[CFG] Fix automatic destructors when a member is bound to a reference.

[NoQ]

Summary

In code like

const int &x = A().x;

the destructor for A() was not present in the CFG due to two problems in the pattern-matching in getReferenceInitTemporaryType():

1. The no-op cast from T to const T is not necessarily performed on a record type. It may be performed on essentially any type. In the current example, it is performed on an xvalue of type int in order to turn it into a const int.
2. Since rC288563 member access is no longer performed over rvalues, but goes after the MaterializeTemporaryExpr instead.

This is not an analyzer-specific change. It may add/remove compiler warnings, but i don't think it makes any sense to hide this behind an analyzer-specific flag.

[rjmccall]

Seems fine to me, but you might want someone with analyzer experience to review.

[rsmith]

lib/Analysis/CFG.cpp

1495–1496

Can you replace this with Expr::skipRValueSubobjectAdjustments? That's how we compute this elsewhere. (You'll need to skip a top-level ExprWithCleanups and check for the search terminating in a MaterializeTemporaryExpr yourself, but this will reduce duplication and fix a couple more cases this function is getting wrong).

[NoQ]

lib/Analysis/CFG.cpp

1495–1496

Hmm, right, ok, yeah. I'm in no rush with this one, so i'll spend some time trying to understand what rvalue adjustments do we still have after rC288563.

[rsmith]

lib/Analysis/CFG.cpp

1495–1496

We still have to deal with rvalue adjustments in C++98 compilations, because we don't create xvalue MaterializeTemporaryExpr nodes there (because C++98 doesn't have xvalues). I think if/when we carry out the plan to remove CXXBindTemporaryExpr, skipping rvalue adjustments will only be interesting to the code that performs lifetime extension, and everything else can just deal with the MaterializeTemporaryExpr nodes. But for now, you'll need to skip rvalue adjustments if you want to handle our C++98 ASTs.

As a quick example, take:

struct A { int n; };
const int &r = A().*&A::n;

... which produces this AST in C++11 onwards:

`-VarDecl 0xc2681f0 <col:22, col:46> col:33 r 'const int &' cinit
  `-ExprWithCleanups 0xc268b28 <col:37, col:46> 'const int' xvalue
    `-ImplicitCastExpr 0xc2689f0 <col:37, col:46> 'const int' xvalue <NoOp>
      `-BinaryOperator 0xc2689c8 <col:37, col:46> 'int' xvalue '.*'
        |-MaterializeTemporaryExpr 0xc2689b0 <col:37, col:39> 'A' xvalue extended by Var 0xc2681f0 'r' 'const int &'
        | `-CXXTemporaryObjectExpr 0xc2687b0 <col:37, col:39> 'A' 'void () noexcept' zeroing
        `-UnaryOperator 0xc268990 <col:42, col:46> 'int A::*' prefix '&' cannot overflow
          `-DeclRefExpr 0xc268928 <col:43, col:46> 'int' lvalue Field 0xc268148 'n' 'int'

... but produces this in C++98 mode (which I think this function will mishandle because it doesn't know how to look through the binary .* operator):

`-VarDecl 0xcd61c90 <col:22, col:46> col:33 r 'const int &' cinit
  `-ExprWithCleanups 0xcd62398 <col:37, col:46> 'const int' lvalue
    `-MaterializeTemporaryExpr 0xcd622a8 <col:37, col:46> 'const int' lvalue extended by Var 0xcd61c90 'r' 'const int &'
      `-BinaryOperator 0xcd62280 <col:37, col:46> 'int' '.*'
        |-CXXTemporaryObjectExpr 0xcd62080 <col:37, col:39> 'A' 'void () throw()' zeroing
        `-UnaryOperator 0xcd62260 <col:42, col:46> 'int A::*' prefix '&' cannot overflow
          `-DeclRefExpr 0xcd621f8 <col:43, col:46> 'int' lvalue Field 0xcd61be8 'n' 'int'

[NoQ]

lib/Analysis/CFG.cpp

1495–1496

Aha, yay, thanks, i'll add this one, and also it seems that CFG and Analyzer C++ tests need way more different -std= run-lines :)

[NoQ]

Switch to skipRValueSubobjectAdjustments. Yup, that's much better.

Add FIXME tests for lifetime extension through non-references that are still not working - that correspond to a nearby FIXME in the code. I'm not planning to fix them immediately, but it's nice to know what else isn't working in this realm.

