[CFG] [analyzer] Add MaterializeTemporaryExpr into the construction context.

[NoQ]

Summary

MaterializeTemporaryExpr captures lifetime extension information. In the analyzer it is important to have this information at construction site because we would be dealing only with rvalue expressions for quite a while, but in order to perform lifetime extension later, we need to put extra effort into keeping the lvalue around.

MaterializeTemporaryExpr is added either as a trigger statement if there's no CXXBindTemporaryExpr within it (eg. const C &c(123); or the actual (not the elidable copy) constructor in C foo() { return C(123); }), or as a parent construction context if there already is a CXXBindTemporary. In the latter case, it is included in the dump and tested accordingly. I understand that this is quite counter-intuitive at the moment (easy to construct, hard to use) and i'd make super sure that ConstructionContext is refactored later to become easy to understand and work with - separation of different "kinds" of construction contexts and fancy kind-specific helper methods are absolutely necessary. But for now i'm focused on getting it to work.

[NoQ]

eg. const C &c(123); or the actual (not the elidable copy) constructor in C foo() { return C(123); }

Emm, sry, never mind, forget it, i was trying to say that the reason why we don't have a CXXBindTemporary is because we don't have a destructor in class C, not because we have specific syntax patterns.

This fix does not cause changes in the analyzer yet. Even though we are providing construction contexts in a bit more cases, and even if we used them in the analyzer, we wouldn't get any functional change yet, because temporary constructors that require no destructors are inlined anyway, regardless of construction context, and an exact same temporary region is accidentally created for them. So the point of this patch is not to make more construction contexts available, but to provide better construction contexts in the CXXBindTemporary case, which will be used later.

[dcoughlin]

LGTM.

[lxfind]

Hi! I have a question regarding the implementation of "VisitMaterializeTemporaryExpr". Specifically, I wonder if we should skip visiting the children? Would't visiting the children of MaterializeTemporaryExpr cause the same expression to be visited twice?

I am debugging a crash in ThreadSafetyAnalyzer, which triggers this assertion: https://github.com/llvm/llvm-project/blob/main/clang/lib/Analysis/ThreadSafety.cpp#L534
Basically it's adding the same declaration twice from the same CFG block.
And I found that the redundant declaration is added during CFG construction, when processing cpp source code like this:

co_return ({ static constexpr mydomain::logdevice::ErrorStacktrace::Frame frame{ __FUNCTION__, "logdevice/common/ZookeeperClientBase.cpp", 103}; mydomain::logdevice::detail::makeUnexpected(&frame, toStatus(result.rc_)); });

which corresponds to the following AST:

