Checker.cpp

Go to the documentation of this file.

//===- Checker.cpp - C++ Lifetime Safety Checker ----------------*- C++ -*-===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
//
// This file implements the LifetimeChecker, which detects use-after-free
// errors by checking if live origins hold loans that have expired.
//
//===----------------------------------------------------------------------===//
 
#include "clang/Analysis/Analyses/LifetimeSafety/Checker.h"
#include "clang/AST/Decl.h"
#include "clang/AST/Expr.h"
#include "clang/Analysis/Analyses/LifetimeSafety/Facts.h"
#include "clang/Analysis/Analyses/LifetimeSafety/LifetimeAnnotations.h"
#include "clang/Analysis/Analyses/LifetimeSafety/LiveOrigins.h"
#include "clang/Analysis/Analyses/LifetimeSafety/LoanPropagation.h"
#include "clang/Analysis/Analyses/LifetimeSafety/Loans.h"
#include "clang/Analysis/Analyses/PostOrderCFGView.h"
#include "clang/Analysis/AnalysisDeclContext.h"
#include "clang/Basic/SourceLocation.h"
#include "clang/Basic/SourceManager.h"
#include "llvm/ADT/DenseMap.h"
#include "llvm/Support/ErrorHandling.h"
#include "llvm/Support/TimeProfiler.h"
 
namespace clang::lifetimes::internal {
 
static bool causingFactDominatesExpiry(LivenessKind K) {
  switch (K) {
  case LivenessKind::Must:
    return true;
  case LivenessKind::Maybe:
  case LivenessKind::Dead:
    return false;
  }
  llvm_unreachable("unknown liveness kind");
}
 
namespace {
 
/// Struct to store the complete context for a potential lifetime violation.
struct PendingWarning {
  SourceLocation ExpiryLoc; // Where the loan expired.
  llvm::PointerUnion<const UseFact *, const OriginEscapesFact *> CausingFact;
  const Expr *MovedExpr;
  const Expr *InvalidatedByExpr;
  bool CausingFactDominatesExpiry;
};
 
using AnnotationTarget =
    llvm::PointerUnion<const ParmVarDecl *, const CXXMethodDecl *>;
using EscapingTarget = LifetimeSafetySemaHelper::EscapingTarget;
 
class LifetimeChecker {
private:
  llvm::DenseMap<LoanID, PendingWarning> FinalWarningsMap;
  llvm::DenseMap<AnnotationTarget, EscapingTarget> AnnotationWarningsMap;
  llvm::DenseMap<const ParmVarDecl *, EscapingTarget> NoescapeWarningsMap;
  llvm::DenseMap<const FieldDecl *, const Expr *> FieldOriginEscapesMap;
  llvm::DenseSet<const Decl *> VerifiedLiftimeboundEscapes;
  const LoanPropagationAnalysis &LoanPropagation;
  const MovedLoansAnalysis &MovedLoans;
  const LiveOriginsAnalysis &LiveOrigins;
  FactManager &FactMgr;
  LifetimeSafetySemaHelper *SemaHelper;
  ASTContext &AST;
  const CFG *Cfg;
  const Decl *FD;
  const LifetimeSafetyOpts &LSOpts;
 
  static SourceLocation
  GetFactLoc(llvm::PointerUnion<const UseFact *, const OriginEscapesFact *> F) {
    if (const auto *UF = dyn_cast<const UseFact *>(F))
      return UF->getUseExpr()->getExprLoc();
    if (const auto *OEF = dyn_cast<const OriginEscapesFact *>(F)) {
      if (auto *ReturnEsc = dyn_cast<ReturnEscapeFact>(OEF))
        return ReturnEsc->getReturnExpr()->getExprLoc();
      if (auto *FieldEsc = dyn_cast<FieldEscapeFact>(OEF))
        return FieldEsc->getFieldDecl()->getLocation();
    }
    llvm_unreachable("unhandled causing fact in PointerUnion");
  }
 
