Implement inlining of temporary destructors.

[alexmc]

Woo :D nice work!

test/Analysis/temporaries.cpp

106–107

Remove fixme

[klimek]

Added more tests, and a FIXME for the parameter passing test.
Addressed review comments.

[klimek]

Do not inline temporary destructors for temporaries that bind to parameters.

[jordan_rose]

Do we really need to put the "binds parameter" information in the CFG? I was hoping we could look in the parent map to see how the temporary is used (like for 'new' right now).

include/clang/Analysis/CFG.h

284

Why not just use "self"? Or &T? Why "T"? Why does T require a dynamic allocation?

lib/StaticAnalyzer/Core/ExprEngine.cpp

719–724

This is not how LCVs work. An LCV is a snapshot of a region at a particular "time" (state of the Store); the region may not exist in the current store. The "best" answer in the current scheme is to use createTemporaryRegionIfNeeded, but the right answer may end up being to disregard the rvalue-ness of temporaries (as we talked about some on cfe-dev).

lib/StaticAnalyzer/Core/ProgramState.cpp

508–509 ↗

(On Diff #12305)

This is not correct; see above.

[klimek]

Dumping of intermediate state developed with Jordan...

include/clang/Analysis/CFG.h

static bool isKind(const CFGElement &E) {
     return E.getKind() == MemberDtor;
   }
 };
 
 /// CFGTemporaryDtor - Represents C++ object destructor implicitly generated
 /// at the end of full expression for temporary object.
 class CFGTemporaryDtor : public CFGImplicitDtor {
 public:
-  CFGTemporaryDtor(CXXBindTemporaryExpr *expr)
-      : CFGImplicitDtor(TemporaryDtor, expr, nullptr) {}
+  CFGTemporaryDtor(CXXBindTemporaryExpr *expr, bool BindsParameter)
+      : CFGImplicitDtor(TemporaryDtor, expr, BindsParameter ? this : nullptr) {}
 
   const CXXBindTemporaryExpr *getBindTemporaryExpr() const {
     return static_cast<const CXXBindTemporaryExpr *>(Data1.getPointer());
   }
 
+  bool bindsParameter() const { return Data2.getPointer(); }
+
 private:
   friend class CFGElement;
   CFGTemporaryDtor() {}
   static bool isKind(const CFGElement &E) {
     return E.getKind() == TemporaryDtor;
   }
 };
 
public:
   void appendBaseDtor(const CXXBaseSpecifier *BS, BumpVectorContext &C) {
     Elements.push_back(CFGBaseDtor(BS), C);
   }
 
   void appendMemberDtor(FieldDecl *FD, BumpVectorContext &C) {
     Elements.push_back(CFGMemberDtor(FD), C);
   }
 
-  void appendTemporaryDtor(CXXBindTemporaryExpr *E, BumpVectorContext &C) {
-    Elements.push_back(CFGTemporaryDtor(E), C);
+  void appendTemporaryDtor(CXXBindTemporaryExpr *E, BumpVectorContext &C,
+                           bool BindsParameter) {
+    Elements.push_back(CFGTemporaryDtor(E, BindsParameter), C);
   }
 
   void appendAutomaticObjDtor(VarDecl *VD, Stmt *S, BumpVectorContext &C) {
     Elements.push_back(CFGAutomaticObjDtor(VD, S), C);
   }
 
   void appendDeleteDtor(CXXRecordDecl *RD, CXXDeleteExpr *DE, BumpVectorContext &C) {
     Elements.push_back(CFGDeleteDtor(RD, DE), C);

include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h

protected:
   explicit Loc(unsigned SubKind, const void *D)
   : DefinedSVal(const_cast<void*>(D), true, SubKind) {}
 
 public:
   void dumpToStream(raw_ostream &Out) const;
 
   static inline bool isLocType(QualType T) {
     return T->isAnyPointerType() || T->isBlockPointerType() || 
-           T->isReferenceType() || T->isNullPtrType();
+           T->isReferenceType() || T->isNullPtrType() ||
+           T->isRecordType();
   }
 
 private:
   friend class SVal;
   static bool isKind(const SVal& V) {
     return V.getBaseKind() == LocKind;
   }
 };

lib/Analysis/CFG.cpp

private:
   // Visitors to walk an AST and generate destructors of temporaries in
   // full expression.
   CFGBlock *VisitForTemporaryDtors(Stmt *E, bool BindToTemporary,
                                    TempDtorContext &Context);
   CFGBlock *VisitChildrenForTemporaryDtors(Stmt *E, TempDtorContext &Context);
   CFGBlock *VisitBinaryOperatorForTemporaryDtors(BinaryOperator *E,
                                                  TempDtorContext &Context);
   CFGBlock *VisitCXXBindTemporaryExprForTemporaryDtors(
-      CXXBindTemporaryExpr *E, bool BindToTemporary, TempDtorContext &Context);
+      CXXBindTemporaryExpr *E, bool BindToTemporary, TempDtorContext &Context,
+      bool BindsParameter = false);
   CFGBlock *VisitConditionalOperatorForTemporaryDtors(
       AbstractConditionalOperator *E, bool BindToTemporary,
       TempDtorContext &Context);
   void InsertTempDtorDecisionBlock(const TempDtorContext &Context,
                                    CFGBlock *FalseSucc = nullptr);
 
   // NYS == Not Yet Supported
   CFGBlock *NYS() {
     badCFG = true;
     return Block;
   }
 
   void autoCreateBlock() { if (!Block) Block = createBlock(); }
   CFGBlock *createBlock(bool add_successor = true);
   CFGBlock *createNoReturnBlock();
 
