[analyzer] Invalidate static locals when escaping lambdas

[george.karpenkov]

Summary

Lambdas can affect static locals even without an explicit capture.

rdar://39537031

[NoQ]

I think we should also add the test with the original problem: where the lambda is being called directly but isn't inlined due to call stack depth limit. We could artificially set the limit in the RUN: line to an explicit small value to emulate the desired behavior.

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

 // structures are largely ignored. Basically we do 1-limiting analysis.
 // Parameter pointers are assumed with no aliasing. Pointee objects of
 // parameters are created lazily.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/AST/Attr.h"
 #include "clang/AST/CharUnits.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/Analysis/Analyses/LiveVariables.h"
 #include "clang/Analysis/AnalysisDeclContext.h"
 #include "clang/Basic/TargetInfo.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
if (C) {
     for (ClusterBindings::iterator I = C->begin(), E = C->end(); I != E; ++I)
       VisitBinding(I.getData());
 
     // Invalidate regions contents.
     if (!PreserveRegionsContents)
       B = B.remove(baseR);
   }
 
+  if (const auto *TO = dyn_cast<TypedValueRegion>(baseR)) {
+    if (const auto *RD = TO->getValueType()->getAsCXXRecordDecl()) {
+
+      // Lambdas can affect all static local variables without explicitly
+      // capturing those.
+      // We invalidate all static locals referenced inside the lambda body.
+      if (RD->isLambda() && RD->getLambdaCallOperator()->getBody()) {
+        using namespace ast_matchers;
+
+        const char *DeclBind = "DeclBind";
+        StatementMatcher RefToStatic = stmt(hasDescendant(declRefExpr(
+              to(varDecl(hasStaticStorageDuration()).bind(DeclBind)))));
+        auto Matches =
+            match(RefToStatic, *RD->getLambdaCallOperator()->getBody(),
+                  RD->getASTContext());
+
+        for (BoundNodes &Match : Matches) {
+          auto *VD = Match.getNodeAs<VarDecl>(DeclBind);
+          const VarRegion *ToInvalidate =
+              RM.getRegionManager().getVarRegion(VD, LCtx);
+          AddToWorkList(ToInvalidate);
+        }
+      }
+    }
+  }
+
   // BlockDataRegion?  If so, invalidate captured variables that are passed
   // by reference.
   if (const BlockDataRegion *BR = dyn_cast<BlockDataRegion>(baseR)) {
     for (BlockDataRegion::referenced_vars_iterator
          BI = BR->referenced_vars_begin(), BE = BR->referenced_vars_end() ;
          BI != BE; ++BI) {
       const VarRegion *VR = BI.getCapturedRegion();
       const VarDecl *VD = VR->getDecl();

clang/test/Analysis/lambdas.cpp

auto lambda = []{
     // Don't treat localConstant as containing a garbage value
     float copy = localConstant; // no-warning
     (void)copy;
   };
 
   lambda();
 }
 
+void escape(void*);
+
+int& invalidate_static_on_unknown_lambda() {
+  static int* z;
+  auto lambda = [] {
+    static float zz;
+    z = new int(120);
+  };
+  escape(&lambda);
+  return *z; // no-warning
+}
+
 
 static int b = 0;
 
 int f() {
   b = 0;
   auto &bm = b;
   [&] {
     bm++;