[george.karpenkov]

I'm not an expert in CFG construction, but looks good to me.

lib/Analysis/CFG.cpp

if (Init) {
     }
     return Visit(Init);
   }
 
   return Block;
 }
 
 /// Retrieve the type of the temporary object whose lifetime was 
 /// extended by a local reference with the given initializer.
-static QualType getReferenceInitTemporaryType(ASTContext &Context,
-                                              const Expr *Init,
+static QualType getReferenceInitTemporaryType(const Expr *Init,
                                               bool *FoundMTE = nullptr) {
   while (true) {
     // Skip parentheses.
     Init = Init->IgnoreParens();
-    
     // Skip through cleanups.
     if (const ExprWithCleanups *EWC = dyn_cast<ExprWithCleanups>(Init)) {
       Init = EWC->getSubExpr();
       continue;
     }
-    
     // Skip through the temporary-materialization expression.
     if (const MaterializeTemporaryExpr *MTE
           = dyn_cast<MaterializeTemporaryExpr>(Init)) {
       Init = MTE->GetTemporaryExpr();
       if (FoundMTE)
         *FoundMTE = true;
       continue;
     }
-    
-    // Skip derived-to-base and no-op casts.
-    if (const CastExpr *CE = dyn_cast<CastExpr>(Init)) {
-      if ((CE->getCastKind() == CK_DerivedToBase ||
-           CE->getCastKind() == CK_UncheckedDerivedToBase ||
-           CE->getCastKind() == CK_NoOp) &&
-          Init->getType()->isRecordType()) {
-        Init = CE->getSubExpr();
-        continue;
-      }
-    }
-    
-    // Skip member accesses into rvalues.
-    if (const MemberExpr *ME = dyn_cast<MemberExpr>(Init)) {
-      if (!ME->isArrow() && ME->getBase()->isRValue()) {
-        Init = ME->getBase();
-        continue;
-      }
-    }
-    
+    // Skip sub-object accesses into rvalues.
+    SmallVector<const Expr *, 2> CommaLHSs;
+    SmallVector<SubobjectAdjustment, 2> Adjustments;
+    const Expr *SkippedInit =
+        Init->skipRValueSubobjectAdjustments(CommaLHSs, Adjustments);
+    if (SkippedInit != Init) {
+      Init = SkippedInit;
     break;
   }
 
   return Init->getType();
 }
 
 // TODO: Support adding LoopExit element to the CFG in case where the loop is
 // ended by ReturnStmt, GotoStmt or ThrowExpr.
if (hasTrivialDestructor(*I)) {
       }
       continue;
     }
     // If this destructor is marked as a no-return destructor, we need to
     // create a new block for the destructor which does not have as a successor
     // anything built thus far: control won't flow out of this block.
     QualType Ty = (*I)->getType();
     if (Ty->isReferenceType()) {
-      Ty = getReferenceInitTemporaryType(*Context, (*I)->getInit());
+      Ty = getReferenceInitTemporaryType((*I)->getInit());
     }
     Ty = Context->getBaseElementType(Ty);
 
     if (Ty->getAsCXXRecordDecl()->isAnyDestructorNoReturn())
       Block = createNoReturnBlock();
     else
       autoCreateBlock();
 
for (auto *DI : DS->decls())
     if (VarDecl *VD = dyn_cast<VarDecl>(DI))
       Scope = addLocalScopeForVarDecl(VD, Scope);
   return Scope;
 }
 
 bool CFGBuilder::hasTrivialDestructor(VarDecl *VD) {
   // Check for const references bound to temporary. Set type to pointee.
   QualType QT = VD->getType();
-  if (QT.getTypePtr()->isReferenceType()) {
+  if (QT->isReferenceType()) {
     // Attempt to determine whether this declaration lifetime-extends a
     // temporary.
     //
     // FIXME: This is incorrect. Non-reference declarations can lifetime-extend
     // temporaries, and a single declaration can extend multiple temporaries.
     // We should look at the storage duration on each nested
     // MaterializeTemporaryExpr instead.
 
     const Expr *Init = VD->getInit();
-    if (!Init)
+    if (!Init) {
+      // Probably an exception catch-by-reference variable.
+      // FIXME: It doesn't really mean that the object has a trivial destructor.
+      // Also are there other cases?
       return true;
+    }
 