public:
  LifetimeChecker(const LoanPropagationAnalysis &LoanPropagation,
                  const MovedLoansAnalysis &MovedLoans,
                  const LiveOriginsAnalysis &LiveOrigins, FactManager &FM,
                  AnalysisDeclContext &ADC,
                  LifetimeSafetySemaHelper *SemaHelper,
                  const LifetimeSafetyOpts &LSOpts)
      : LoanPropagation(LoanPropagation), MovedLoans(MovedLoans),
        LiveOrigins(LiveOrigins), FactMgr(FM), SemaHelper(SemaHelper),
        AST(ADC.getASTContext()), Cfg(ADC.getCFG()), FD(ADC.getDecl()),
        LSOpts(LSOpts) {
    for (const CFGBlock *B : *ADC.getAnalysis<PostOrderCFGView>())
      for (const Fact *F : FactMgr.getFacts(B))
        if (const auto *EF = F->getAs<ExpireFact>())
          checkExpiry(EF);
        else if (const auto *IOF = F->getAs<InvalidateOriginFact>())
          checkInvalidation(IOF);
        else if (const auto *OEF = F->getAs<OriginEscapesFact>())
          checkAnnotations(OEF);
    issuePendingWarnings();
    suggestAnnotations();
    if (LSOpts.CheckFieldOriginEscape)
      reportFieldOriginEscapes();
    if (LSOpts.CheckNoescapeViolations)
      reportNoescapeViolations();
    if (LSOpts.CheckLifetimeboundViolations)
      reportLifetimeboundViolations();
    if (LSOpts.CheckMisplacedLifetimebound)
      reportMisplacedLifetimebound();
    if (LSOpts.CheckInapplicableLifetimebound)
      reportInapplicableLifetimebound();
    //  Annotation inference is currently guarded by a frontend flag. In the
    //  future, this might be replaced by a design that differentiates between
    //  explicit and inferred findings with separate warning groups.
    if (AST.getLangOpts().EnableLifetimeSafetyInference)
      inferAnnotations();
  }
 
