK-NEXT:    2: [B4.1] (ImplicitCastExpr, NoOp, const A)
 // CHECK-NEXT:    3: [B4.2] (CXXConstructExpr, A)
 // CHECK-NEXT:    4: A b = a;
 // CHECK-NEXT:    5: b
 // CHECK-NEXT:    6: [B4.5] (ImplicitCastExpr, NoOp, const class A)
 // CHECK-NEXT:    7: [B4.6].operator int
 // CHECK-NEXT:    8: [B4.6]
 // CHECK-NEXT:    9: [B4.8] (ImplicitCastExpr, UserDefinedConversion, int)
 // CHECK-NEXT:   10: [B4.9] (ImplicitCastExpr, IntegralToBoolean, _Bool)
-// CHECK-NEXT:    T: for (...; [B4.10]; )
+// CHECK-NEXT:    T: for (...; [B4.10]; ...)
 // CHECK-NEXT:    Preds (2): B2 B5
 // CHECK-NEXT:    Succs (2): B3 B1
 // CHECK:       [B5]
 // CHECK-NEXT:    1:  (CXXConstructExpr, A)
 // CHECK-NEXT:    2: A a;
 // CHECK-NEXT:    Preds (1): B6
 // CHECK-NEXT:    Succs (1): B4
 // CHECK:       [B0 (EXIT)]
 // CHECK-NEXT:    Preds (1): B1
 void test_for_implicit_scope() {
-  for (A a; A b = a;)
+  for (A a; A b = a; b.p)
     A c;
 }
 
 // CHECK:       [B12 (ENTRY)]
 // CHECK-NEXT:    Succs (1): B11
 // CHECK:       [B1]
 // CHECK-NEXT:    1: [B10.4] (Lifetime ends)
 // CHECK-NEXT:    2: [B11.4] (Lifetime ends)
 // CHECK-NEXT:    3:  (CXXConstructExpr, A)
 // CHECK-NEXT:    4: A f;
 // CHECK-NEXT:    5: [B1.4] (Lifetime ends)
 // CHECK-NEXT:    6: [B11.2] (Lifetime ends)
 // CHECK-NEXT:    Preds (2): B8 B10
 // CHECK-NEXT:    Succs (1): B0
 // CHECK:       [B2]
+// CHECK-NEXT:    1: [B10.4] (Lifetime ends)
 // CHECK-NEXT:    Preds (2): B3 B6
 // CHECK-NEXT:    Succs (1): B10
 // CHECK:       [B3]
 // CHECK-NEXT:    1:  (CXXConstructExpr, A)
 // CHECK-NEXT:    2: A e;
 // CHECK-NEXT:    3: [B3.2] (Lifetime ends)
 // CHECK-NEXT:    4: [B9.2] (Lifetime ends)
-// CHECK-NEXT:    5: [B10.4] (Lifetime ends)
 // CHECK-NEXT:    Preds (1): B5
 // CHECK-NEXT:    Succs (1): B2
 // CHECK:       [B4]
 // CHECK-NEXT:    1: return;
 // CHECK-NEXT:    2: [B9.2] (Lifetime ends)
 // CHECK-NEXT:    3: [B10.4] (Lifetime ends)
 // CHECK-NEXT:    4: [B11.4] (Lifetime ends)
 // CHECK-NEXT:    5: [B11.2] (Lifetime ends)
 // CHECK-NEXT:    Preds (1): B5
 // CHECK-NEXT:    Succs (1): B0
 // CHECK:       [B5]
 // CHECK-NEXT:    1: UV
 // CHECK-NEXT:    2: [B5.1] (ImplicitCastExpr, LValueToRValue, _Bool)
 // CHECK-NEXT:    T: if [B5.2]
 // CHECK-NEXT:    Preds (1): B7
 // CHECK-NEXT:    Succs (2): B4 B3
 // CHECK:       [B6]
 // CHECK-NEXT:    1: [B9.2] (Lifetime ends)
 // CHECK-NEXT:    T: continue;
 // CHECK-NEXT:    Preds (1): B7
 // CHECK-NEXT:    Succs (1): B2
 // CHECK:       [B7]
 // CHECK-NEXT:    1: UV
 // CHECK-NEXT:    2: [B7.1] (ImplicitCastExpr, LValueToRValue, _Bool)
 // CHECK-NEXT:    T: if [B7.2]
 // CHECK-NEXT:    Preds (1): B9
 // CHECK-NEXT:    Succs (2): B6 B5