|   `-CompoundStmt 0x227b13f8
|     `-CoreturnStmt 0x227b13d0
|       |-CXXBindTemporaryExpr 0x22776218 'folly::Unexpected<Error>':'class folly::Unexpected<struct mydomain::logdevice::Error>' (CXXTemporary 0x22776218)
|       | `-StmtExpr 0x227761f0 'folly::Unexpected<Error>':'class folly::Unexpected<struct mydomain::logdevice::Error>'
|       |   `-CompoundStmt 0x227761d0
|       |     |-DeclStmt 0x22771e88
|       |     | `-VarDecl 0x22771c50  used frame 'const mydomain::logdevice::class ErrorStacktrace::Frame':'const struct mydomain::logdevice::ErrorStacktrace::Frame' static constexpr listinit
|       |     |   |-value: Struct
|       |     |   | `-fields: LValue <todo>, LValue <todo>, Int 103
|       |     |   `-InitListExpr 0x22771da8 'const mydomain::logdevice::class ErrorStacktrace::Frame':'const struct mydomain::logdevice::ErrorStacktrace::Frame'
|       |     |     |-ImplicitCastExpr 0x22771e00 'const char *' <ArrayToPointerDecay>
|       |     |     | `-PredefinedExpr 0x22771cd8 'const char [8]' lvalue __FUNCTION__
|       |     |     |   `-StringLiteral 0x22771cb8 'const char [8]' lvalue "getData"
|       |     |     |-ImplicitCastExpr 0x22771e18 'const char *' <ArrayToPointerDecay>
|       |     |     | `-StringLiteral 0x22771cf0 'const char [41]' lvalue "logdevice/common/ZookeeperClientBase.cpp"
|       |     |     `-IntegerLiteral 0x22771d30 'int' 103
|       |     `-ExprWithCleanups 0x227761b8 'folly::Unexpected<Error>':'class folly::Unexpected<struct mydomain::logdevice::Error>'
|       |       `-CXXBindTemporaryExpr 0x22776198 'folly::Unexpected<Error>':'class folly::Unexpected<struct mydomain::logdevice::Error>' (CXXTemporary 0x22776198)
|       |         `-CallExpr 0x22776160 'folly::Unexpected<Error>':'class folly::Unexpected<struct mydomain::logdevice::Error>'
|       |           |-ImplicitCastExpr 0x22776148 'folly::Unexpected<Error> (*)(const class ErrorStacktrace::Frame *, mydomain::logdevice::Status)' <FunctionToPointerDecay>
|       |           | `-DeclRefExpr 0x227760b8 'folly::Unexpected<Error> (const class ErrorStacktrace::Frame *, mydomain::logdevice::Status)' lvalue Function 0x18b49568 'makeUnexpected' 'folly::Unexpected<Error> (const class ErrorStacktrace::Frame *, mydomain::logdevice::Status)'
|       |           |-UnaryOperator 0x22771fb8 'const mydomain::logdevice::class ErrorStacktrace::Frame *' prefix '&' cannot overflow
|       |           | `-DeclRefExpr 0x22771f68 'const mydomain::logdevice::class ErrorStacktrace::Frame':'const struct mydomain::logdevice::ErrorStacktrace::Frame' lvalue Var 0x22771c50 'frame' 'const mydomain::logdevice::class ErrorStacktrace::Frame':'const struct mydomain::logdevice::ErrorStacktrace::Frame'
|       |           `-CallExpr 0x227720e0 'mydomain::logdevice::Status':'enum mydomain::logdevice::E'
|       |             |-ImplicitCastExpr 0x227720c8 'mydomain::logdevice::Status (*)(int)' <FunctionToPointerDecay>
|       |             | `-DeclRefExpr 0x22771ff8 'mydomain::logdevice::Status (int)' lvalue CXXMethod 0x221cddd0 'toStatus' 'mydomain::logdevice::Status (int)'
|       |             `-ImplicitCastExpr 0x22772108 'int' <LValueToRValue>
|       |               `-MemberExpr 0x22772038 'int' lvalue .rc_ 0x21f24480
|       |                 `-DeclRefExpr 0x22772018 'struct mydomain::logdevice::zk::GetResponse':'struct mydomain::logdevice::zk::GetResponse' lvalue Var 0x22731508 'result' 'struct mydomain::logdevice::zk::GetResponse':'struct mydomain::logdevice::zk::GetResponse'
|       `-ExprWithCleanups 0x227b13b8 'void'
|         `-CXXMemberCallExpr 0x227b1378 'void'
|           |-MemberExpr 0x227b1330 '<bound member function type>' .return_value 0x227b1230
|           | `-DeclRefExpr 0x22776238 'std::__coroutine_traits_impl<class folly::coro::Task<class folly::Expected<struct mydomain::logdevice::zk::GetResponse, struct mydomain::logdevice::Error> > >::promise_type':'class folly::coro::detail::TaskPromise<class folly::Expected<struct mydomain::logdevice::zk::GetResponse, struct mydomain::logdevice::Error> >' lvalue Var 0x227330a0 '__promise' 'std::__coroutine_traits_impl<class folly::coro::Task<class folly::Expected<struct mydomain::logdevice::zk::GetResponse, struct mydomain::logdevice::Error> > >::promise_type':'class folly::coro::detail::TaskPromise<class folly::Expected<struct mydomain::logdevice::zk::GetResponse, struct mydomain::logdevice::Error> >'