   CFGBlock *addStmt(Stmt *S) {
     return Visit(S, AddStmtChoice::AlwaysAdd);
   }
   CFGBlock *addInitializer(CXXCtorInitializer *I);
+  void addAutomaticObjDtorsForLifetimeExtendedTemporaries(
+      Stmt *E, bool LifetimeExtended = false);
+  void addAutomaticObjDtorsForVarDecl(VarDecl *VD, Stmt* S);
   void addAutomaticObjDtors(LocalScope::const_iterator B,
                             LocalScope::const_iterator E, Stmt *S);
   void addImplicitDtorsForDestructor(const CXXDestructorDecl *DD);
 
   // Local scopes creation.
   LocalScope* createOrReuseLocalScope(LocalScope* Scope);
 
   void addLocalScopeForStmt(Stmt *S);
   LocalScope* addLocalScopeForDeclStmt(DeclStmt *DS,
                                        LocalScope* Scope = nullptr);
+  bool needsLocalScopeForLifetimeExtendedTemporary(const Stmt* E);
+  bool needsLocalScopeForVarDecl(const VarDecl* VD);
+  bool needsLocalScopeForType(QualType QT);
   LocalScope* addLocalScopeForVarDecl(VarDecl *VD, LocalScope* Scope = nullptr);
 
   void addLocalScopeAndDtors(Stmt *S);
 
   // Interface to CFGBlock - adding CFGElements.
   void appendStmt(CFGBlock *B, const Stmt *S) {
     if (alwaysAdd(S) && cachedEntry)
       cachedEntry->second = B;
void appendNewAllocator(CFGBlock *B, CXXNewExpr *NE) {
     B->appendNewAllocator(NE, cfg->getBumpVectorContext());
   }
   void appendBaseDtor(CFGBlock *B, const CXXBaseSpecifier *BS) {
     B->appendBaseDtor(BS, cfg->getBumpVectorContext());
   }
   void appendMemberDtor(CFGBlock *B, FieldDecl *FD) {
     B->appendMemberDtor(FD, cfg->getBumpVectorContext());
   }
-  void appendTemporaryDtor(CFGBlock *B, CXXBindTemporaryExpr *E) {
-    B->appendTemporaryDtor(E, cfg->getBumpVectorContext());
+  void appendTemporaryDtor(CFGBlock *B, CXXBindTemporaryExpr *E,
+                           bool BindsParameter) {
+    B->appendTemporaryDtor(E, cfg->getBumpVectorContext(), BindsParameter);
   }
   void appendAutomaticObjDtor(CFGBlock *B, VarDecl *VD, Stmt *S) {
     B->appendAutomaticObjDtor(VD, S, cfg->getBumpVectorContext());
   }
 
   void appendDeleteDtor(CFGBlock *B, CXXRecordDecl *RD, CXXDeleteExpr *DE) {
     B->appendDeleteDtor(RD, DE, cfg->getBumpVectorContext());
   }
if (HasTemporaries) {
       return Visit(cast<ExprWithCleanups>(Init)->getSubExpr());
     }
     return Visit(Init);
   }
 
   return Block;
 }
 
-/// \brief Retrieve the type of the temporary object whose lifetime was 
-/// extended by a local reference with the given initializer.
-static QualType getReferenceInitTemporaryType(ASTContext &Context,
-                                              const Expr *Init) {
-  while (true) {
-    // Skip parentheses.
-    Init = Init->IgnoreParens();
-    
-    // Skip through cleanups.
-    if (const ExprWithCleanups *EWC = dyn_cast<ExprWithCleanups>(Init)) {
-      Init = EWC->getSubExpr();
-      continue;
+void CFGBuilder::addAutomaticObjDtorsForLifetimeExtendedTemporaries(
+    Stmt *E, bool LifetimeExtended) {
+  switch (E->getStmtClass()) {
+    // FIXME: What do we want to do for conditional operators and binary
+    // conditional operators?
+  case Stmt::MaterializeTemporaryExprClass: {
+    const MaterializeTemporaryExpr * MTE = cast<MaterializeTemporaryExpr>(E);
+    if (MTE->getStorageDuration() != SD_FullExpression) {
+      SmallVector<const Expr *, 2> CommaLHSs;
+      SmallVector<SubobjectAdjustment, 2> Adjustments;
+      assert(MTE->GetTemporaryExpr());
+      const Expr *ExtendedE =
+          MTE->GetTemporaryExpr()->skipRValueSubobjectAdjustments(CommaLHSs,
+                                                                  Adjustments);
+      addAutomaticObjDtorsForLifetimeExtendedTemporaries(
+          const_cast<Expr*>(ExtendedE), /*LifetimeExtended=*/true);
     }
-    
-    // Skip through the temporary-materialization expression.
-    if (const MaterializeTemporaryExpr *MTE
-          = dyn_cast<MaterializeTemporaryExpr>(Init)) {
-      Init = MTE->GetTemporaryExpr();
-      continue;
+  } break;
+  case Stmt::CXXBindTemporaryExprClass:
+    // If the temporary is not lifetime extended, we'll handle it in
+    // VisitForTemporaryDtors instead.
+    if (LifetimeExtended) {
+      const CXXDestructorDecl *Dtor =
+          cast<CXXBindTemporaryExpr>(E)->getTemporary()->getDestructor();
+      if (Dtor->isNoReturn()) {
+        Block = createNoReturnBlock();
+      } else {
+        autoCreateBlock();
       }
-    
-    // Skip derived-to-base and no-op casts.
-    if (const CastExpr *CE = dyn_cast<CastExpr>(Init)) {
-      if ((CE->getCastKind() == CK_DerivedToBase ||
-           CE->getCastKind() == CK_UncheckedDerivedToBase ||
-           CE->getCastKind() == CK_NoOp) &&
-          Init->getType()->isRecordType()) {
-        Init = CE->getSubExpr();
-        continue;
-      }
+      appendTemporaryDtor(Block, cast<CXXBindTemporaryExpr>(E), false);
+    break;
+  case Stmt::ConditionalOperatorClass:
+  case Stmt::BinaryConditionalOperatorClass:
+    // FIXME: Implement. If both the true and false branch yield lifetime
+    // extended temporaries, we need to add a branch that triggers on which
+    // temporary constructor was executed.
+    break;
+  default:
+    LifetimeExtended = false;
+    // Fallthrough.
+  case Stmt::ParenExprClass:
+  case Stmt::CXXFunctionalCastExprClass:
+  case Stmt::ImplicitCastExprClass:
+  case Stmt::ExprWithCleanupsClass:
+  case Stmt::CXXDefaultArgExprClass:
+  case Stmt::CXXDefaultInitExprClass:
+    for (Stmt *Child : E->children()) {
+      if (Child)
+        addAutomaticObjDtorsForLifetimeExtendedTemporaries(Child,
+                                                           LifetimeExtended);
     }
-    
-    // Skip member accesses into rvalues.
-    if (const MemberExpr *ME = dyn_cast<MemberExpr>(Init)) {
-      if (!ME->isArrow() && ME->getBase()->isRValue()) {
-        Init = ME->getBase();
-        continue;
-      }
-    }
-    
-    break;
-  }
+    break;
+  case Stmt::BlockExprClass:
+  case Stmt::LambdaExprClass:
+    break;
+void CFGBuilder::addAutomaticObjDtorsForVarDecl(VarDecl *VD,
+                                                Stmt *S) {
+  if (!VD->getType()->isReferenceType() &&
+      needsLocalScopeForType(VD->getType())) {
+    QualType QT = VD->getType();
+    QT = Context->getBaseElementType(QT);
 
