================
@@ -3648,35 +3648,38 @@ PathDiagnosticPieceRef
MallocBugVisitor::VisitNode(const ExplodedNode *N,
return nullptr;
}
- // See if we're releasing memory while inlining a destructor
- // (or one of its callees). This turns on various common
- // false positive suppressions.
- bool FoundAnyDestructor = false;
- for (const LocationContext *LC = CurrentLC; LC; LC = LC->getParent()) {
- if (const auto *DD = dyn_cast<CXXDestructorDecl>(LC->getDecl())) {
- if (isReferenceCountingPointerDestructor(DD)) {
- // This immediately looks like a reference-counting destructor.
- // We're bad at guessing the original reference count of the
object,
- // so suppress the report for now.
- BR.markInvalid(getTag(), DD);
- } else if (!FoundAnyDestructor) {
- assert(!ReleaseDestructorLC &&
+ // See if we're releasing memory while inlining a destructor or
+ // functions that decrement reference counters (or one of its callees).
+ // This turns on various common false positive suppressions.
+ bool FoundAnyReleaseFunction = false;
+ for (const LocationContext *LC = CurrentLC; LC; LC = LC->getParent()) {
+ if (const auto *DD = dyn_cast<CXXDestructorDecl>(LC->getDecl())) {
+ if (isReferenceCountingPointerDestructor(DD)) {
+ // This immediately looks like a reference-counting destructor.
+ // We're bad at guessing the original reference count of the
+ // object, so suppress the report for now.
+ BR.markInvalid(getTag(), DD);
+ continue;
+ }
+ }
+
+ if (!FoundAnyReleaseFunction) {
----------------
pskrgag wrote:
Trying to reproduce the behavior you mention, but I cannot. So I wrote
following test:
```cpp
// Also IntrusivePtr but release is happening out-of-line in desctructor
template <typename T>
class IntrusivePtrOutlineRelease {
T *Ptr;
public:
IntrusivePtrOutlineRelease(T *Ptr) : Ptr(Ptr) {
Ptr->incRef();
}
IntrusivePtrOutlineRelease(const IntrusivePtrOutlineRelease &Other) :
Ptr(Other.Ptr) {
Ptr->incRef();
}
void releasePtr(void) {
delete Ptr;
}
~IntrusivePtrOutlineRelease() {
// We should not take the path on which the object is deleted.
if (Ptr->decRef() == 1)
releasePtr();
}
T *getPtr() const { return Ptr; } // no-warning
};
void testDestroyLocalRefPtrWithOutlineRelease() {
IntrusivePtrOutlineRelease<RawObj> p1(new RawObj());
{
IntrusivePtrOutlineRelease<RawObj> p2(p1);
}
// p1 still maintains ownership. The object is not deleted.
p1.getPtr()->foo(); // no-warning
}
```
And there is no warning. Did I get it wrong?
https://github.com/llvm/llvm-project/pull/104599
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