 // CHECK-NEXT:    3:  (CXXConstructExpr, A)
 // CHECK-NEXT:    4: A b;
 // CHECK-NEXT:    Preds (1): B12
 // CHECK-NEXT:    Succs (1): B10
 // CHECK:       [B0 (EXIT)]
 // CHECK-NEXT:    Preds (2): B1 B4
 void test_for_jumps() {
   A a;
-  for (A b; A c = b;) {
+  for (A b; A c = b; ) {
     A d;
     if (UV)
       break;
     if (UV)
       continue;
     if (UV)
       return;
     A e;
   }
   A f;
 }
 
+// CHECK:      [B9 (ENTRY)]
+// CHECK-NEXT:   Succs (1): B8
+// CHECK:      [B1]
+// CHECK-NEXT:   1: [B7.4] (Lifetime ends)
+// CHECK-NEXT:   2: [B8.2] (Lifetime ends)
+// CHECK-NEXT:   Preds (1): B7
+// CHECK-NEXT:   Succs (1): B0
+// CHECK:      [B2]
+// CHECK-NEXT:   1: [B5.4] ? [B3.3] : [B4.2]
+// CHECK-NEXT:   2: [B7.4] (Lifetime ends)
+// CHECK-NEXT:   Preds (2): B3 B4
+// CHECK-NEXT:   Succs (1): B7
+// CHECK:      [B3]
+// CHECK-NEXT:   1: b
+// CHECK-NEXT:   2: [B3.1].p
+// CHECK-NEXT:   3: [B3.2]++
+// CHECK-NEXT:   Preds (1): B5
+// CHECK-NEXT:   Succs (1): B2
+// CHECK:      [B4]
+// CHECK-NEXT:   1: 0
+// CHECK-NEXT:   2: [B4.1] (ImplicitCastExpr, NullToPointer, int *)
+// CHECK-NEXT:   Preds (1): B5
+// CHECK-NEXT:   Succs (1): B2
+// CHECK:      [B5]
+// CHECK-NEXT:   1: b
+// CHECK-NEXT:   2: [B5.1].p
+// CHECK-NEXT:   3: [B5.2] (ImplicitCastExpr, LValueToRValue, int *)
+// CHECK-NEXT:   4: [B5.3] (ImplicitCastExpr, PointerToBoolean, _Bool)
+// CHECK-NEXT:   T: [B5.4] ? ... : ...
+// CHECK-NEXT:   Preds (1): B6
+// CHECK-NEXT:   Succs (2): B3 B4
+// CHECK:      [B6]
+// CHECK-NEXT:   1: 0
+// CHECK-NEXT:   2: (void)[B6.1] (CStyleCastExpr, ToVoid, void)
+// CHECK-NEXT:   Preds (1): B7
+// CHECK-NEXT:   Succs (1): B5
+// CHECK:      [B7]
+// CHECK-NEXT:   1: a
+// CHECK-NEXT:   2: [B7.1] (ImplicitCastExpr, NoOp, const A)
+// CHECK-NEXT:   3: [B7.2] (CXXConstructExpr, A)
+// CHECK-NEXT:   4: A b = a;
+// CHECK-NEXT:   5: b
+// CHECK-NEXT:   6: [B7.5] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:   7: [B7.6].operator int
+// CHECK-NEXT:   8: [B7.6]
+// CHECK-NEXT:   9: [B7.8] (ImplicitCastExpr, UserDefinedConversion, int)
+// CHECK-NEXT:  10: [B7.9] (ImplicitCastExpr, IntegralToBoolean, _Bool)
+// CHECK-NEXT:   T: for (...; [B7.10]; ...)
+// CHECK-NEXT:   Preds (2): B2 B8
+// CHECK-NEXT:   Succs (2): B6 B1
+// CHECK:      [B8]
+// CHECK-NEXT:   1:  (CXXConstructExpr, A)
+// CHECK-NEXT:   2: A a;
+// CHECK-NEXT:   Preds (1): B9
+// CHECK-NEXT:   Succs (1): B7
+void test_for_inc_conditional() {
+  for (A a; A b = a; b.p ? b.p++ : 0)
+    (void)0;
+}
+
 // CHECK:       [B2 (ENTRY)]
 // CHECK-NEXT:    Succs (1): B1
 // CHECK:       [B1]
 // CHECK-NEXT:    1:  (CXXConstructExpr, A)
 // CHECK-NEXT:    2: A a;
 // CHECK-NEXT:    3: int n;
 // CHECK-NEXT:    4: n
 // CHECK-NEXT:    5: &[B1.4]