-    // Lifetime-extending a temporary.
+    // Lifetime-extending a temporary?
     bool FoundMTE = false;
-    QT = getReferenceInitTemporaryType(*Context, Init, &FoundMTE);
+    QT = getReferenceInitTemporaryType(Init, &FoundMTE);
     if (!FoundMTE)
       return true;
   }
 
   // Check for constant size array. Set type to array element type.
   while (const ConstantArrayType *AT = Context->getAsConstantArrayType(QT)) {
     if (AT->getSize() == 0)
       return true;
case CFGElement::AutomaticObjectDtor: {
       QualType ty = var->getType();
 
       // FIXME: See CFGBuilder::addLocalScopeForVarDecl.
       //
       // Lifetime-extending constructs are handled here. This works for a single
       // temporary in an initializer expression.
       if (ty->isReferenceType()) {
         if (const Expr *Init = var->getInit()) {
-          ty = getReferenceInitTemporaryType(astContext, Init);
+          ty = getReferenceInitTemporaryType(Init);
         }
       }
 
       while (const ArrayType *arrayType = astContext.getAsArrayType(ty)) {
         ty = arrayType->getElementType();
       }
       const RecordType *recordType = ty->getAs<RecordType>();
       const CXXRecordDecl *classDecl =
static void print_elem(raw_ostream &OS, StmtPrinterHelper &Helper,
   } else if (Optional<CFGInitializer> IE = E.getAs<CFGInitializer>()) {
     print_initializer(OS, Helper, IE->getInitializer());
     OS << '\n';
   } else if (Optional<CFGAutomaticObjDtor> DE =
                  E.getAs<CFGAutomaticObjDtor>()) {
     const VarDecl *VD = DE->getVarDecl();
     Helper.handleDecl(VD, OS);
 
-    const Type* T = VD->getType().getTypePtr();
-    if (const ReferenceType* RT = T->getAs<ReferenceType>())
-      T = RT->getPointeeType().getTypePtr();
-    T = T->getBaseElementTypeUnsafe();
+    ASTContext &ACtx = VD->getASTContext();
+    QualType T = VD->getType();
+    if (T->isReferenceType())
+      T = getReferenceInitTemporaryType(VD->getInit(), nullptr);
+    if (const ArrayType *AT = ACtx.getAsArrayType(T))
+      T = ACtx.getBaseElementType(AT);
 
     OS << ".~" << T->getAsCXXRecordDecl()->getName().str() << "()";
     OS << " (Implicit destructor)\n";
   } else if (Optional<CFGLifetimeEnds> DE = E.getAs<CFGLifetimeEnds>()) {
     const VarDecl *VD = DE->getVarDecl();
     Helper.handleDecl(VD, OS);
 
     OS << " (Lifetime ends)\n";

test/Analysis/auto-obj-dtors-cfg-output.cpp

-// RUN: %clang_analyze_cc1 -fcxx-exceptions -fexceptions -analyzer-checker=debug.DumpCFG -analyzer-config cfg-rich-constructors=false %s > %t 2>&1
-// RUN: FileCheck --input-file=%t -check-prefixes=CHECK,WARNINGS %s
-// RUN: %clang_analyze_cc1 -fcxx-exceptions -fexceptions -analyzer-checker=debug.DumpCFG -analyzer-config cfg-rich-constructors=true %s > %t 2>&1
-// RUN: FileCheck --input-file=%t -check-prefixes=CHECK,ANALYZER %s
+// RUN: %clang_analyze_cc1 -std=c++98 -fcxx-exceptions -fexceptions -analyzer-checker=debug.DumpCFG -analyzer-config cfg-rich-constructors=false %s > %t 2>&1
+// RUN: FileCheck --input-file=%t -check-prefixes=CHECK,CXX98,WARNINGS,CXX98-WARNINGS %s
+// RUN: %clang_analyze_cc1 -std=c++98 -fcxx-exceptions -fexceptions -analyzer-checker=debug.DumpCFG -analyzer-config cfg-rich-constructors=true %s > %t 2>&1
+// RUN: FileCheck --input-file=%t -check-prefixes=CHECK,CXX98,ANALYZER,CXX98-ANALYZER %s
+// RUN: %clang_analyze_cc1 -std=c++11 -fcxx-exceptions -fexceptions -analyzer-checker=debug.DumpCFG -analyzer-config cfg-rich-constructors=false %s > %t 2>&1
+// RUN: FileCheck --input-file=%t -check-prefixes=CHECK,CXX11,WARNINGS,CXX11-WARNINGS %s
+// RUN: %clang_analyze_cc1 -std=c++11 -fcxx-exceptions -fexceptions -analyzer-checker=debug.DumpCFG -analyzer-config cfg-rich-constructors=true %s > %t 2>&1
+// RUN: FileCheck --input-file=%t -check-prefixes=CHECK,CXX11,ANALYZER,CXX11-ANALYZER %s
 