  /// Checks if an escaping origin holds a placeholder loan, indicating a
  /// missing [[clang::lifetimebound]] annotation or a violation of
  /// [[clang::noescape]].
  void checkAnnotations(const OriginEscapesFact *OEF) {
    OriginID EscapedOID = OEF->getEscapedOriginID();
    LoanSet EscapedLoans = LoanPropagation.getLoans(EscapedOID, OEF);
    auto CheckParam = [&](const ParmVarDecl *PVD, bool IsMoved) {
      // NoEscape param should not escape.
      if (PVD->hasAttr<NoEscapeAttr>()) {
        if (auto *ReturnEsc = dyn_cast<ReturnEscapeFact>(OEF))
          NoescapeWarningsMap.try_emplace(PVD, ReturnEsc->getReturnExpr());
        if (auto *FieldEsc = dyn_cast<FieldEscapeFact>(OEF))
          NoescapeWarningsMap.try_emplace(PVD, FieldEsc->getFieldDecl());
        if (auto *GlobalEsc = dyn_cast<GlobalEscapeFact>(OEF))
          NoescapeWarningsMap.try_emplace(PVD, GlobalEsc->getGlobal());
        return;
      }
      // Skip annotation suggestion for moved loans, as ownership transfer
      // obscures the lifetime relationship (e.g., shared_ptr from unique_ptr).
      if (IsMoved)
        return;
      if (PVD->hasAttr<LifetimeBoundAttr>()) {
        // Track that this lifetimebound parameter correctly escapes
        // (via return or via field assignment in a constructor).
        if (isa<ReturnEscapeFact>(OEF) ||
            (isa<FieldEscapeFact>(OEF) && isa<CXXConstructorDecl>(FD)))
          VerifiedLiftimeboundEscapes.insert(PVD);
      } else {
        // Otherwise, suggest lifetimebound for parameter escaping through
        // return or a field in constructor.
        if (auto *ReturnEsc = dyn_cast<ReturnEscapeFact>(OEF))
          AnnotationWarningsMap.try_emplace(PVD, ReturnEsc->getReturnExpr());
        else if (auto *FieldEsc = dyn_cast<FieldEscapeFact>(OEF);
                 FieldEsc && isa<CXXConstructorDecl>(FD)) {
          // Disable inference for pointers being captured by an owner type,
          // as owners typically consume these pointers rather than borrow them.
          if (!isOwnerPtrCtor(dyn_cast<CXXConstructorDecl>(FD), PVD))
            AnnotationWarningsMap.try_emplace(PVD, FieldEsc->getFieldDecl());
        }
      }
      // TODO: Suggest lifetime_capture_by(this) for parameter escaping to a
      // field!
    };
    auto CheckImplicitThis = [&](const CXXMethodDecl *MD) {
      if (auto *ReturnEsc = dyn_cast<ReturnEscapeFact>(OEF)) {
        if (implicitObjectParamIsLifetimeBound(MD))
          VerifiedLiftimeboundEscapes.insert(MD);
        else
          AnnotationWarningsMap.try_emplace(MD, ReturnEsc->getReturnExpr());
      }
    };
    // Identifies methods whose return value derives from a field's origin
    // rather than *this, e.g., Span::data() or Vector::data().
    auto CheckField = [&](const FieldDecl *Field) {
      if (!LSOpts.CheckFieldOriginEscape)
        return;
      // Lifetimebound marks the field as owned by *this (e.g., Vector::data()).
      const auto *MD = dyn_cast<CXXMethodDecl>(FD);
      if (MD && implicitObjectParamIsLifetimeBound(MD))
        return;
      if (auto *ReturnEsc = dyn_cast<ReturnEscapeFact>(OEF)) {
        // Ignore field loans in inner origins, e.g., returning a reference to
        // a view field borrows *this.
        if (OriginList *RetList = FactMgr.getOriginMgr().getOrCreateList(
                ReturnEsc->getReturnExpr());
            RetList && RetList->getOuterOriginID() == EscapedOID)
          FieldOriginEscapesMap.try_emplace(Field, ReturnEsc->getReturnExpr());
      }
    };
    auto MovedAtEscape = MovedLoans.getMovedLoans(OEF);
    for (LoanID LID : EscapedLoans) {
      const Loan *L = FactMgr.getLoanMgr().getLoan(LID);
      const PlaceholderBase *PB = L->getAccessPath().getAsPlaceholderBase();
      if (!PB)
        continue;
      if (const auto *PVD = PB->getParmVarDecl())
        CheckParam(PVD, /*IsMoved=*/MovedAtEscape.lookup(LID));
      else if (const auto *MD = PB->getImplicitThisParent())
        CheckImplicitThis(MD);
      else if (const auto *Field = PB->getFieldDecl())
        CheckField(Field);
    }
  }
 
  /// Checks for use-after-free & use-after-return errors when an access path
  /// expires (e.g., a variable goes out of scope).
  ///
  /// When a path expires, all loans prefixed by that path expire. For example,
  /// if `x` expires, loans to `x`, `x.field`, and `x.field.*` all expire.
  /// This method examines all live origins and reports warnings for loans they
  /// hold that are prefixed by the expired path.
  void checkExpiry(const ExpireFact *EF) {
    const AccessPath &ExpiredPath = EF->getAccessPath();
    LiveOriginSet Origins = LiveOrigins.getLiveOriginsAt(EF);
    for (const LivenessMap &Live : {Origins.Persistent, Origins.BlockLocal})
      for (auto &[OID, LiveInfo] : Live) {
        LoanSet HeldLoans = LoanPropagation.getLoans(OID, EF);
        for (LoanID HeldLoanID : HeldLoans) {
          const Loan *HeldLoan = FactMgr.getLoanMgr().getLoan(HeldLoanID);
          if (!ExpiredPath.isPrefixOf(HeldLoan->getAccessPath()))
            continue;
          // HeldLoan is expired because its base or itself is expired.
          PendingWarning &CurWarning = FinalWarningsMap[HeldLoan->getID()];
          const Expr *MovedExpr = nullptr;
          if (auto *ME = MovedLoans.getMovedLoans(EF).lookup(HeldLoanID))
            MovedExpr = *ME;
          // Skip if we already have a dominating causing fact.
          if (CurWarning.CausingFactDominatesExpiry)
            continue;
          if (causingFactDominatesExpiry(LiveInfo.Kind))
            CurWarning.CausingFactDominatesExpiry = true;
          CurWarning.CausingFact = LiveInfo.CausingFact;
          CurWarning.ExpiryLoc = EF->getExpiryLoc();
          CurWarning.MovedExpr = MovedExpr;
          CurWarning.InvalidatedByExpr = nullptr;
        }
      }
  }
 