|           `-MaterializeTemporaryExpr 0x227b13a0 'folly::Unexpected<Error>':'class folly::Unexpected<struct mydomain::logdevice::Error>' xvalue
|             `-CXXBindTemporaryExpr 0x22776218 'folly::Unexpected<Error>':'class folly::Unexpected<struct mydomain::logdevice::Error>' (CXXTemporary 0x22776218)
|               `-StmtExpr 0x227761f0 'folly::Unexpected<Error>':'class folly::Unexpected<struct mydomain::logdevice::Error>'
|                 `-CompoundStmt 0x227761d0
|                   |-DeclStmt 0x22771e88
|                   | `-VarDecl 0x22771c50  used frame 'const mydomain::logdevice::class ErrorStacktrace::Frame':'const struct mydomain::logdevice::ErrorStacktrace::Frame' static constexpr listinit
|                   |   |-value: Struct
|                   |   | `-fields: LValue <todo>, LValue <todo>, Int 103
|                   |   `-InitListExpr 0x22771da8 'const mydomain::logdevice::class ErrorStacktrace::Frame':'const struct mydomain::logdevice::ErrorStacktrace::Frame'
|                   |     |-ImplicitCastExpr 0x22771e00 'const char *' <ArrayToPointerDecay>
|                   |     | `-PredefinedExpr 0x22771cd8 'const char [8]' lvalue __FUNCTION__
|                   |     |   `-StringLiteral 0x22771cb8 'const char [8]' lvalue "getData"
|                   |     |-ImplicitCastExpr 0x22771e18 'const char *' <ArrayToPointerDecay>
|                   |     | `-StringLiteral 0x22771cf0 'const char [41]' lvalue "logdevice/common/ZookeeperClientBase.cpp"
|                   |     `-IntegerLiteral 0x22771d30 'int' 103
|                   `-ExprWithCleanups 0x227761b8 'folly::Unexpected<Error>':'class folly::Unexpected<struct mydomain::logdevice::Error>'
|                     `-CXXBindTemporaryExpr 0x22776198 'folly::Unexpected<Error>':'class folly::Unexpected<struct mydomain::logdevice::Error>' (CXXTemporary 0x22776198)
|                       `-CallExpr 0x22776160 'folly::Unexpected<Error>':'class folly::Unexpected<struct mydomain::logdevice::Error>'
|                         |-ImplicitCastExpr 0x22776148 'folly::Unexpected<Error> (*)(const class ErrorStacktrace::Frame *, mydomain::logdevice::Status)' <FunctionToPointerDecay>
|                         | `-DeclRefExpr 0x227760b8 'folly::Unexpected<Error> (const class ErrorStacktrace::Frame *, mydomain::logdevice::Status)' lvalue Function 0x18b49568 'makeUnexpected' 'folly::Unexpected<Error> (const class ErrorStacktrace::Frame *, mydomain::logdevice::Status)'
|                         |-UnaryOperator 0x22771fb8 'const mydomain::logdevice::class ErrorStacktrace::Frame *' prefix '&' cannot overflow
|                         | `-DeclRefExpr 0x22771f68 'const mydomain::logdevice::class ErrorStacktrace::Frame':'const struct mydomain::logdevice::ErrorStacktrace::Frame' lvalue Var 0x22771c50 'frame' 'const mydomain::logdevice::class ErrorStacktrace::Frame':'const struct mydomain::logdevice::ErrorStacktrace::Frame'
|                         `-CallExpr 0x227720e0 'mydomain::logdevice::Status':'enum mydomain::logdevice::E'
|                           |-ImplicitCastExpr 0x227720c8 'mydomain::logdevice::Status (*)(int)' <FunctionToPointerDecay>
|                           | `-DeclRefExpr 0x22771ff8 'mydomain::logdevice::Status (int)' lvalue CXXMethod 0x221cddd0 'toStatus' 'mydomain::logdevice::Status (int)'
|                           `-ImplicitCastExpr 0x22772108 'int' <LValueToRValue>
|                             `-MemberExpr 0x22772038 'int' lvalue .rc_ 0x21f24480
|                               `-DeclRefExpr 0x22772018 'struct mydomain::logdevice::zk::GetResponse':'struct mydomain::logdevice::zk::GetResponse' lvalue Var 0x22731508 'result' 'struct mydomain::logdevice::zk::GetResponse':'struct mydomain::logdevice::zk::GetResponse'