 // This file tests how we construct two different flavors of the Clang CFG -
 // the CFG used by the Sema analysis-based warnings and the CFG used by the
 // static analyzer. The difference in the behavior is checked via FileCheck
 // prefixes (WARNINGS and ANALYZER respectively). When introducing new analyzer
 // flags, no new run lines should be added - just these flags would go to the
 // respective line depending on where is it turned on and where is it turned
 // off. Feel free to add tests that test only one of the CFG flavors if you're
 // not sure how the other flavor is supposed to work in your case.
 
 class A {
 public:
+  int x;
+
 // CHECK:      [B1 (ENTRY)]
 // CHECK-NEXT:   Succs (1): B0
 // CHECK:      [B0 (EXIT)]
 // CHECK-NEXT:   Preds (1): B1
   A() {}
 
 // CHECK:      [B1 (ENTRY)]
 // CHECK-NEXT:   Succs (1): B0
void test_const_ref() {
   A a;
   const A& b = a;
   const A& c = A();
 }
 
 // CHECK:      [B2 (ENTRY)]
 // CHECK-NEXT:   Succs (1): B1
 // CHECK:      [B1]
+// WARNINGS-NEXT:   1: A() (CXXConstructExpr, class A)
+// CXX98-ANALYZER-NEXT:   1: A() (CXXConstructExpr, [B1.2], class A)
+// CXX11-ANALYZER-NEXT:   1: A() (CXXConstructExpr, [B1.2], [B1.3], class A)
+// CHECK-NEXT:   2: [B1.1] (BindTemporary)
+// CXX98-NEXT:   3: [B1.2].x
+// CXX98-NEXT:   4: [B1.3]
+// CXX98-NEXT:   5: const int &x = A().x;
+// CXX98-NEXT:   6: [B1.5].~A() (Implicit destructor)
+// CXX11-NEXT:   3: [B1.2]
+// CXX11-NEXT:   4: [B1.3].x
+// CXX11-NEXT:   5: [B1.4] (ImplicitCastExpr, NoOp, const int)
+// CXX11-NEXT:   6: const int &x = A().x;
+// CXX11-NEXT:   7: [B1.6].~A() (Implicit destructor)
+// CHECK-NEXT:   Preds (1): B2
+// CHECK-NEXT:   Succs (1): B0
+// CHECK:      [B0 (EXIT)]
+// CHECK-NEXT:   Preds (1): B1
+void test_const_ref_to_field() {
+  const int &x = A().x;
+}
+
+// CHECK:        [B2 (ENTRY)]
+// CHECK-NEXT:     Succs (1): B1
+// CHECK:        [B1]
+// WARNINGS-NEXT:     1: A() (CXXConstructExpr, class A)
+// CXX98-ANALYZER-NEXT:     1: A() (CXXConstructExpr, [B1.2], class A)
+// CXX11-ANALYZER-NEXT:     1: A() (CXXConstructExpr, [B1.2], [B1.3], class A)
+// CHECK-NEXT:     2: [B1.1] (BindTemporary)
+// CXX98-NEXT:     3: A::x
+// CXX98-NEXT:     4: &[B1.3]
+// CXX98-NEXT:     5: [B1.2] .* [B1.4]
+// CXX98-NEXT:     6: [B1.5]
+// CXX98-NEXT:     7: const int &x = A() .* &A::x;
+// CXX98-NEXT:     8: [B1.7].~A() (Implicit destructor)
+// CXX11-NEXT:     3: [B1.2]
+// CXX11-NEXT:     4: A::x
+// CXX11-NEXT:     5: &[B1.4]
+// CXX11-NEXT:     6: [B1.3] .* [B1.5]
+// CXX11-NEXT:     7: [B1.6] (ImplicitCastExpr, NoOp, const int)
+// CXX11-NEXT:     8: const int &x = A() .* &A::x;
+// CXX11-NEXT:     9: [B1.8].~A() (Implicit destructor)
+// CHECK-NEXT:     Preds (1): B2
+// CHECK-NEXT:     Succs (1): B0
+// CHECK:        [B0 (EXIT)]
+// CHECK-NEXT:     Preds (1): B1
+void test_pointer_to_member() {
+  const int &x = A().*&A::x;
+}
+
+// FIXME: There should be automatic destructors at the end of scope.