  /// Checks for use-after-invalidation errors when a container is modified.
  ///
  /// When a container is invalidated, loans pointing into its interior are
  /// invalidated. For example, if container `v` is invalidated, iterators with
  /// loans to `v.*` are invalidated. This method finds live origins holding
  /// such loans and reports warnings. A loan is invalidated if its path extends
  /// an invalidated container's path (e.g., `v.*` extends `v`).
  void checkInvalidation(const InvalidateOriginFact *IOF) {
    OriginID InvalidatedOrigin = IOF->getInvalidatedOrigin();
    /// Get loans directly pointing to the invalidated container
    LoanSet DirectlyInvalidatedLoans =
        LoanPropagation.getLoans(InvalidatedOrigin, IOF);
    auto IsInvalidated = [&](const Loan *L) {
      for (LoanID InvalidID : DirectlyInvalidatedLoans) {
        const Loan *InvalidL = FactMgr.getLoanMgr().getLoan(InvalidID);
        if (InvalidL->getAccessPath().isPrefixOf(L->getAccessPath()))
          return true;
      }
      return false;
    };
    // For each live origin, check if it holds an invalidated loan and report.
    LiveOriginSet Origins = LiveOrigins.getLiveOriginsAt(IOF);
    for (const LivenessMap &Live : {Origins.Persistent, Origins.BlockLocal})
      for (auto &[OID, LiveInfo] : Live) {
        LoanSet HeldLoans = LoanPropagation.getLoans(OID, IOF);
        for (LoanID LiveLoanID : HeldLoans)
          if (IsInvalidated(FactMgr.getLoanMgr().getLoan(LiveLoanID))) {
            bool CurDomination = causingFactDominatesExpiry(LiveInfo.Kind);
            bool LastDomination =
                FinalWarningsMap.lookup(LiveLoanID).CausingFactDominatesExpiry;
            if (!LastDomination) {
              FinalWarningsMap[LiveLoanID] = {
                  /*ExpiryLoc=*/{},
                  /*CausingFact=*/LiveInfo.CausingFact,
                  /*MovedExpr=*/nullptr,
                  /*InvalidatedByExpr=*/IOF->getInvalidationExpr(),
                  /*CausingFactDominatesExpiry=*/CurDomination};
            }
          }
      }
  }
 
  void issuePendingWarnings() {
    llvm::TimeTraceScope TimeTrace("IssuePendingWarnings");
    if (!SemaHelper)
      return;
    for (const auto &[LID, Warning] : FinalWarningsMap) {
      const Loan *L = FactMgr.getLoanMgr().getLoan(LID);
      const Expr *IssueExpr = L->getIssueExpr();
      const ParmVarDecl *InvalidatedPVD = nullptr;
      if (const PlaceholderBase *PB = L->getAccessPath().getAsPlaceholderBase())
        InvalidatedPVD = PB->getParmVarDecl();
 
      llvm::PointerUnion<const UseFact *, const OriginEscapesFact *>
          CausingFact = Warning.CausingFact;
      const Expr *MovedExpr = Warning.MovedExpr;
      SourceLocation ExpiryLoc = Warning.ExpiryLoc;
 
      if (const auto *UF = dyn_cast<const UseFact *>(CausingFact)) {
        llvm::SmallVector<const Expr *> ExprChain =
            getExprChain(LoanPropagation.buildOriginFlowChain(UF, LID, Cfg));
        if (Warning.InvalidatedByExpr) {
          if (IssueExpr)
            // Use-after-invalidation of an object on stack.
            SemaHelper->reportUseAfterInvalidation(IssueExpr, UF->getUseExpr(),
                                                   Warning.InvalidatedByExpr,
                                                   ExprChain);
          else if (InvalidatedPVD)
            // Use-after-invalidation of a parameter.
            SemaHelper->reportUseAfterInvalidation(
                InvalidatedPVD, UF->getUseExpr(), Warning.InvalidatedByExpr,
                ExprChain);
 