-  return Init->getType();
+    const CXXDestructorDecl *Dtor = QT->getAsCXXRecordDecl()->getDestructor();
+    if (Dtor->isNoReturn())
+      Block = createNoReturnBlock();
+    else
+      autoCreateBlock();
+
+    appendAutomaticObjDtor(Block, VD, S);
+  }
+  if (const Expr *Init = VD->getInit()) {
+    addAutomaticObjDtorsForLifetimeExtendedTemporaries(
+        const_cast<Expr *>(Init));
+  }
 }
-  
 /// addAutomaticObjDtors - Add to current block automatic objects destructors
 /// for objects in range of local scope positions. Use S as trigger statement
 /// for destructors.
 void CFGBuilder::addAutomaticObjDtors(LocalScope::const_iterator B,
                                       LocalScope::const_iterator E, Stmt *S) {
   if (!BuildOpts.AddImplicitDtors)
     return;
 
   if (B == E)
     return;
 
   // We need to append the destructors in reverse order, but any one of them
   // may be a no-return destructor which changes the CFG. As a result, buffer
   // this sequence up and replay them in reverse order when appending onto the
   // CFGBlock(s).
   SmallVector<VarDecl*, 10> Decls;
   Decls.reserve(B.distance(E));
   for (LocalScope::const_iterator I = B; I != E; ++I)
     Decls.push_back(*I);
 
   for (SmallVectorImpl<VarDecl*>::reverse_iterator I = Decls.rbegin(),
                                                    E = Decls.rend();
        I != E; ++I) {
-    // If this destructor is marked as a no-return destructor, we need to
-    // create a new block for the destructor which does not have as a successor
-    // anything built thus far: control won't flow out of this block.
-    QualType Ty = (*I)->getType();
-    if (Ty->isReferenceType()) {
-      Ty = getReferenceInitTemporaryType(*Context, (*I)->getInit());
-    }
-    Ty = Context->getBaseElementType(Ty);
-
-    const CXXDestructorDecl *Dtor = Ty->getAsCXXRecordDecl()->getDestructor();
-    if (Dtor->isNoReturn())
-      Block = createNoReturnBlock();
-    else
-      autoCreateBlock();
-
-    appendAutomaticObjDtor(Block, *I, S);
+    addAutomaticObjDtorsForVarDecl(*I, S);
   }
 }
 
 /// addImplicitDtorsForDestructor - Add implicit destructors generated for
 /// base and member objects in destructor.
 void CFGBuilder::addImplicitDtorsForDestructor(const CXXDestructorDecl *DD) {
   assert (BuildOpts.AddImplicitDtors
       && "Can be called only when dtors should be added");
if (!BuildOpts.AddImplicitDtors)
     return Scope;
 
   for (auto *DI : DS->decls())
     if (VarDecl *VD = dyn_cast<VarDecl>(DI))
       Scope = addLocalScopeForVarDecl(VD, Scope);
   return Scope;
 }
 