Unfortunately I haven't been able to get a small repro. But I wonder if the problem makes sense to you?

include/clang/Analysis/CFG.h

public:
   const Stmt *getTriggerStmt() const {
     return Trigger.dyn_cast<Stmt *>();
   }
 
   const CXXCtorInitializer *getTriggerInit() const {
     return Trigger.dyn_cast<CXXCtorInitializer *>();
   }
 
+  const MaterializeTemporaryExpr *getMaterializedTemporary() const {
+    // TODO: Be more careful to ensure that there's only one MTE around.
+    for (const ConstructionContext *CC = this; CC; CC = CC->getParent()) {
+      if (const auto *MTE = dyn_cast_or_null<MaterializeTemporaryExpr>(
+              CC->getTriggerStmt())) {
+        return MTE;
+      }
+    }
+    return nullptr;
+  }
+
   bool isSameAsPartialContext(const ConstructionContext *Other) const {
     assert(Other);
     return (Trigger == Other->Trigger);
   }
 
   // See if Other is a proper initial segment of this construction context
   // in terms of the parent chain - i.e. a few first parents coincide and
   // then the other context terminates but our context goes further - i.e.,
public:
   const Stmt *getTriggerStmt() const {
     return getConstructionContext()->getTriggerStmt();
   }
 
   const CXXCtorInitializer *getTriggerInit() const {
     return getConstructionContext()->getTriggerInit();
   }
 
+  const MaterializeTemporaryExpr *getMaterializedTemporary() const {
+    return getConstructionContext()->getMaterializedTemporary();
+  }
+
 private:
   friend class CFGElement;
 
   CFGConstructor() = default;
 
   static bool isKind(const CFGElement &E) {
     return E.getKind() == Constructor;
   }

lib/Analysis/CFG.cpp

private:
   CFGBlock *VisitLabelStmt(LabelStmt *L);
   CFGBlock *VisitBlockExpr(BlockExpr *E, AddStmtChoice asc);
   CFGBlock *VisitLambdaExpr(LambdaExpr *E, AddStmtChoice asc);
   CFGBlock *VisitLogicalOperator(BinaryOperator *B);
   std::pair<CFGBlock *, CFGBlock *> VisitLogicalOperator(BinaryOperator *B,
                                                          Stmt *Term,
                                                          CFGBlock *TrueBlock,
                                                          CFGBlock *FalseBlock);
+  CFGBlock *VisitMaterializeTemporaryExpr(MaterializeTemporaryExpr *MTE,
+                                          AddStmtChoice asc);
   CFGBlock *VisitMemberExpr(MemberExpr *M, AddStmtChoice asc);
   CFGBlock *VisitObjCAtCatchStmt(ObjCAtCatchStmt *S);
   CFGBlock *VisitObjCAtSynchronizedStmt(ObjCAtSynchronizedStmt *S);
   CFGBlock *VisitObjCAtThrowStmt(ObjCAtThrowStmt *S);
   CFGBlock *VisitObjCAtTryStmt(ObjCAtTryStmt *S);
   CFGBlock *VisitObjCAutoreleasePoolStmt(ObjCAutoreleasePoolStmt *S);
   CFGBlock *VisitObjCForCollectionStmt(ObjCForCollectionStmt *S);
   CFGBlock *VisitPseudoObjectExpr(PseudoObjectExpr *E);
case Stmt::IndirectGotoStmtClass:
       return VisitIndirectGotoStmt(cast<IndirectGotoStmt>(S));
 
     case Stmt::LabelStmtClass:
       return VisitLabelStmt(cast<LabelStmt>(S));
 
     case Stmt::LambdaExprClass:
       return VisitLambdaExpr(cast<LambdaExpr>(S), asc);
 