        } else
          // Scope-based expiry (use-after-scope).
          SemaHelper->reportUseAfterScope(IssueExpr, UF->getUseExpr(),
                                          MovedExpr, ExpiryLoc, ExprChain);
 
      } else if (const auto *OEF =
                     dyn_cast<const OriginEscapesFact *>(CausingFact)) {
        if (Warning.InvalidatedByExpr) {
          if (const auto *FieldEscape = dyn_cast<FieldEscapeFact>(OEF)) {
            // Invalidated object escapes to a field.
            if (IssueExpr)
              // Invalidated object on stack escapes to a field.
              SemaHelper->reportInvalidatedField(IssueExpr,
                                                 FieldEscape->getFieldDecl(),
                                                 Warning.InvalidatedByExpr);
            else if (InvalidatedPVD)
              // Invalidated parameter escapes to a field.
              SemaHelper->reportInvalidatedField(InvalidatedPVD,
                                                 FieldEscape->getFieldDecl(),
                                                 Warning.InvalidatedByExpr);
          } else if (const auto *GlobalEscape =
                         dyn_cast<GlobalEscapeFact>(OEF)) {
            // Invalidated object escapes to global or static storage.
            if (IssueExpr)
              // Invalidated object on stack escapes to global or static
              // storage.
              SemaHelper->reportInvalidatedGlobal(IssueExpr,
                                                  GlobalEscape->getGlobal(),
                                                  Warning.InvalidatedByExpr);
            else if (InvalidatedPVD)
              // Invalidated parameter escapes to global or static storage.
              SemaHelper->reportInvalidatedGlobal(InvalidatedPVD,
                                                  GlobalEscape->getGlobal(),
                                                  Warning.InvalidatedByExpr);
          } else if (isa<ReturnEscapeFact>(OEF)) {
            // FIXME: Diagnose invalidated return escapes separately.
          } else if (const auto *ThisEscape = dyn_cast<ThisEscapeFact>(OEF)) {
            // A loan still held by the object at the method's exit was
            // invalidated.
            llvm::SmallVector<const Expr *> ExprChain = getExprChain(
                LoanPropagation.buildOriginFlowChain(OEF, LID, Cfg));
            if (IssueExpr)
              SemaHelper->reportUseAfterInvalidation(
                  IssueExpr, ThisEscape->getLoc(), Warning.InvalidatedByExpr,
                  ExprChain);
            else if (InvalidatedPVD)
              SemaHelper->reportUseAfterInvalidation(
                  InvalidatedPVD, ThisEscape->getLoc(),
                  Warning.InvalidatedByExpr, ExprChain);
          } else
            llvm_unreachable("Unhandled OriginEscapesFact type");
        } else if (const auto *RetEscape = dyn_cast<ReturnEscapeFact>(OEF)) {
          // Return stack address.
          SemaHelper->reportUseAfterReturn(
              IssueExpr, RetEscape->getReturnExpr(), MovedExpr,
              getExprChain(
                  LoanPropagation.buildOriginFlowChain(OEF, LID, Cfg)));
        } else if (const auto *FieldEscape = dyn_cast<FieldEscapeFact>(OEF)) {
          // Dangling field.
          bool IsCapturedByLambda =
              FactMgr.isFieldCapturedByLambda(FieldEscape->getFieldDecl());
          SemaHelper->reportDanglingField(
              IssueExpr, FieldEscape->getFieldDecl(), MovedExpr,
              IsCapturedByLambda, ExpiryLoc);
        } else if (const auto *GlobalEscape = dyn_cast<GlobalEscapeFact>(OEF)) {
          // Global escape.
          bool IsMain = false;
          if (const auto *Func = dyn_cast_if_present<FunctionDecl>(FD))
            IsMain = Func->isMain();
          SemaHelper->reportDanglingGlobal(IssueExpr, GlobalEscape->getGlobal(),
                                           MovedExpr, ExpiryLoc, IsMain);
        } else if (const auto *ThisEscape = dyn_cast<ThisEscapeFact>(OEF))
          // A borrow is still held by the object (e.g. captured via
          // lifetime_capture_by_this) when the captured local goes out of
          // scope; reuse the use-after-scope diagnostic at the capturing
          // method.
          SemaHelper->reportUseAfterScope(
              IssueExpr, ThisEscape->getLoc(), MovedExpr, ExpiryLoc,
              getExprChain(
                  LoanPropagation.buildOriginFlowChain(OEF, LID, Cfg)));
        else
          llvm_unreachable("Unhandled OriginEscapesFact type");
      } else
        llvm_unreachable("Unhandled CausingFact type");
    }
  }
 