+// CHECK:        [B2 (ENTRY)]
+// CHECK-NEXT:     Succs (1): B1
+// CHECK:        [B1]
+// WARNINGS-NEXT:     1: A() (CXXConstructExpr, class A)
+// ANALYZER-NEXT:     1: A() (CXXConstructExpr, [B1.2], [B1.4], class A)
+// CHECK-NEXT:     2: [B1.1] (BindTemporary)
+// CHECK-NEXT:     3: [B1.2] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:     4: [B1.3]
+// CHECK-NEXT:     5: {[B1.4]}
+// CHECK-NEXT:     6: B b = {A()};
+// WARNINGS-NEXT:     7: A() (CXXConstructExpr, class A)
+// ANALYZER-NEXT:     7: A() (CXXConstructExpr, [B1.8], [B1.10], class A)
+// CHECK-NEXT:     8: [B1.7] (BindTemporary)
+// CHECK-NEXT:     9: [B1.8] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    10: [B1.9]
+// CHECK-NEXT:    11: {[B1.10]}
+// WARNINGS-NEXT:    12: A() (CXXConstructExpr, class A)
+// ANALYZER-NEXT:    12: A() (CXXConstructExpr, [B1.13], [B1.15], class A)
+// CHECK-NEXT:    13: [B1.12] (BindTemporary)
+// CHECK-NEXT:    14: [B1.13] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    15: [B1.14]
+// CHECK-NEXT:    16: {[B1.15]}
+// CHECK-NEXT:    17: {[B1.10], [B1.15]}
+// CHECK-NEXT:    18: B bb[2] = {A(), A()};
+// CHECK-NEXT:     Preds (1): B2
+// CHECK-NEXT:     Succs (1): B0
+// CHECK:        [B0 (EXIT)]
+// CHECK-NEXT:     Preds (1): B1
+void test_aggregate_lifetime_extension() {
+  struct B {
+    const A &x;
+  };
+
+  B b = {A()};
+  B bb[2] = {A(), A()};
+}
+
+// In C++98 such class 'C' will not be an aggregate.
+#if __cplusplus >= 201103L
+// FIXME: There should be automatic destructors at the end of the scope.
+// CXX11:        [B2 (ENTRY)]
+// CXX11-NEXT:     Succs (1): B1
+// CXX11:        [B1]
+// CXX11-WARNINGS-NEXT:     1: A() (CXXConstructExpr, class A)
+// CXX11-ANALYZER-NEXT:     1: A() (CXXConstructExpr, [B1.2], [B1.4], class A)
+// CXX11-NEXT:     2: [B1.1] (BindTemporary)
+// CXX11-NEXT:     3: [B1.2] (ImplicitCastExpr, NoOp, const class A)
+// CXX11-NEXT:     4: [B1.3]
+// CXX11-NEXT:     5: [B1.4] (CXXConstructExpr, const class A)
+// CXX11-WARNINGS-NEXT:     6: A() (CXXConstructExpr, class A)
+// CXX11-ANALYZER-NEXT:     6: A() (CXXConstructExpr, [B1.7], [B1.9], class A)
+// CXX11-NEXT:     7: [B1.6] (BindTemporary)
+// CXX11-NEXT:     8: [B1.7] (ImplicitCastExpr, NoOp, const class A)
+// CXX11-NEXT:     9: [B1.8]
+// CXX11-NEXT:    10: [B1.9] (CXXConstructExpr, const class A)
+// FIXME: Why does it look as if the initializer list consumes uncopied objects?
+// CXX11-NEXT:    11: {[B1.2], [B1.7]}
+// CXX11-NEXT:    12: [B1.11] (BindTemporary)
+// CXX11-NEXT:    13: [B1.12]
+// CXX11-NEXT:    14: {[B1.13]}
+// Double curly braces trigger regexps, escape as per FileCheck manual.
+// CXX11-NEXT:    15: C c = {{[{][{]}}A(), A(){{[}][}]}};
+// CXX11-NEXT:    16: ~A() (Temporary object destructor)
+// CXX11-NEXT:    17: ~A() (Temporary object destructor)
+// CXX11-WARNINGS-NEXT:    18: A() (CXXConstructExpr, class A)
+// CXX11-ANALYZER-NEXT:    18: A() (CXXConstructExpr, [B1.19], [B1.21], class A)