+bool CFGBuilder::needsLocalScopeForType(QualType QT) {
+  // Check for constant size array. Set type to array element type.
+  while (const ConstantArrayType *AT = Context->getAsConstantArrayType(QT)) {
+    if (AT->getSize() == 0)
+      return false;
+    QT = AT->getElementType();
+  }
+
+  // Check if type is a C++ class with non-trivial destructor.
+  if (const CXXRecordDecl *CD = QT->getAsCXXRecordDecl())
+    return !CD->hasTrivialDestructor();
+  return false;
+}
+
+bool CFGBuilder::needsLocalScopeForLifetimeExtendedTemporary(const Stmt* E) {
+  // FIXME: Handle cases where the scope would be introduced by a nested
+  // lambda or block.
+  switch (E->getStmtClass()) {
+  case Stmt::MaterializeTemporaryExprClass: {
+    const MaterializeTemporaryExpr * MTE = cast<MaterializeTemporaryExpr>(E);
+    if (MTE->getStorageDuration() != SD_FullExpression) {
+      SmallVector<const Expr *, 2> CommaLHSs;
+      SmallVector<SubobjectAdjustment, 2> Adjustments;
+      assert(MTE->GetTemporaryExpr());
+      const Expr *ExtendedE =
+          MTE->GetTemporaryExpr()->skipRValueSubobjectAdjustments(CommaLHSs,
+                                                                  Adjustments);
+      return needsLocalScopeForType(ExtendedE->getType()) ||
+             needsLocalScopeForLifetimeExtendedTemporary(ExtendedE);
+    }
+  } break;
+  default:
+    for (const Stmt *Child : E->children()) {
+      if (Child && needsLocalScopeForLifetimeExtendedTemporary(Child))
+        return true;
+    }
+    break;
+  }
+  return false;
+}
+
+bool CFGBuilder::needsLocalScopeForVarDecl(const VarDecl* VD) {
+  if (!VD->getType()->isReferenceType() &&
+      needsLocalScopeForType(VD->getType())) {
+    return true;
+  }
+  if (const Expr *Init = VD->getInit()) {
+    return needsLocalScopeForLifetimeExtendedTemporary(Init);
+  }
+  return false;
+}
+
 /// addLocalScopeForVarDecl - Add LocalScope for variable declaration. It will
 /// create add scope for automatic objects and temporary objects bound to
 /// const reference. Will reuse Scope if not NULL.
 LocalScope* CFGBuilder::addLocalScopeForVarDecl(VarDecl *VD,
                                                 LocalScope* Scope) {
   if (!BuildOpts.AddImplicitDtors)
     return Scope;
 
   // Check if variable is local.
   switch (VD->getStorageClass()) {
   case SC_None:
   case SC_Auto:
   case SC_Register:
     break;
   default: return Scope;
   }
 
-  // Check for const references bound to temporary. Set type to pointee.
-  QualType QT = VD->getType();
-  if (QT.getTypePtr()->isReferenceType()) {
-    // Attempt to determine whether this declaration lifetime-extends a
-    // temporary.
-    //
-    // FIXME: This is incorrect. Non-reference declarations can lifetime-extend
-    // temporaries, and a single declaration can extend multiple temporaries.
-    // We should look at the storage duration on each nested
-    // MaterializeTemporaryExpr instead.
-    const Expr *Init = VD->getInit();
-    if (!Init)
-      return Scope;
-    if (const ExprWithCleanups *EWC = dyn_cast<ExprWithCleanups>(Init))
-      Init = EWC->getSubExpr();
-    if (!isa<MaterializeTemporaryExpr>(Init))
-      return Scope;
-
-    // Lifetime-extending a temporary.
-    QT = getReferenceInitTemporaryType(*Context, Init);
-  }
-
-  // Check for constant size array. Set type to array element type.
-  while (const ConstantArrayType *AT = Context->getAsConstantArrayType(QT)) {
-    if (AT->getSize() == 0)
-      return Scope;
-    QT = AT->getElementType();
-  }
-
-  // Check if type is a C++ class with non-trivial destructor.
-  if (const CXXRecordDecl *CD = QT->getAsCXXRecordDecl())
-    if (!CD->hasTrivialDestructor()) {
-      // Add the variable to scope
-      Scope = createOrReuseLocalScope(Scope);
-      Scope->addVar(VD);
-      ScopePos = Scope->begin();
-    }
+  if (!needsLocalScopeForVarDecl(VD))
   return Scope;
 }
 
 /// addLocalScopeAndDtors - For given statement add local scope for it and
 /// add destructors that will cleanup the scope. Will reuse Scope if not NULL.
 void CFGBuilder::addLocalScopeAndDtors(Stmt *S) {
   if (!BuildOpts.AddImplicitDtors)
     return;
switch (E->getStmtClass()) {
 
     case Stmt::CXXDefaultArgExprClass:
       E = cast<CXXDefaultArgExpr>(E)->getExpr();
       goto tryAgain;
 
     case Stmt::CXXDefaultInitExprClass:
       E = cast<CXXDefaultInitExpr>(E)->getExpr();
       goto tryAgain;
+
+    case Stmt::CallExprClass: {
+      CFGBlock *B = Block;
+      for (Expr *Arg : cast<CallExpr>(E)->arguments()) {
+        if (!Arg) continue;
+        if (CXXBindTemporaryExpr *BTE = dyn_cast<CXXBindTemporaryExpr>(Arg)) {
+          if (CFGBlock *R = VisitCXXBindTemporaryExprForTemporaryDtors(
+                  BTE, false, Context, /*BindsParameter=*/true)) {
+            B = R;
+          }
+        } else if (CFGBlock *R = VisitForTemporaryDtors(Arg, false, Context)) {
+          B = R;
+        }
+      }
+      return B;
+    }
   }
 }
 
 CFGBlock *CFGBuilder::VisitChildrenForTemporaryDtors(Stmt *E,
                                                      TempDtorContext &Context) {
   if (isa<LambdaExpr>(E)) {
     // Do not visit the children of lambdas; they have their own CFGs.
     return Block;
CFGBlock *CFGBuilder::VisitBinaryOperatorForTemporaryDtors(
   // LHS expression (order of children). For destructors visit them in reverse
   // order.
   CFGBlock *LHSBlock = VisitForTemporaryDtors(E->getLHS(), false, Context);
   CFGBlock *RHSBlock = VisitForTemporaryDtors(E->getRHS(), false, Context);
   return RHSBlock ? RHSBlock : LHSBlock;
 }
 
 CFGBlock *CFGBuilder::VisitCXXBindTemporaryExprForTemporaryDtors(
-    CXXBindTemporaryExpr *E, bool BindToTemporary, TempDtorContext &Context) {
+    CXXBindTemporaryExpr *E, bool BindToTemporary, TempDtorContext &Context,
+    bool BindsParameter) {
   // First add destructors for temporaries in subexpression.
   CFGBlock *B = VisitForTemporaryDtors(E->getSubExpr(), false, Context);
   if (!BindToTemporary) {
     // If lifetime of temporary is not prolonged (by assigning to constant
     // reference) add destructor for it.
 