  // Returns declarations that should be annotated with lifetime attributes
  // in order to annotate FDef: the canonical declaration and the earliest
  // redeclarations in each other file. This defines the placement policy for
  // lifetime annotations. Each target is paired with its corresponding warning
  // scope.
  llvm::SmallVector<std::pair<const FunctionDecl *, WarningScope>, 2>
  getTargetDeclsForAttr(const FunctionDecl *FDef) {
    if (!FDef)
      return {};
 
    assert(FDef->isThisDeclarationADefinition() &&
           "Expected FunctionDecl to be a definition");
 
    const auto &SM = FDef->getASTContext().getSourceManager();
 
    auto GetFile = [&SM](const FunctionDecl *FD) {
      return SM.getFileID(SM.getExpansionLoc(FD->getLocation()));
    };
 
    const FileID DefFile = GetFile(FDef);
    const FunctionDecl *CanonicalDecl = FDef->getCanonicalDecl();
    llvm::SmallVector<std::pair<const FunctionDecl *, WarningScope>, 2> Targets{
        {CanonicalDecl, GetFile(CanonicalDecl) == DefFile
                            ? WarningScope::IntraTU
                            : WarningScope::CrossTU}};
 
    // Find the earliest redeclaration in each file other than the definition
    // file.
    auto AddCrossTUDecl = [&](const FunctionDecl *FD) {
      FileID File = GetFile(FD);
      if (File == DefFile)
        return;
      for (auto [SeenFD, _] : Targets)
        if (GetFile(SeenFD) == File)
          return;
      Targets.push_back({FD, WarningScope::CrossTU});
    };
 
    // We iterate in reverse order (from most recent to oldest) to find
    // the first declaration in each file.
 
    // Store in temporary variable to manually extend lifetime
    auto redecls = llvm::to_vector(FDef->redecls());
 
    for (const FunctionDecl *Redecl : llvm::reverse(redecls))
      AddCrossTUDecl(Redecl);
 
    return Targets;
  }
 
  void suggestWithScopeForParmVar(const ParmVarDecl *PVD,
                                  EscapingTarget EscapeTarget) {
    if (llvm::isa<const VarDecl *>(EscapeTarget))
      return;
 
    for (auto [Decl, Scope] : getTargetDeclsForAttr(cast<FunctionDecl>(FD))) {
      const auto *ParmToAnnotate =
          Decl->getParamDecl(PVD->getFunctionScopeIndex());
      SemaHelper->suggestLifetimeboundToParmVar(Scope, ParmToAnnotate,
                                                EscapeTarget);
    }
  }
 
  void suggestWithScopeForImplicitThis(const CXXMethodDecl *MD,
                                       const Expr *EscapeExpr) {
    for (auto [Decl, Scope] : getTargetDeclsForAttr(MD)) {
      SemaHelper->suggestLifetimeboundToImplicitThis(
          Scope, cast<CXXMethodDecl>(Decl), EscapeExpr);
    }
  }
 
