llvm / llvm/llvm-project

Add support for Pointer-Field sensitivity

Open
#184,344 8 comments 0 reactions 1 assignee Claimed by @aeft View on GitHub
clang:temporal-safety
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

The current analysis needs improved handling of pointers and references within structs and classes (pointer-field sensitivity).

Northstar example:
```cpp
struct S { // Fields as pointers.
std::string_view v1, v2;
};

S foo() {
std::string local = "local string";
S s1;
S* p1;
p1 = &s1;
p1->v1 = local; // error: stack addr returned later.
s.v2 = local; // error: stack addr returned later.
return s; // note x2: returned here.
}
```

## Phases

* **Phase 1: Model Lambda Captures**: Start by modeling lambda captures as pointer-fields. Since captured variables in a lambda cannot be reassigned, this provides a constrained initial scope. This will handle cases where lambdas outlive the captured variables.
* **Phase 2: Struct Pointer-Field Sensitivity**: Implement basic pointer-field sensitivity for struct members. This involves tracking the lifetime of objects pointed to by struct fields.
* **Phase 3: Advanced Pointer-Field Sensitivity**: Extend the analysis to handle reassignment of pointer fields and pointer indirections within structs.

**Phase 1: Lambda capture**
1. Reference types as fields.
```cpp
auto getCallback() {
std::string local = "local string";
auto lambda = [&]() {
std::cout << local;
};
return lambda;
}

// Equivalent to
class lambda_class {
std::string& local;
operator() {}
};
auto getCallback() {
std::string local = "local string";
lambda_class lambda(local);
return lambda;
}
```
2. View/Pointer types as fields
```cpp
auto getCallback() {
std::string local = "local string";
std::string_view view = local;
auto lambda = [=]() {
std::cout << view;
};
return lambda;
}

// Equivalent to
class lambda_class {
std::string_view view;
operator() {}
};
auto getCallback() {
std::string local = "local string";
std::string_view view = local;
lambda_class lambda(view);
return lambda;
}
```

**Phase 2: Struct Pointer-Field Sensitivity**
Ignore reassignments:
```cpp
struct S { // Fields as pointers.
std::string_view v1, v2;
};

S foo() {
std::string local = "local string";
S s;
s.v1 = local;
s.v2 = local;
return s; // return stack address.
}
```

**Phase 3: Advanced Pointer-Field tracking**
```cpp
struct S { // Fields as pointers.
std::string_view v1, v2;
};

S foo() {
std::string local = "local string";
S a, b;
a.v1 = local;
b.v2 = local;
a.v2 = b.v1 = local;
return s; // return stack address.
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.