     const CXXDestructorDecl *Dtor = E->getTemporary()->getDestructor();
 
if (Dtor->isNoReturn()) {
       if (B) Succ = B;
       Block = createBlock();
     } else {
       autoCreateBlock();
     }
     if (Context.needsTempDtorBranch()) {
       Context.setDecisionPoint(Succ, E);
     }
-    appendTemporaryDtor(Block, E);
+    appendTemporaryDtor(Block, E, BindsParameter);
 
     B = Block;
   }
   return B;
 }
 
 void CFGBuilder::InsertTempDtorDecisionBlock(const TempDtorContext &Context,
                                              CFGBlock *FalseSucc) {

lib/Analysis/LiveVariables.cpp

for (CFGBlock::const_reverse_iterator it = block->rbegin(),
        ei = block->rend(); it != ei; ++it) {
     const CFGElement &elem = *it;
 
     if (Optional<CFGAutomaticObjDtor> Dtor =
             elem.getAs<CFGAutomaticObjDtor>()) {
       val.liveDecls = DSetFact.add(val.liveDecls, Dtor->getVarDecl());
       continue;
     }
+    if (Optional<CFGTemporaryDtor> Dtor =
+            elem.getAs<CFGTemporaryDtor>()) {
+      //llvm::errs() << "keep it live...\n";
+      //Dtor->getBindTemporaryExpr()->dump();
+//      llvm::errs() << "\n";
+      // Temporary objects need to survive until the destructor is called.
+      val.liveStmts = SSetFact.add(val.liveStmts,
+                                   Dtor->getBindTemporaryExpr()->getSubExpr());
+      continue;
+    }
 
     if (!elem.getAs<CFGStmt>())
       continue;
     
     const Stmt *S = elem.castAs<CFGStmt>().getStmt();
     TF.Visit(const_cast<Stmt*>(S));
     stmtsToLiveness[S] = val;
   }

lib/StaticAnalyzer/Core/CallEvent.cpp

CallEventManager::getCaller(const StackFrameContext *CalleeCtx,
   }
 
   // Fall back to the CFG. The only thing we haven't handled yet is
   // destructors, though this could change in the future.
   const CFGBlock *B = CalleeCtx->getCallSiteBlock();
   CFGElement E = (*B)[CalleeCtx->getIndex()];
   assert(E.getAs<CFGImplicitDtor>() &&
          "All other CFG elements should have exprs");
-  assert(!E.getAs<CFGTemporaryDtor>() && "We don't handle temporaries yet");
 
   SValBuilder &SVB = State->getStateManager().getSValBuilder();
   const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
   Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
   SVal ThisVal = State->getSVal(ThisPtr);
 
   const Stmt *Trigger;
   if (Optional<CFGAutomaticObjDtor> AutoDtor = E.getAs<CFGAutomaticObjDtor>())

lib/StaticAnalyzer/Core/CoreEngine.cpp

while (WList->hasWork()) {
     dispatchWorkItem(Node, Node->getLocation(), WU);
   }
   SubEng.processEndWorklist(hasWorkRemaining());
   return WList->hasWork();
 }
 
 void CoreEngine::dispatchWorkItem(ExplodedNode* Pred, ProgramPoint Loc,
                                   const WorkListUnit& WU) {
+  //Pred->getState()->dump();
+  //llvm::errs() << "\n";
   // Dispatch on the location type.
   switch (Loc.getKind()) {
     case ProgramPoint::BlockEdgeKind:
       HandleBlockEdge(Loc.castAs<BlockEdge>(), Pred);
       break;
 
     case ProgramPoint::BlockEntranceKind:
       HandleBlockEntrance(Loc.castAs<BlockEntrance>(), Pred);

lib/StaticAnalyzer/Core/ExprEngine.cpp

ExprEngine::createTemporaryRegionIfNeeded(ProgramStateRef State,
   SVal V = State->getSVal(Ex, LC);
   if (!Result) {
     // If we don't have an explicit result expression, we're in "if needed"
     // mode. Only create a region if the current value is a NonLoc.
     if (!V.getAs<NonLoc>())
       return State;
     Result = Ex;
   } else {
+   // if (const MemRegion *MR = V.getAsRegion())
+   //   if (isa<CXXTempObjectRegion>(MR->getBaseRegion()))
+   //     return State;
     // We need to create a region no matter what. For sanity, make sure we don't
     // try to stuff a Loc into a non-pointer temporary region.
     assert(!V.getAs<Loc>() || Loc::isLocType(Result->getType()) ||
            Result->getType()->isMemberPointerType());
   }
 
   ProgramStateManager &StateMgr = State->getStateManager();
   MemRegionManager &MRMgr = StateMgr.getRegionManager();
for (ExplodedNodeSet::const_iterator
         StateMgr.getPersistentStateWithGDM(CleanedState, CheckerState);
       Bldr.generateNode(DiagnosticStmt, *I, CleanedCheckerSt, &cleanupTag, K);
     }
   }
 }
 
 void ExprEngine::ProcessStmt(const CFGStmt S,
                              ExplodedNode *Pred) {
+  //S.getStmt()->dump();
+  //llvm::errs() << "\n";
   // Reclaim any unnecessary nodes in the ExplodedGraph.
   G.reclaimRecentlyAllocatedNodes();
 
   const Stmt *currStmt = S.getStmt();
   PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
                                 currStmt->getLocStart(),
                                 "Error evaluating statement");
 
void ExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D,
   StmtBldr.generateNode(D.getBindTemporaryExpr(), Pred, State);
 