  void suggestAnnotations() {
    if (!SemaHelper)
      return;
    if (!LSOpts.SuggestAnnotations)
      return;
    llvm::TimeTraceScope TimeTrace("SuggestAnnotations");
    for (auto [Target, EscapeTarget] : AnnotationWarningsMap) {
      if (const auto *PVD = dyn_cast<const ParmVarDecl *>(Target))
        suggestWithScopeForParmVar(PVD, EscapeTarget);
      else if (const auto *MD = dyn_cast<const CXXMethodDecl *>(Target)) {
        if (const auto *EscapeExpr = dyn_cast<const Expr *>(EscapeTarget))
          suggestWithScopeForImplicitThis(MD, EscapeExpr);
        else
          llvm_unreachable("Implicit this can only escape via Expr (return)");
      }
    }
  }
 
  void reportFieldOriginEscapes() {
    if (!SemaHelper)
      return;
    const auto *MD = dyn_cast<CXXMethodDecl>(FD);
    if (!MD)
      return;
    llvm::TimeTraceScope TimeTrace("ReportFieldOriginEscapes");
    for (auto [Field, EscapeExpr] : FieldOriginEscapesMap)
      SemaHelper->reportFieldOriginEscape(MD, Field, EscapeExpr);
  }
 
  void reportNoescapeViolations() {
    llvm::TimeTraceScope TimeTrace("ReportNoescapeViolations");
    for (auto [PVD, EscapeTarget] : NoescapeWarningsMap) {
      if (const auto *E = dyn_cast<const Expr *>(EscapeTarget))
        SemaHelper->reportNoescapeViolation(PVD, E);
      else if (const auto *FD = dyn_cast<const FieldDecl *>(EscapeTarget))
        SemaHelper->reportNoescapeViolation(PVD, FD);
      else if (const auto *G = dyn_cast<const VarDecl *>(EscapeTarget))
        SemaHelper->reportNoescapeViolation(PVD, G);
      else
        llvm_unreachable("Unhandled EscapingTarget type");
    }
  }
 
  void reportLifetimeboundViolations() {
    llvm::TimeTraceScope TimeTrace("ReportLifetimeboundViolations");
    if (!isa<FunctionDecl>(FD))
      return;
    if (const auto *MD = dyn_cast<CXXMethodDecl>(FD);
        MD && getImplicitObjectParamLifetimeBoundAttr(MD) &&
        !VerifiedLiftimeboundEscapes.contains(MD))
      SemaHelper->reportLifetimeboundViolation(MD);
    for (const ParmVarDecl *PVD : cast<FunctionDecl>(FD)->parameters()) {
      if (!PVD->hasAttr<LifetimeBoundAttr>())
        continue;
      bool isImplicit = PVD->getAttr<LifetimeBoundAttr>()->isImplicit();
      bool Escapes = VerifiedLiftimeboundEscapes.contains(PVD);
      assert((!isImplicit || Escapes || isInStlNamespace(FD)) &&
             "Implicit lifetimebound parameters "
             "should escape through return");
      if (!isImplicit && !Escapes)
        SemaHelper->reportLifetimeboundViolation(PVD);
    }
  }
 
  // Reports lifetimebound attributes that are placed on a function definition
  // but not on the corresponding declaration.
  void reportMisplacedLifetimebound() {
    llvm::TimeTraceScope TimeTrace("ReportMisplacedLifetimebound");
    const FunctionDecl *FDef = dyn_cast<FunctionDecl>(FD);
    if (!FDef)
      return;
 
    auto TargetDecls = getTargetDeclsForAttr(FDef);
    // Check if implicit 'this' has lifetimebound on definition but not on
    // declaration.
    if (const auto *MDef = dyn_cast<CXXMethodDecl>(FDef);
        MDef && getDirectImplicitObjectLifetimeBoundAttr(MDef))
      for (auto [Decl, Scope] : TargetDecls) {
        const auto *MDecl = cast<CXXMethodDecl>(Decl);
        if (!getDirectImplicitObjectLifetimeBoundAttr(MDecl))
          SemaHelper->reportMisplacedLifetimebound(Scope, MDef, MDecl);
      }
 