clang/test/Analysis/scopes-cfg-output.cpp

 // CHECK:      [B1]
 // CHECK-NEXT:   1: 1
 // CHECK-NEXT:   2: return [B1.1];
 // CHECK-NEXT:   Preds (1): B2
 // CHECK-NEXT:   Succs (1): B0
 // CHECK:      [B0 (EXIT)]
 // CHECK-NEXT:   Preds (1): B1
   operator int() const { return 1; }
+  int *p;
 };
 
 int getX();
 extern const bool UV;
 
 // CHECK:      [B2 (ENTRY)]
 // CHECK-NEXT:   Succs (1): B1
 // CHECK:      [B1]

 // CHECK:      [B1]
 // CHECK-NEXT:   1: [B4.5].~A() (Implicit destructor)
 // CHECK-NEXT:   2: CFGScopeEnd(b)
 // CHECK-NEXT:   3: [B5.3].~A() (Implicit destructor)
 // CHECK-NEXT:   4: CFGScopeEnd(a)
 // CHECK-NEXT:   Preds (1): B4
 // CHECK-NEXT:   Succs (1): B0
 // CHECK:      [B2]
+// CHECK-NEXT:   1: b
+// CHECK-NEXT:   2: [B2.1].p
+// CHECK-NEXT:   3: [B4.5].~A() (Implicit destructor)
+// CHECK-NEXT:   4: CFGScopeEnd(b)
 // CHECK-NEXT:   Preds (1): B3
 // CHECK-NEXT:   Succs (1): B4
 // CHECK:      [B3]
 // CHECK-NEXT:   1: CFGScopeBegin(c)
 // CHECK-NEXT:   2:  (CXXConstructExpr, [B3.3], A)
 // CHECK-NEXT:   3: A c;
 // CHECK-NEXT:   4: [B3.3].~A() (Implicit destructor)
 // CHECK-NEXT:   5: CFGScopeEnd(c)
-// CHECK-NEXT:   6: [B4.5].~A() (Implicit destructor)
-// CHECK-NEXT:   7: CFGScopeEnd(b)
 // CHECK-NEXT:   Preds (1): B4
 // CHECK-NEXT:   Succs (1): B2
 // CHECK:      [B4]
 // CHECK-NEXT:   1: CFGScopeBegin(b)
 // CHECK-NEXT:   2: a
 // CHECK-NEXT:   3: [B4.2] (ImplicitCastExpr, NoOp, const A)
 // CHECK-NEXT:   4: [B4.3] (CXXConstructExpr, [B4.5], A)
 // CHECK-NEXT:   5: A b = a;
 // CHECK-NEXT:   6: b
 // CHECK-NEXT:   7: [B4.6] (ImplicitCastExpr, NoOp, const class A)
 // CHECK-NEXT:   8: [B4.7].operator int
 // CHECK-NEXT:   9: [B4.7]
 // CHECK-NEXT:  10: [B4.9] (ImplicitCastExpr, UserDefinedConversion, int)
 // CHECK-NEXT:  11: [B4.10] (ImplicitCastExpr, IntegralToBoolean, _Bool)
-// CHECK-NEXT:   T: for (...; [B4.11]; )
+// CHECK-NEXT:   T: for (...; [B4.11]; ...)
 // CHECK-NEXT:   Preds (2): B2 B5
 // CHECK-NEXT:   Succs (2): B3 B1
 // CHECK:      [B5]
 // CHECK-NEXT:   1: CFGScopeBegin(a)
 // CHECK-NEXT:   2:  (CXXConstructExpr, [B5.3], A)
 // CHECK-NEXT:   3: A a;
 // CHECK-NEXT:   Preds (1): B6
 // CHECK-NEXT:   Succs (1): B4
 // CHECK:      [B0 (EXIT)]
 // CHECK-NEXT:   Preds (1): B1
 void test_for_implicit_scope() {
-  for (A a; A b = a; )
+  for (A a; A b = a; b.p)
     A c;
 }
 