+    case Stmt::MaterializeTemporaryExprClass:
+      return VisitMaterializeTemporaryExpr(cast<MaterializeTemporaryExpr>(S),
+                                           asc);
+
     case Stmt::MemberExprClass:
       return VisitMemberExpr(cast<MemberExpr>(S), asc);
 
     case Stmt::NullStmtClass:
       return Block;
 
     case Stmt::ObjCAtCatchStmtClass:
       return VisitObjCAtCatchStmt(cast<ObjCAtCatchStmt>(S));
CFGBlock *CFGBuilder::VisitForStmt(ForStmt *F) {
 
   // There is no loop initialization.  We are thus basically a while loop.
   // NULL out Block to force lazy block construction.
   Block = nullptr;
   Succ = EntryConditionBlock;
   return EntryConditionBlock;
 }
 
+CFGBlock *
+CFGBuilder::VisitMaterializeTemporaryExpr(MaterializeTemporaryExpr *MTE,
+                                          AddStmtChoice asc) {
+  findConstructionContexts(
+      ConstructionContext::create(cfg->getBumpVectorContext(), MTE),
+      MTE->getTemporary());
+
+  return VisitStmt(MTE, asc);
+}
+
 CFGBlock *CFGBuilder::VisitMemberExpr(MemberExpr *M, AddStmtChoice asc) {
   if (asc.alwaysAdd(*this, M)) {
     autoCreateBlock();
     appendStmt(Block, M);
   }
   return Visit(M->getBase());
 }
 
if (Optional<CFGStmt> CS = E.getAs<CFGStmt>()) {
 
     if (isa<CXXOperatorCallExpr>(S)) {
       OS << " (OperatorCall)";
     } else if (isa<CXXBindTemporaryExpr>(S)) {
       OS << " (BindTemporary)";
     } else if (const CXXConstructExpr *CCE = dyn_cast<CXXConstructExpr>(S)) {
       OS << " (CXXConstructExpr, ";
       if (Optional<CFGConstructor> CE = E.getAs<CFGConstructor>()) {
+        // TODO: Refactor into ConstructionContext::print().
         if (const Stmt *S = CE->getTriggerStmt())
-          Helper.handledStmt((const_cast<Stmt *>(S)), OS);
+          Helper.handledStmt(const_cast<Stmt *>(S), OS);
         else if (const CXXCtorInitializer *I = CE->getTriggerInit())
           print_initializer(OS, Helper, I);
         else
           llvm_unreachable("Unexpected trigger kind!");
         OS << ", ";
+        if (const Stmt *S = CE->getMaterializedTemporary()) {
+          if (S != CE->getTriggerStmt()) {
+            Helper.handledStmt(const_cast<Stmt *>(S), OS);
+            OS << ", ";
+          }
+        }
       }
       OS << CCE->getType().getAsString() << ")";
     } else if (const CastExpr *CE = dyn_cast<CastExpr>(S)) {
       OS << " (" << CE->getStmtClassName() << ", "
          << CE->getCastKindName()
          << ", " << CE->getType().getAsString()
          << ")";
     }

test/Analysis/cfg-rich-constructors.cpp

 // CHECK:        [B4]
 // CHECK-NEXT:     1: coin
 // CHECK-NEXT:     2: [B4.1] (ImplicitCastExpr, LValueToRValue, _Bool)
 // CHECK-NEXT:     T: [B4.2] ? ... : ...
 void simpleVariableWithTernaryOperator(bool coin) {
   C c = coin ? C::get() : C(0);
 }
 
-// TODO: Should find construction target here.
 // CHECK: void referenceVariableWithConstructor()
 // CHECK:          1: 0
 // CHECK-NEXT:     2: [B1.1] (ImplicitCastExpr, NullToPointer, class C *)
-// CHECK-NEXT:     3: [B1.2] (CXXConstructExpr, const class C)
+// CHECK-NEXT:     3: [B1.2] (CXXConstructExpr, [B1.4], const class C)
 // CHECK-NEXT:     4: [B1.3]
 // CHECK-NEXT:     5: const C &c(0);
 void referenceVariableWithConstructor() {
   const C &c(0);
 }
 