   QualType varType = D.getBindTemporaryExpr()->getSubExpr()->getType();
   // FIXME: Currently CleanDtorState can be empty here due to temporaries being
   // bound to default parameters.
   assert(CleanDtorState.size() <= 1);
   ExplodedNode *CleanPred =
       CleanDtorState.empty() ? Pred : *CleanDtorState.begin();
+
+  const LocationContext *LCtx = CleanPred->getLocationContext();
+  SVal Val = CleanPred->getState()->getSVal(
+      D.getBindTemporaryExpr()->getSubExpr(), LCtx->getCurrentStackFrame());
+  const MemRegion *Region = Val.getAsRegion();
+  //llvm::errs() << "huh?\n";
+  //if (Region != nullptr) {
+  //  llvm::errs() << "HEEEEEEEEEEEEEEEY!!!!!\n";
+ // }
+  // If the class does not have any members, there will not be a region
+  // for it bound in the environment.
+  //if (Optional<loc::MemRegionVal> MRV =
+  //        Val.getAs<loc::MemRegionVal>()) {
+  //  Region = LCV->getRegion();
+  //}
+
   // FIXME: Inlining of temporary destructors is not supported yet anyway, so
   // we just put a NULL region for now. This will need to be changed later.
-  VisitCXXDestructor(varType, nullptr, D.getBindTemporaryExpr(),
+  VisitCXXDestructor(varType, Region, D.getBindTemporaryExpr(),
                      /*IsBase=*/false, CleanPred, Dst);
 }
 
 void ExprEngine::processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
                                                NodeBuilderContext &BldCtx,
                                                ExplodedNode *Pred,
                                                ExplodedNodeSet &Dst,
                                                const CFGBlock *DstT,
                                                const CFGBlock *DstF) {
   BranchNodeBuilder TempDtorBuilder(Pred, Dst, BldCtx, DstT, DstF);
   if (Pred->getState()->contains<InitializedTemporariesSet>(
           std::make_pair(BTE, Pred->getStackFrame()))) {
     TempDtorBuilder.markInfeasible(false);
     TempDtorBuilder.generateNode(Pred->getState(), true, Pred);
   } else {
     TempDtorBuilder.markInfeasible(true);
     TempDtorBuilder.generateNode(Pred->getState(), false, Pred);
   }
 }
 

lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

 static bool isTemporaryPRValue(const CXXConstructExpr *E, SVal V) {
   if (E->isGLValue())
     return false;
 
   const MemRegion *MR = V.getAsRegion();
   if (!MR)
     return false;
 
-  return isa<CXXTempObjectRegion>(MR);
+  return false;
+  /*(
+  if (isa<CXXTempObjectRegion>(MR) && !isa<CXXTemporaryObjectExpr>(E)) {
+    if (const CXXConstructExpr* CE = llvm::dyn_cast<CXXConstructExpr>(E)) {
+        return true;
+      E->dump();
+      llvm::errs() << "\n";
+    }
+  }
+  return false;
+*/
 }
 
 /// The call exit is simulated with a sequence of nodes, which occur between 
 /// CallExitBegin and CallExitEnd. The following operations occur between the 
 /// two program points:
 /// 1. CallExitBegin (triggers the start of call exit sequence)
 /// 2. Bind the return value
 /// 3. Run Remove dead bindings to clean up the dead symbols from the callee.
case CE_CXXConstructor: {
     if (Ctor.getDecl()->getParent()->hasTrivialDestructor())
       break;
 
     // For other types, only inline constructors if destructor inlining is
     // also enabled.
     if (!Opts.mayInlineCXXMemberFunction(CIMK_Destructors))
       return CIP_DisallowedAlways;
 
-    // FIXME: This is a hack. We don't handle temporary destructors
-    // right now, so we shouldn't inline their constructors.
-    if (CtorExpr->getConstructionKind() == CXXConstructExpr::CK_Complete)
-      if (!Target || !isa<DeclRegion>(Target))
-        return CIP_DisallowedOnce;
-
     break;
   }
   case CE_CXXDestructor: {
     if (!Opts.mayInlineCXXMemberFunction(CIMK_Destructors))
       return CIP_DisallowedAlways;
 
     // Inlining destructors requires building the CFG correctly.
     const AnalysisDeclContext *ADC = CallerSFC->getAnalysisDeclContext();
bool ExprEngine::shouldInlineCall(const CallEvent &Call, const Decl *D,
   if (!D)
     return false;
 
   AnalysisManager &AMgr = getAnalysisManager();
   AnalyzerOptions &Opts = AMgr.options;
   AnalysisDeclContextManager &ADCMgr = AMgr.getAnalysisDeclContextManager();
   AnalysisDeclContext *CalleeADC = ADCMgr.getContext(D);
 
-  // Temporary object destructor processing is currently broken, so we never
-  // inline them.
-  // FIXME: Remove this once temp destructors are working.
   if (isa<CXXDestructorCall>(Call)) {
-    if ((*currBldrCtx->getBlock())[currStmtIdx].getAs<CFGTemporaryDtor>())
-      return false;
+    if (Optional<CFGTemporaryDtor> Dtor =
+            (*currBldrCtx->getBlock())[currStmtIdx].getAs<CFGTemporaryDtor>()) {
+      // We must not inline temporary destructors for temporaries that are
+      // bound to parameters, as we currently don't support correctly
+      // invalidating our knowledge about them when they escape.
+      //if (Dtor->bindsParameter())
+      //  return false;
+    }
   }
 
   // The auto-synthesized bodies are essential to inline as they are
   // usually small and commonly used. Note: we should do this check early on to
   // ensure we always inline these calls.
   if (CalleeADC->isBodyAutosynthesized())
     return true;
 

lib/StaticAnalyzer/Core/RegionStore.cpp

RegionStoreManager::bind(RegionBindingsConstRef B, Loc L, SVal V) {
   // If we get here, the location should be a region.
   const MemRegion *R = L.castAs<loc::MemRegionVal>().getRegion();
 