 // CHECK:      [B12 (ENTRY)]
 // CHECK-NEXT:   Succs (1): B11
 // CHECK:      [B1]
 // CHECK-NEXT:   1: [B10.5].~A() (Implicit destructor)
 // CHECK-NEXT:   2: CFGScopeEnd(c)
 // CHECK-NEXT:   3: [B11.6].~A() (Implicit destructor)
 // CHECK-NEXT:   4: CFGScopeEnd(b)
 // CHECK-NEXT:   5:  (CXXConstructExpr, [B1.6], A)
 // CHECK-NEXT:   6: A f;
 // CHECK-NEXT:   7: [B1.6].~A() (Implicit destructor)
 // CHECK-NEXT:   8: [B11.3].~A() (Implicit destructor)
 // CHECK-NEXT:   9: CFGScopeEnd(a)
 // CHECK-NEXT:   Preds (2): B8 B10
 // CHECK-NEXT:   Succs (1): B0
 // CHECK:      [B2]
+// CHECK-NEXT:   1: [B10.5].~A() (Implicit destructor)
+// CHECK-NEXT:   2: CFGScopeEnd(c)
 // CHECK-NEXT:   Preds (2): B3 B6
 // CHECK-NEXT:   Succs (1): B10
 // CHECK:      [B3]
 // CHECK-NEXT:   1:  (CXXConstructExpr, [B3.2], A)
 // CHECK-NEXT:   2: A e;
 // CHECK-NEXT:   3: [B3.2].~A() (Implicit destructor)
 // CHECK-NEXT:   4: [B9.3].~A() (Implicit destructor)
 // CHECK-NEXT:   5: CFGScopeEnd(d)
-// CHECK-NEXT:   6: [B10.5].~A() (Implicit destructor)
-// CHECK-NEXT:   7: CFGScopeEnd(c)
 // CHECK-NEXT:   Preds (1): B5
 // CHECK-NEXT:   Succs (1): B2
 // CHECK:      [B4]
 // CHECK-NEXT:   1: return;
 // CHECK-NEXT:   2: [B9.3].~A() (Implicit destructor)
 // CHECK-NEXT:   3: CFGScopeEnd(d)
 // CHECK-NEXT:   4: [B10.5].~A() (Implicit destructor)
 // CHECK-NEXT:   5: CFGScopeEnd(c)
for (A b; A c = b; ) {
     if (UV) continue;
     if (UV) return;
     A e;
   }
   A f;
 }
 