 // TODO: Should find construction target here.
 // CHECK: void referenceVariableWithInitializer()

 // CHECK:          1: 123
 // CHECK-NEXT:     2: 456
 // CHECK-NEXT:     3: {[B1.1], [B1.2]} (CXXConstructExpr, [B1.4], class C)
 // CHECK-NEXT:     4: return [B1.3];
 C returnBracesWithMultipleItems() {
   return {123, 456};
 }
 
-// TODO: Should find construction targets for the first constructor as well.
 // CHECK: C returnTemporary()
-// CHECK:          1: C() (CXXConstructExpr, class C)
+// CHECK:          1: C() (CXXConstructExpr, [B1.2], class C)
 // CHECK-NEXT:     2: [B1.1]
 // CHECK-NEXT:     3: [B1.2] (CXXConstructExpr, [B1.4], class C)
 // CHECK-NEXT:     4: return [B1.3];
 C returnTemporary() {
   return C();
 }
 
 // TODO: Should find construction targets for the first constructor as well.

 // CHECK-NEXT:     7: ~temporary_object_expr_with_dtors::D() (Temporary object destructor)
 // CHECK-NEXT:     T: if [B2.6]
 void temporaryInCondition() {
   if (D());
 }
 
 // CHECK: void referenceVariableWithConstructor()
 // CHECK:          1: 0
-// CHECK-NEXT:     2: [B1.1] (CXXConstructExpr, [B1.3], const class temporary_object_expr_with_dtors::D)
+// CHECK-NEXT:     2: [B1.1] (CXXConstructExpr, [B1.3], [B1.4], const class temporary_object_expr_with_dtors::D)
 // CHECK-NEXT:     3: [B1.2] (BindTemporary)
 // CHECK-NEXT:     4: [B1.3]
 // CHECK-NEXT:     5: const temporary_object_expr_with_dtors::D &d(0);
 // CHECK-NEXT:     6: [B1.5].~D() (Implicit destructor)
 void referenceVariableWithConstructor() {
   const D &d(0);
 }
 

test/Analysis/temp-obj-dtors-cfg-output.cpp

 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B2]
 // CHECK:     1: 1
 // CHECK:     2: return [B2.1];
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B3]
-// CHECK:     1: D() (CXXConstructExpr, struct D)
+// WARNINGS:     1: D() (CXXConstructExpr, struct D)
+// CXX98-ANALYZER:     1: D() (CXXConstructExpr, struct D)
+// CXX11-ANALYZER:     1: D() (CXXConstructExpr, [B3.2], struct D)
 // CXX98:     2: [B3.1] (ImplicitCastExpr, NoOp, const struct D)
 // CXX98:     3: [B3.2]
 // CXX98-WARNINGS:     4: [B3.3] (CXXConstructExpr, struct D)
 // CXX98-ANALYZER:     4: [B3.3] (CXXConstructExpr, [B3.5], struct D)
 // CXX98:     5: D d = D();
 // CXX98:     6: d
 // CXX98:     7: [B3.6].operator bool
 // CXX98:     8: [B3.6]

 // CHECK:     4: [B6.3]
 // WARNINGS:     5: [B6.4] (CXXConstructExpr, class A)
 // ANALYZER:     5: [B6.4] (CXXConstructExpr, [B6.6], class A)
 // CHECK:     6: [B6.5] (BindTemporary)
 // CHECK:     Preds (1): B7
 // CHECK:     Succs (1): B4
 // CHECK:   [B7]
 // WARNINGS:     1: A() (CXXConstructExpr, class A)
-// ANALYZER:     1: A() (CXXConstructExpr, [B7.2], class A)
+// ANALYZER-CXX98:     1: A() (CXXConstructExpr, [B7.2], [B7.3], class A)
+// ANALYZER-CXX11:     1: A() (CXXConstructExpr, [B7.2], class A)
 // CHECK:     2: [B7.1] (BindTemporary)
 // CXX98:     3: [B7.2].operator bool
 // CXX98:     4: [B7.2]
 // CXX98:     5: [B7.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
 // CXX98:     T: [B7.5] ? ... : ...
 // CXX11:     3: [B7.2]
 // CXX11:     4: [B7.3].operator bool
 // CXX11:     5: [B7.3]

