[analyzer] Test case for lambda capture by value modelling

[gamesh411]

Summary

This test provides test coverage for the following feature:
Variables which are captured by value into a lambda require a call to a
copy constructor.

[gamesh411]

• Add capture by reference test
• Add another class to ensure reachability inside function call is independent of each other in the first 2 test cases

[Szelethus]

LGTM, can we remove the open projects entry under the same breath?

[gamesh411]

• Remove link reference from commit message
• Remove superfluous semicolons left in the code

[NoQ]

I recommend starting with CFG tests for this feature. I.e., do -analyzer-checker debug.DumpCFG and make sure that every CFGStmt that corresponds to a constructor is a CFGConstructor (i.e., has a ConstructionContext explained in the dump). Cf. test/Analysis/cfg-rich-constructors.cpp.

clang/test/Analysis/clangsa_unsupported_features/handle_constructors_for_lambda_captures.cpp

12

This test doesn't test whether the function is inlined. If the function is not inlined, the code will still be reachable when analyzed as top frame. See also clang_analyzer_checkInlined().

30

That's the reason why your tests seem to work. If you change it to ~incr_on_copy_for_simple_usage() {}, we will no longer evaluate the capture correctly.

The difference here is that we allow ourselves inline the constructor without a construction context when the destructor is trivial. But when the destructor is non-trivial, our inability to keep track of the object under construction until destruction will have terrible consequences.

[NoQ]

clang/test/Analysis/clangsa_unsupported_features/handle_constructors_for_lambda_captures.cpp

30

*allow ourselves to inline

clang/test/Analysis/clangsa_unsupported_features/handle_constructors_for_lambda_captures.cpp

+// RUN: %clang_cc1 -fsyntax-only -analyze \
+// RUN:   -analyzer-checker=core,debug.ExprInspection %s -verify
+
+// Handle constructors for lambda captures
+// Variables which are captured by value into a lambda require a call to a copy
+// constructor.
+void clang_analyzer_eval(bool);
+void clang_analyzer_warnIfReached();
+
+void reached_function() {
+  clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
+};
+
+struct incr_on_copy {
+  int &i;
+  incr_on_copy(int &i) : i(i) {}
+  incr_on_copy(const incr_on_copy &o) : i(++o.i) { reached_function(); }
+  incr_on_copy &operator=(const incr_on_copy &o) = delete;
+  incr_on_copy &operator=(incr_on_copy &&o) = delete;
+  ~incr_on_copy() = default;
+};
+
+void test_simple_copy() {
+  int a = 0;
+
+  incr_on_copy ioc1(a);
+
+  clang_analyzer_eval(ioc1.i == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(a == 0);      // expected-warning{{TRUE}}
+
+  // Explicit copy constructor call.
+  incr_on_copy ioc2(ioc1);
+
+  clang_analyzer_eval(ioc2.i == 1); // expected-warning{{TRUE}}
+  clang_analyzer_eval(a == 1);      // expected-warning{{TRUE}}
+}
+
+void test_lambda_capture() {
+  int a = 0;
+
+  incr_on_copy ioc(a);
+
+  clang_analyzer_eval(ioc.i == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(a == 0);     // expected-warning{{TRUE}}
+
+  // Implicitly call copy constructor in case of capture-by-value.
+  [ioc]() {
+    clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
+  }();
+
+  clang_analyzer_eval(ioc.i == 1); // expected-warning{{TRUE}}
+  clang_analyzer_eval(a == 1);     // expected-warning{{TRUE}}
+}