 // CHECK:      [B9 (ENTRY)]
+// CHECK-NEXT:   Succs (1): B8
+// CHECK:      [B1]
+// CHECK-NEXT:   1: [B7.5].~A() (Implicit destructor)
+// CHECK-NEXT:   2: CFGScopeEnd(b)
+// CHECK-NEXT:   3: [B8.3].~A() (Implicit destructor)
+// CHECK-NEXT:   4: CFGScopeEnd(a)
+// CHECK-NEXT:   Preds (1): B7
+// CHECK-NEXT:   Succs (1): B0
+// CHECK:      [B2]
+// CHECK-NEXT:   1: [B5.4] ? [B3.3] : [B4.2]
+// CHECK-NEXT:   2: [B7.5].~A() (Implicit destructor)
+// CHECK-NEXT:   3: CFGScopeEnd(b)
+// CHECK-NEXT:   Preds (2): B3 B4
+// CHECK-NEXT:   Succs (1): B7
+// CHECK:      [B3]
+// CHECK-NEXT:   1: b
+// CHECK-NEXT:   2: [B3.1].p
+// CHECK-NEXT:   3: [B3.2]++
+// CHECK-NEXT:   Preds (1): B5
+// CHECK-NEXT:   Succs (1): B2
+// CHECK:      [B4]
+// CHECK-NEXT:   1: 0
+// CHECK-NEXT:   2: [B4.1] (ImplicitCastExpr, NullToPointer, int *)
+// CHECK-NEXT:   Preds (1): B5
+// CHECK-NEXT:   Succs (1): B2
+// CHECK:      [B5]
+// CHECK-NEXT:   1: b
+// CHECK-NEXT:   2: [B5.1].p
+// CHECK-NEXT:   3: [B5.2] (ImplicitCastExpr, LValueToRValue, int *)
+// CHECK-NEXT:   4: [B5.3] (ImplicitCastExpr, PointerToBoolean, _Bool)
+// CHECK-NEXT:   T: [B5.4] ? ... : ...
+// CHECK-NEXT:   Preds (1): B6
+// CHECK-NEXT:   Succs (2): B3 B4
+// CHECK:      [B6]
+// CHECK-NEXT:   1: 0
+// CHECK-NEXT:   2: (void)[B6.1] (CStyleCastExpr, ToVoid, void)
+// CHECK-NEXT:   Preds (1): B7
+// CHECK-NEXT:   Succs (1): B5
+// CHECK:      [B7]
+// CHECK-NEXT:   1: CFGScopeBegin(b)
+// CHECK-NEXT:   2: a
+// CHECK-NEXT:   3: [B7.2] (ImplicitCastExpr, NoOp, const A)
+// CHECK-NEXT:   4: [B7.3] (CXXConstructExpr, [B7.5], A)
+// CHECK-NEXT:   5: A b = a;
+// CHECK-NEXT:   6: b
+// CHECK-NEXT:   7: [B7.6] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:   8: [B7.7].operator int
+// CHECK-NEXT:   9: [B7.7]
+// CHECK-NEXT:  10: [B7.9] (ImplicitCastExpr, UserDefinedConversion, int)
+// CHECK-NEXT:  11: [B7.10] (ImplicitCastExpr, IntegralToBoolean, _Bool)
+// CHECK-NEXT:   T: for (...; [B7.11]; ...)
+// CHECK-NEXT:   Preds (2): B2 B8
+// CHECK-NEXT:   Succs (2): B6 B1
+// CHECK:      [B8]
+// CHECK-NEXT:   1: CFGScopeBegin(a)
+// CHECK-NEXT:   2:  (CXXConstructExpr, [B8.3], A)
+// CHECK-NEXT:   3: A a;
+// CHECK-NEXT:   Preds (1): B9
+// CHECK-NEXT:   Succs (1): B7
+void test_for_inc_conditional() {
+  for (A a; A b = a; b.p ? b.p++ : 0)
+    (void)0;
+}
+
+// CHECK:      [B9 (ENTRY)]
 // CHECK-NEXT:   Succs (1): B7
 // CHECK:      [B1]
 // CHECK-NEXT:  l1:
 // CHECK-NEXT:   1:  (CXXConstructExpr, [B1.2], A)
 // CHECK-NEXT:   2: A c;
 // CHECK-NEXT:   3: [B1.2].~A() (Implicit destructor)
 // CHECK-NEXT:   4: [B6.4].~A() (Implicit destructor)
 // CHECK-NEXT:   5: [B6.2].~A() (Implicit destructor)