   // Check if the region is a struct region.
   if (const TypedValueRegion* TR = dyn_cast<TypedValueRegion>(R)) {
     QualType Ty = TR->getValueType();
     if (Ty->isArrayType())
       return bindArray(B, TR, V);
-    if (Ty->isStructureOrClassType())
+    if (Ty->isStructureOrClassType()) {
       return bindStruct(B, TR, V);
+    }
     if (Ty->isVectorType())
       return bindVector(B, TR, V);
     if (Ty->isUnionType())
       return bindAggregate(B, TR, V);
   }
 
   if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R)) {
     // Binding directly to a symbolic region should be treated as binding
RegionBindingsRef RegionStoreManager::bindStruct(RegionBindingsConstRef B,
   const RecordDecl *RD = RT->getDecl();
 
   if (!RD->isCompleteDefinition())
     return B;
 
   // Handle lazy compound values and symbolic values.
   if (Optional<nonloc::LazyCompoundVal> LCV =
         V.getAs<nonloc::LazyCompoundVal>()) {
-    if (Optional<RegionBindingsRef> NewB = tryBindSmallStruct(B, R, RD, *LCV))
+    if (Optional<RegionBindingsRef> NewB = tryBindSmallStruct(B, R, RD, *LCV)) {
       return *NewB;
+    }
     return bindAggregate(B, R, V);
   }
   if (V.getAs<nonloc::SymbolVal>())
     return bindAggregate(B, R, V);
 
   // We may get non-CompoundVal accidentally due to imprecise cast logic or
   // that we are binding symbolic struct value. Kill the field values, and if
   // the value is symbolic go and bind it as a "default" binding.

test/Analysis/auto-obj-dtors-cfg-output.cpp

 // CHECK-NEXT:   3: a
 // CHECK-NEXT:   4: [B1.3] (ImplicitCastExpr, NoOp, const class A)
 // CHECK-NEXT:   5: const A &b = a;
 // CHECK-NEXT:   6: A() (CXXConstructExpr, class A)
 // CHECK-NEXT:   7: [B1.6] (BindTemporary)
 // CHECK-NEXT:   8: [B1.7] (ImplicitCastExpr, NoOp, const class A)
 // CHECK-NEXT:   9: [B1.8]
 // CHECK:       10: const A &c = A();
-// CHECK:       11: [B1.10].~A() (Implicit destructor)
+// CHECK:       11: ~A()
 // CHECK:       12: [B1.2].~A() (Implicit destructor)
 // CHECK-NEXT:   Preds (1): B2
 // CHECK-NEXT:   Succs (1): B0
 // CHECK:      [B0 (EXIT)]
 // CHECK-NEXT:   Preds (1): B1
 void test_const_ref() {
   A a;
   const A& b = a;

test/Analysis/cfg.cpp

 // RUN: %clang_cc1 -analyze -analyzer-checker=debug.DumpCFG -triple x86_64-apple-darwin12 -analyzer-config cfg-temporary-dtors=true -std=c++11 %s > %t 2>&1
 // RUN: FileCheck --input-file=%t %s
 
+#include "Inputs/system-header-simulator-cxx.h"
+
 // CHECK-LABEL: void checkWrap(int i)
 // CHECK: ENTRY
 // CHECK-NEXT: Succs (1): B1
 // CHECK: [B1]
 // CHECK: Succs (21): B2 B3 B4 B5 B6 B7 B8 B9
 // CHECK: B10 B11 B12 B13 B14 B15 B16 B17 B18 B19
 // CHECK: B20 B21 B0
 // CHECK: [B0 (EXIT)]

 // CHECK: [B0 (EXIT)]
 // CHECK-NEXT:  Preds (1): B1
 
 void test_placement_new_array() {
   int buffer[16];
   MyClass* obj = new (buffer) MyClass[5];
 }
 
-
 // CHECK-LABEL: void test_lifetime_extended_temporaries()
 // CHECK: [B1]
-struct LifetimeExtend { LifetimeExtend(int); ~LifetimeExtend(); };
+struct LifetimeExtend { LifetimeExtend(int); ~LifetimeExtend(); int i; };
 struct Aggregate { const LifetimeExtend a; const LifetimeExtend b; };
 struct AggregateRef { const LifetimeExtend &a; const LifetimeExtend &b; };
 void test_lifetime_extended_temporaries() {
   // CHECK: LifetimeExtend(1);
   // CHECK-NEXT: : 1
   // CHECK-NEXT: ~LifetimeExtend()
   // CHECK-NOT: ~LifetimeExtend()
   {
void test_lifetime_extended_temporaries() {
   // CHECK-NEXT: : 4
   // CHECK-NOT: ~LifetimeExtend()
   {
     Aggregate a{LifetimeExtend(4), LifetimeExtend(4)};
     4;
   }
   // CHECK: LifetimeExtend(5)
   // CHECK-NEXT: : 5
-  // FIXME: We want to emit the destructors of the lifetime
-  // extended variables here.
+  // CHECK-NEXT: ~LifetimeExtend()
+  // CHECK-NEXT: ~LifetimeExtend()
   // CHECK-NOT: ~LifetimeExtend()
   {
     AggregateRef a{LifetimeExtend(5), LifetimeExtend(5)};
     5;
   }
-  // FIXME: Add tests for lifetime extension via subobject
-  // references (LifetimeExtend().some_member).
+  // CHECK: LifetimeExtend(6)
+  // CHECK-NEXT: : 6
+  // CHECK-NEXT: ~LifetimeExtend()
+  // CHECK-NOT: ~LifetimeExtend()
+  {
+    const int &i = LifetimeExtend(6).i;
+    6;
+  }
+}
+
+
+// CHECK-LABEL: void test_lifetime_extended_temporaries_for_range()
+void test_lifetime_extended_temporaries_for_range() {
+  // CHECK: [B1]
+  // CHECK-NEXT: ~const LifetimeExtend [1]()
+  // CHECK-NEXT: Preds (1): B2
+  // CHECK: auto &&__range = { LifetimeExtend(7) };
+  // CHECK-NEXT: ~LifetimeExtend() (Temporary object destructor)
+  {
+    for (LifetimeExtend e : {LifetimeExtend(7)}) {
+      1;
+    }
+  }
 }
 