    // Check each parameter for explicit lifetimebound on definition but not on
    // declaration.
    for (const auto *PDef : FDef->parameters()) {
      const auto *Attr = PDef->getAttr<LifetimeBoundAttr>();
      if (!Attr || Attr->isImplicit())
        continue;
      for (auto [Decl, Scope] : TargetDecls) {
        const auto *PDecl = Decl->getParamDecl(PDef->getFunctionScopeIndex());
        if (!PDecl->hasAttr<LifetimeBoundAttr>())
          SemaHelper->reportMisplacedLifetimebound(Scope, PDef, PDecl);
      }
    }
  }
 
  void reportInapplicableLifetimebound() {
    llvm::TimeTraceScope TimeTrace("ReportInapplicableLifetimebound");
    const auto *FDef = dyn_cast<FunctionDecl>(FD);
    if (!FDef)
      return;
 
    // If analyzed function is a template definition or an implicit
    // instantiation, skip.
    if (FDef->getTemplatedKind() == FunctionDecl::TK_FunctionTemplate ||
        FDef->getTemplateSpecializationKind() == TSK_ImplicitInstantiation)
      return;
 
    for (const auto &PVD : FDef->parameters())
      if (PVD->hasAttr<LifetimeBoundAttr>() &&
          !FactMgr.getOriginMgr().hasOrigins(PVD->getType(),
                                             /*IntrinsicOnly=*/true))
        SemaHelper->reportInapplicableLifetimebound(PVD);
  }
 
  void inferAnnotations() {
    for (auto [Target, EscapeTarget] : AnnotationWarningsMap) {
      if (const auto *MD = dyn_cast<const CXXMethodDecl *>(Target)) {
        if (!implicitObjectParamIsLifetimeBound(MD))
          SemaHelper->addLifetimeBoundToImplicitThis(cast<CXXMethodDecl>(MD));
      } else if (const auto *PVD = dyn_cast<const ParmVarDecl *>(Target)) {
        const auto *FD = dyn_cast<FunctionDecl>(PVD->getDeclContext());
        if (!FD)
          continue;
        // Propagates inferred attributes via the most recent declaration to
        // ensure visibility for callers in post-order analysis.
        FD = getDeclWithMergedLifetimeBoundAttrs(FD);
        ParmVarDecl *InferredPVD = const_cast<ParmVarDecl *>(
            FD->getParamDecl(PVD->getFunctionScopeIndex()));
        if (!InferredPVD->hasAttr<LifetimeBoundAttr>())
          InferredPVD->addAttr(
              LifetimeBoundAttr::CreateImplicit(AST, PVD->getLocation()));
      }
    }
  }
 
  /// Extract expressions from the origin flow chain for diagnostic purposes.
  ///
  /// Given a chain of origins that shows how a loan propagates, this function
  /// extracts the corresponding expressions for each origin. Origins that refer
  /// to declarations (rather than expressions) are skipped.
  llvm::SmallVector<const Expr *>
  getExprChain(llvm::ArrayRef<OriginID> OriginFlowChain) {
    llvm::SmallVector<const Expr *> rs;
    for (const OriginID CurrOID : OriginFlowChain)
      if (const Expr *CurrExpr =
              FactMgr.getOriginMgr().getOrigin(CurrOID).getExpr())
        rs.push_back(CurrExpr);
    return rs;
  }
};
} // namespace
 
void runLifetimeChecker(const LoanPropagationAnalysis &LP,
                        const MovedLoansAnalysis &MovedLoans,
                        const LiveOriginsAnalysis &LO, FactManager &FactMgr,
                        AnalysisDeclContext &ADC,
                        LifetimeSafetySemaHelper *SemaHelper,
                        const LifetimeSafetyOpts &LSOpts) {
  llvm::TimeTraceScope TimeProfile("LifetimeChecker");
  LifetimeChecker Checker(LP, MovedLoans, LO, FactMgr, ADC, SemaHelper, LSOpts);
}
 
} // namespace clang::lifetimes::internal