+// CXX11-NEXT:    19: [B1.18] (BindTemporary)
+// CXX11-NEXT:    20: [B1.19] (ImplicitCastExpr, NoOp, const class A)
+// CXX11-NEXT:    21: [B1.20]
+// CXX11-NEXT:    22: [B1.21] (CXXConstructExpr, const class A)
+// CXX11-WARNINGS-NEXT:    23: A() (CXXConstructExpr, class A)
+// CXX11-ANALYZER-NEXT:    23: A() (CXXConstructExpr, [B1.24], [B1.26], class A)
+// CXX11-NEXT:    24: [B1.23] (BindTemporary)
+// CXX11-NEXT:    25: [B1.24] (ImplicitCastExpr, NoOp, const class A)
+// CXX11-NEXT:    26: [B1.25]
+// CXX11-NEXT:    27: [B1.26] (CXXConstructExpr, const class A)
+// FIXME: Why does it look as if the initializer list consumes uncopied objects?
+// CXX11-NEXT:    28: {[B1.19], [B1.24]}
+// CXX11-NEXT:    29: [B1.28] (BindTemporary)
+// CXX11-NEXT:    30: [B1.29]
+// CXX11-NEXT:    31: {[B1.30]}
+// CXX11-WARNINGS-NEXT:    32: A() (CXXConstructExpr, class A)
+// CXX11-ANALYZER-NEXT:    32: A() (CXXConstructExpr, [B1.33], [B1.35], class A)
+// CXX11-NEXT:    33: [B1.32] (BindTemporary)
+// CXX11-NEXT:    34: [B1.33] (ImplicitCastExpr, NoOp, const class A)
+// CXX11-NEXT:    35: [B1.34]
+// CXX11-NEXT:    36: [B1.35] (CXXConstructExpr, const class A)
+// CXX11-WARNINGS-NEXT:    37: A() (CXXConstructExpr, class A)
+// CXX11-ANALYZER-NEXT:    37: A() (CXXConstructExpr, [B1.38], [B1.40], class A)
+// CXX11-NEXT:    38: [B1.37] (BindTemporary)
+// CXX11-NEXT:    39: [B1.38] (ImplicitCastExpr, NoOp, const class A)
+// CXX11-NEXT:    40: [B1.39]
+// CXX11-NEXT:    41: [B1.40] (CXXConstructExpr, const class A)
+// FIXME: Why does it look as if the initializer list consumes uncopied objects?
+// CXX11-NEXT:    42: {[B1.33], [B1.38]}
+// CXX11-NEXT:    43: [B1.42] (BindTemporary)
+// CXX11-NEXT:    44: [B1.43]
+// CXX11-NEXT:    45: {[B1.44]}
+// Double curly braces trigger regexps, escape as per FileCheck manual.
+// CXX11-NEXT:    46: {{[{][{]}}[B1.30]}, {[B1.44]{{[}][}]}}
+// Double curly braces trigger regexps, escape as per FileCheck manual.
+// CXX11-NEXT:    47: C cc[2] = {{[{][{][{]}}A(), A(){{[}][}]}}, {{[{][{]}}A(), A(){{[}][}][}]}};
+// CXX11-NEXT:    48: ~A() (Temporary object destructor)
+// CXX11-NEXT:    49: ~A() (Temporary object destructor)
+// CXX11-NEXT:    50: ~A() (Temporary object destructor)
+// CXX11-NEXT:    51: ~A() (Temporary object destructor)
+// CXX11-NEXT:     Preds (1): B2
+// CXX11-NEXT:     Succs (1): B0
+// CXX11:        [B0 (EXIT)]
+// CXX11-NEXT:     Preds (1): B1
+void test_aggregate_array_lifetime_extension() {
+  struct C {
+    const A (&z)[2];
+  };
+
+  // Until C++17 there are elidable copies here, so there should be 9 temporary
+  // destructors of A()s. There are no destructors of 'c' and 'cc' because this
+  // aggregate has no destructor. Instead, arrays are lifetime-extended,
+  // and copies of A()s within them need to be destroyed via automatic
+  // destructors.
+  C c = {{A(), A()}};
+  C cc[2] = {{{A(), A()}}, {{A(), A()}}};
+}
+#endif
+
+// CHECK:        [B2 (ENTRY)]