 // ANALYZER:     5: [B6.4] (CXXConstructExpr, [B6.6], class A)
 // CHECK:     6: [B6.5] (BindTemporary)
 // CHECK:     Preds (1): B7
 // CHECK:     Succs (1): B4
 // CHECK:   [B7]
 // CHECK:     1: foo
 // CHECK:     2: [B7.1] (ImplicitCastExpr, FunctionToPointerDecay, void (*)(const class A &))
 // WARNINGS:     3: A() (CXXConstructExpr, class A)
-// ANALYZER:     3: A() (CXXConstructExpr, [B7.4], class A)
+// ANALYZER-CXX98:     3: A() (CXXConstructExpr, [B7.4], class A)
+// ANALYZER-CXX11:     3: A() (CXXConstructExpr, class A)
 // CHECK:     4: [B7.3] (BindTemporary)
 // CXX98:     5: [B7.4].operator bool
 // CXX98:     6: [B7.4]
 // CXX98:     7: [B7.6] (ImplicitCastExpr, UserDefinedConversion, _Bool)
 // CXX98:     T: [B7.7] ? ... : ...
 // CXX11:     5: [B7.4]
 // CXX11:     6: [B7.5].operator bool
 // CXX11:     7: [B7.5]

 // CHECK:     4: [B11.3]
 // WARNINGS:     5: [B11.4] (CXXConstructExpr, class A)
 // ANALYZER:     5: [B11.4] (CXXConstructExpr, [B11.6], class A)
 // CHECK:     6: [B11.5] (BindTemporary)
 // CHECK:     Preds (1): B12
 // CHECK:     Succs (1): B9
 // CHECK:   [B12]
 // WARNINGS:     1: A() (CXXConstructExpr, class A)
-// ANALYZER:     1: A() (CXXConstructExpr, [B12.2], class A)
+// ANALYZER-CXX98:     1: A() (CXXConstructExpr, [B12.2], [B12.3], class A)
+// ANALYZER-CXX11:     1: A() (CXXConstructExpr, [B12.2], class A)
 // CHECK:     2: [B12.1] (BindTemporary)
 // CXX98:     3: [B12.2].operator bool
 // CXX98:     4: [B12.2]
 // CXX98:     5: [B12.4] (ImplicitCastExpr, UserDefinedConversion, _Bool)
 // CXX98:     T: [B12.5] ? ... : ...
 // CXX11:     3: [B12.2]
 // CXX11:     4: [B12.3].operator bool
 // CXX11:     5: [B12.3]

 // CHECK:     Succs (1): B2
 // CHECK:   [B1]
 // CHECK:     1: int b;
 // CHECK:     Preds (1): B2(Unreachable)
 // CHECK:     Succs (1): B0
 // CHECK:   [B2 (NORETURN)]
 // CHECK:     1: int a;
 // WARNINGS:     2: NoReturn() (CXXConstructExpr, class NoReturn)
-// ANALYZER:     2: NoReturn() (CXXConstructExpr, [B2.3], class NoReturn)
+// ANALYZER-CXX98:     2: NoReturn() (CXXConstructExpr, [B2.3], [B2.4], class NoReturn)
+// ANALYZER-CXX11:     2: NoReturn() (CXXConstructExpr, [B2.3], class NoReturn)
 // CHECK:     3: [B2.2] (BindTemporary)
 // CHECK:     [[MEMBER:[45]]]: [B2.{{[34]}}].f
 // CHECK:     {{[56]}}: [B2.[[MEMBER]]]()
 // CHECK:     {{[67]}}: ~NoReturn() (Temporary object destructor)
 // CHECK:     Preds (1): B3
 // CHECK:     Succs (1): B0
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (2): B1 B2