 
 // CHECK-LABEL: int *PR18472()
 // CHECK: [B2 (ENTRY)]
 // CHECK-NEXT:   Succs (1): B1
 // CHECK: [B1]
 // CHECK-NEXT:   1: 0

test/Analysis/temp-obj-dtors-cfg-output.cpp

 // CHECK:     7: [B1.6] (ImplicitCastExpr, FunctionToPointerDecay, void (*)(const class A &))
 // CHECK:     8: A() (CXXConstructExpr, class A)
 // CHECK:     9: [B1.8] (BindTemporary)
 // CHECK:    10: [B1.9] (ImplicitCastExpr, NoOp, const class A)
 // CHECK:    11: [B1.10]
 // CHECK:    12: [B1.7]([B1.11])
 // CHECK:    13: ~A() (Temporary object destructor)
 // CHECK:    14: int b;
-// CHECK:    15: [B1.5].~A() (Implicit destructor)
+// CHECK:    15: ~A() (Temporary object destructor)
 // CHECK:     Preds (1): B2
 // CHECK:     Succs (1): B0
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (1): B1
 // CHECK:   [B2 (ENTRY)]
 // CHECK:     Succs (1): B1
 // CHECK:   [B1]
 // CHECK:     1: A::make

 // CHECK:    11: [B1.10] (ImplicitCastExpr, FunctionToPointerDecay, class A (*)(void))
 // CHECK:    12: [B1.11]()
 // CHECK:    13: [B1.12] (BindTemporary)
 // CHECK:    14: [B1.13] (ImplicitCastExpr, NoOp, const class A)
 // CHECK:    15: [B1.14]
 // CHECK:    16: [B1.9]([B1.15])
 // CHECK:    17: ~A() (Temporary object destructor)
 // CHECK:    18: int b;
-// CHECK:    19: [B1.7].~A() (Implicit destructor)
+// CHECK:    19: ~A() (Temporary object destructor)
 // CHECK:     Preds (1): B2
 // CHECK:     Succs (1): B0
 // CHECK:   [B0 (EXIT)]
 // CHECK:     Preds (1): B1
 // CHECK:   [B2 (ENTRY)]
 // CHECK:     Succs (1): B1
 // CHECK:   [B1]
 // CHECK:     1: int a;

test/Analysis/temporaries.cpp

namespace compound_literals {
   };
 
   void test() {
     clang_analyzer_eval(((POD){1, 42}).y == 42); // expected-warning{{TRUE}}
     clang_analyzer_eval(((HasDtor){1, 42}).y == 42); // expected-warning{{TRUE}}
 
 #if __cplusplus >= 201103L
     clang_analyzer_eval(((HasCtor){1, 42}).y == 42); // expected-warning{{TRUE}}
 
-    // FIXME: should be TRUE, but we don't inline the constructors of
-    // temporaries because we can't model their destructors yet.
-    clang_analyzer_eval(((HasCtorDtor){1, 42}).y == 42); // expected-warning{{UNKNOWN}}
+    clang_analyzer_eval(((HasCtorDtor){1, 42}).y == 42); // expected-warning{{TRUE}}
 #endif
   }
 }
 
 namespace destructors {
   struct Dtor {
     ~Dtor();
   };
#ifdef TEMPORARY_DTORS
   void testBinaryOperatorShortcut(bool value) {
     if (value) {
       if (false && false && check(NoReturnDtor()) && true) {
         clang_analyzer_eval(true);
       }
     }
   }
 
+  struct NoWarnDerefDtor {
+    NoWarnDerefDtor(int *p) : p(p) {}
+    ~NoWarnDerefDtor() { *p = 23; } // no warning
+    int *p;
+  };
+  void testDtorInlining() {
+    int x;
+    (NoWarnDerefDtor(&x));
+    clang_analyzer_eval(x == 23); // expected-warning{{TRUE}}
+  }
+  void use(NoWarnDerefDtor);
+  void testArgumentDtorInliningPreventedByValue() {
+    int x;
+    NoWarnDerefDtor p(nullptr);
+    use(p);
+    p.p = &x;
+  }
+
+  struct WarnDerefDtor {
+    WarnDerefDtor(int *p) : p(p) {}
+    ~WarnDerefDtor() {
+      *p = 23; // expected-warning{{Dereference of null pointer}}
+    }
+    int *p;
+  };
+  void useRef(WarnDerefDtor& p) {
+    p.p = nullptr;
+  }
+  void testArgumentDtorInliningWorksByReference() {
+    int x;
+    WarnDerefDtor p(&x);
+    useRef(p);
+  }
+  void useConstRef(const NoWarnDerefDtor& p) {
+    const_cast<NoWarnDerefDtor&>(p).p = nullptr;
+  }
+  void testArgumentDtorInliningWorksByConstReference() {
+    int x;
+    // FIXME: This should warn. We need to implement correct handling of
+    // temporaries bound to parameters first.
+    useConstRef(NoWarnDerefDtor(&x));
+  }
+
   void testIfAtEndOfLoop() {
     int y = 0;
     while (true) {
       if (y > 0) {
         clang_analyzer_warnIfReached();  // expected-warning{{REACHABLE}}
       }
       ++y;
       // Test that the CFG gets hooked up correctly when temporary destructors