+// CHECK-NEXT:     Succs (1): B1
+// CHECK:        [B1]
+// WARNINGS-NEXT:     1: A() (CXXConstructExpr, class A)
+// ANALYZER-NEXT:     1: A() (CXXConstructExpr, [B1.2], [B1.4], class A)
+// CHECK-NEXT:     2: [B1.1] (BindTemporary)
+// CHECK-NEXT:     3: [B1.2] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:     4: [B1.3]
+// CHECK-NEXT:     5: [B1.4] (CXXConstructExpr, class A)
+// WARNINGS-NEXT:     6: A() (CXXConstructExpr, class A)
+// ANALYZER-NEXT:     6: A() (CXXConstructExpr, [B1.7], [B1.9], class A)
+// CHECK-NEXT:     7: [B1.6] (BindTemporary)
+// CHECK-NEXT:     8: [B1.7] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:     9: [B1.8]
+// CHECK-NEXT:    10: [B1.9] (CXXConstructExpr, class A)
+// WARNINGS-NEXT:    11: A() (CXXConstructExpr, class A)
+// ANALYZER-NEXT:    11: A() (CXXConstructExpr, [B1.12], [B1.14], class A)
+// CHECK-NEXT:    12: [B1.11] (BindTemporary)
+// CHECK-NEXT:    13: [B1.12] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    14: [B1.13]
+// CHECK-NEXT:    15: [B1.14] (CXXConstructExpr, class A)
+// FIXME: Why does it look as if the initializer list consumes uncopied objects?
+// CHECK-NEXT:    16: {[B1.7], [B1.12]}
+// FIXME: Why does it look as if the initializer list consumes uncopied objects?
+// CHECK-NEXT:    17: {[B1.2], {[B1.7], [B1.12]}}
+// CHECK-NEXT:    18: D d = {A(), {A(), A()}};
+// CHECK-NEXT:    19: ~A() (Temporary object destructor)
+// CHECK-NEXT:    20: ~A() (Temporary object destructor)
+// CHECK-NEXT:    21: ~A() (Temporary object destructor)
+// WARNINGS-NEXT:    22: A() (CXXConstructExpr, class A)
+// ANALYZER-NEXT:    22: A() (CXXConstructExpr, [B1.23], [B1.25], class A)
+// CHECK-NEXT:    23: [B1.22] (BindTemporary)
+// CHECK-NEXT:    24: [B1.23] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    25: [B1.24]
+// CHECK-NEXT:    26: [B1.25] (CXXConstructExpr, class A)
+// WARNINGS-NEXT:    27: A() (CXXConstructExpr, class A)
+// ANALYZER-NEXT:    27: A() (CXXConstructExpr, [B1.28], [B1.30], class A)
+// CHECK-NEXT:    28: [B1.27] (BindTemporary)
+// CHECK-NEXT:    29: [B1.28] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    30: [B1.29]
+// CHECK-NEXT:    31: [B1.30] (CXXConstructExpr, class A)
+// WARNINGS-NEXT:    32: A() (CXXConstructExpr, class A)
+// ANALYZER-NEXT:    32: A() (CXXConstructExpr, [B1.33], [B1.35], class A)
+// CHECK-NEXT:    33: [B1.32] (BindTemporary)
+// CHECK-NEXT:    34: [B1.33] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    35: [B1.34]
+// CHECK-NEXT:    36: [B1.35] (CXXConstructExpr, class A)
+// FIXME: Why does it look as if the initializer list consumes uncopied objects?
+// CHECK-NEXT:    37: {[B1.28], [B1.33]}
+// FIXME: Why does it look as if the initializer list consumes uncopied objects?
+// CHECK-NEXT:    38: {[B1.23], {[B1.28], [B1.33]}}
+// WARNINGS-NEXT:    39: A() (CXXConstructExpr, class A)
+// ANALYZER-NEXT:    39: A() (CXXConstructExpr, [B1.40], [B1.42], class A)
+// CHECK-NEXT:    40: [B1.39] (BindTemporary)
