core.StackAddressEscape checker produce invalid detection
Nobody has claimed this yet.
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
The core.StackAddressEscape produce invalid disgnostics (false positive) in the following case:
```
#include
class LocalClass;
class VEI {
public:
VEI():pLocal(nullptr) {}
LocalClass *pLocal;
};
class LocalClass {
public:
LocalClass(VEI *v):p(v) {}
VEI *p;
~LocalClass() { p->pLocal = nullptr; }
void updateVei() {
if(p->pLocal != this) {
p->pLocal = this;
}
}
};
intptr_t funct(VEI *vei) {
LocalClass ohRly(vei);
ohRly.updateVei();
return (intptr_t)vei;
}
int main(void) {
VEI vei;
intptr_t res = funct(&vei);
return res > 0x7FFF;
}
```
The problem is the program context is analyzed at the time of return (line 32) but actual removal of local variable reference happens in the destructor and then context is actually destroyed.
The godbolt reference demonstrating the same is available though this [link](https://godbolt.org/#z:OYLghAFBqd5QCxAYwPYBMCmBRdBLAF1QCcAaPECAMzwBtMA7AQwFtMQByARg9KtQYEAysib0QXACx8BBAKoBnTAAUAHpwAMvAFYTStJg1DIApACYAQuYukl9ZATwDKjdAGFUtAK4sGIAJykrgAyeAyYAHI%2BAEaYxCAAzGakAA6oCoRODB7evgGp6ZkCoeFRLLHxSbaY9o4CQgRMxAQ5Pn6BdpgOWQ1NBCWRMXGJyQqNza15HeP9YYPlw0kAlLaoXsTI7BwA9NsAtAeHR8cnp2fnF5dX1ze3dwcmGgCCuwDUT%2BjoxJgKCq%2BoVFeYyYyAA1q82CwSABPV5MX6oZB4JgETDoV4Ad0ICFetERYleADcmsjovRXmAOKgEAAlWjQymvb4EdbhdFEV6iWj0YivEwAVgsaG%2BADpemCPl8fgpsApRClMAKACKPF7bV4AFQQeD%2BWO5r1icNe6EMwFoYWATMwVDijE2fMFwswYsaEs%2B31%2Bsvliv5Kueu1VbwOhjE0IAXphXnsABoh%2BkR3l7OPhuJ7ZAILqguImBJKp2B/b3IvFkulssl1WVswJMLIbxYPkJNxjfCCEUIHPYSvPOvwv7BfG0NwGX45qw9kd/ABq2AAknyAOzjp4pLxkvDIECq16vGeziBLEApAdciAMLzclIEYhLRdWBdKnfb14nsTDvuvABUx8HY8rD7/Z5VV7X4X0Hd9QJMJdVVXddN2fHdXyHScID3L9CUPFIIAwu8oL9J4dx3NDv0AgjCIAPyQiCFAPO9XhSPZOx/LlG0fc9L2vMdF3wwiiVQPB0S8FITVRKdMDwWioOXXjeLwKgIAYpikIpMAc0fAhtQUW8pIQmSd0UhJsGYgk1NeDSdVIvSnwA55eLw/8VQSZdVTCAgr2IAB9AhXioLwGAcVC53Q8TtOg2ywK5aj/lpelsJCyzorpaERSEkTMDEiSlgS5lWVeCBXPcrylkJcTSPsoDnlciEmDCbD%2BPQULpMItCSrwBKdwK68vKtP5TN8/yCAgcwADZWqypzdJy4gGB6xtsFeDRVAXAAxVaypsp4OBWWhOH5Xg/A4LRSFQTg3GsawgTWDZI3MBIeFIAhNC2lZQRAflJBFfx%2BS4fxJAADg0MwpD%2B6t%2BX0ThJH2p7js4XgFBADQHqelY4FgJA1jcrwCHISg0BYFI6DiCJWC2VQ/uGvZhskTkDCMV4EhFamID7OI6gYLTeDRQgSAEvR%2BEEEQxHYKQZEERQVHUQ6dD0DFiCYFJOB4bbdqhqWYY4AB5LHV28gFXjJimqZp008uvPzQVvCAPHxwneVurgll4R6pZRpA8YJnkcYgd3bZQWngC84hzb4OhUWIeGIGiRXeGiMImmhaPSFj5hiGhDXom0LpnfuvG2EEDWGHpROsGiLxgDcMRaHh7heCwFhTXEGvSHwb5uhK6v7swVQuixrYjtcmpofNaI5dTjwsET688BYROSuIaJ0kwJVMHroxzSMZG%2BAMYAFCnPBMAxDWFQO%2B7%2BeELlhekM/xbUaHdC4fRTRQc7LH0PBonhyAVlQK8smr4NmDxkjDGZMCYoygNTOmTM2ZcxOijAAdQYKgPYfkvBKHQGmVALBV4YPXpgJMxBgA%2BEYAQXgqA57EAEj8eAKxOjdGcBAVwkw/APxCHMMoFQ9BpAyGzZhXDChswGBw4YD86Fs16BMTwbQ9BiJ6DMIRQx4iiJmHw5RfQFELCUbQq6mwJDKw4HtUgB0jonQ4PrcmlNqa9jphAM2DALZ5VwNzO21YHZO2RisDMTAsDxAPKQV6kh%2BQig0P9DQ31/ALj%2Bt9BcVNwYcEhqQGeXANCI2MWQ2GtgEZIxdvoswqsTEZOdloJYKw54ZGcJIIAA).
**Observed behavior**:
The error `32:3: warning: Address of stack memory associated with local variable 'ohRly' returned to caller [core.StackAddressEscape]` is reported.
**Expected behavior**:
No diagnostics reported as no actual stack escape happens here as `vei.pLocal` is actually equals to `nullptr` in line 38 if the provided example.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the provided C++ example with the core.StackAddressEscape checker and inspect why the diagnostic is produced at the return statement. Compare the reported warning with the destructor's clearing of vei.pLocal; done means the example no longer produces the false-positive diagnostic.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100