+// CHECK-NEXT:    41: [B1.40] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    42: [B1.41]
+// CHECK-NEXT:    43: [B1.42] (CXXConstructExpr, class A)
+// WARNINGS-NEXT:    44: A() (CXXConstructExpr, class A)
+// ANALYZER-NEXT:    44: A() (CXXConstructExpr, [B1.45], [B1.47], class A)
+// CHECK-NEXT:    45: [B1.44] (BindTemporary)
+// CHECK-NEXT:    46: [B1.45] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    47: [B1.46]
+// CHECK-NEXT:    48: [B1.47] (CXXConstructExpr, class A)
+// WARNINGS-NEXT:    49: A() (CXXConstructExpr, class A)
+// ANALYZER-NEXT:    49: A() (CXXConstructExpr, [B1.50], [B1.52], class A)
+// CHECK-NEXT:    50: [B1.49] (BindTemporary)
+// CHECK-NEXT:    51: [B1.50] (ImplicitCastExpr, NoOp, const class A)
+// CHECK-NEXT:    52: [B1.51]
+// CHECK-NEXT:    53: [B1.52] (CXXConstructExpr, class A)
+// FIXME: Why does it look as if the initializer list consumes uncopied objects?
+// CHECK-NEXT:    54: {[B1.45], [B1.50]}
+// FIXME: Why does it look as if the initializer list consumes uncopied objects?
+// CHECK-NEXT:    55: {[B1.40], {[B1.45], [B1.50]}}
+// Double curly braces trigger regexps, escape as per FileCheck manual.
+// CHECK-NEXT:    56: {{[{][{]}}[B1.23], {[B1.28], [B1.33]{{[}][}]}}, {[B1.40], {[B1.45], [B1.50]{{[}][}][}]}}
+// Double curly braces trigger regexps, escape as per FileCheck manual.
+// CHECK-NEXT:    57: D dd[2] = {{[{][{]}}A(), {A(), A(){{[}][}]}}, {A(), {A(), A(){{[}][}][}]}};
+// CHECK-NEXT:    58: ~A() (Temporary object destructor)
+// CHECK-NEXT:    59: ~A() (Temporary object destructor)
+// CHECK-NEXT:    60: ~A() (Temporary object destructor)
+// CHECK-NEXT:    61: ~A() (Temporary object destructor)
+// CHECK-NEXT:    62: ~A() (Temporary object destructor)
+// CHECK-NEXT:    63: ~A() (Temporary object destructor)
+// CHECK-NEXT:    64: [B1.57].~D() (Implicit destructor)
+// CHECK-NEXT:    65: [B1.18].~D() (Implicit destructor)
+// CHECK-NEXT:     Preds (1): B2
+// CHECK-NEXT:     Succs (1): B0
+// CHECK:        [B0 (EXIT)]
+// CHECK-NEXT:     Preds (1): B1
+void test_aggregate_with_nontrivial_own_destructor() {
+  struct D {
+    A y;
+    A w[2];
+  };
+
+  // Until C++17 there are elidable copies here, so there should be 9 temporary
+  // destructors of A()s. Destructors of 'd' and 'dd' should implicitly
+  // take care of the copies, so there should not be automatic destructors
+  // for copies of A()s.
+  D d = {A(), {A(), A()}};
+  D dd[2] = {{A(), {A(), A()}}, {A(), {A(), A()}}};
+}
+
+// CHECK:      [B2 (ENTRY)]
+// CHECK-NEXT:   Succs (1): B1
+// CHECK:      [B1]
 // WARNINGS-NEXT:   1:  (CXXConstructExpr, class A [2])
 // ANALYZER-NEXT:   1:  (CXXConstructExpr, [B1.2], class A [2])
 // CHECK-NEXT:   2: A a[2];
 // WARNINGS-NEXT:   3:  (CXXConstructExpr, class A [0])
 // ANALYZER-NEXT:   3:  (CXXConstructExpr, [B1.4], class A [0])
 // CHECK-NEXT:   4: A b[0];
 // CHECK-NEXT:   5: [B1.2].~A() (Implicit destructor)
 // CHECK-NEXT:   Preds (1): B2