tree d149f0034333794d817450c0ea785999e7fdcd08
parent 73c1d99f7a4c76f1461885bba6de16342237989d
author Utkarsh Saxena <usx@google.com> 1768851941 +0100
committer GitHub <noreply@github.com> 1768851941 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJpbonlCRC1aQ7uu5UhlAAA6qMQAEsdMYtNPnallo1JqcfpAy/n
 LGWvpMqBMCbM/FoESIGTXuyAe16eet/WYJk+/NgMk/h0jrVEp9OS8uRqqQksYMr/
 71iHhrYVImPGdaDf1sx1ClVfOsXFxrBPaUMMwCuU44aK12UXFegOOE5f9E8jvZ5S
 KTujJqjKaGDmJ1p+xvv+9X+a2+B4A9xZpcHu3p3KGaVKLIVpEUf7DVwFQ3XEhe8u
 VVVe64FCez+3gf1PKBfBGuzDVAC5wDI/TW+OP/tzswW09i7KL6dNre+i4g+gyHqw
 9Jn+aBBug4lBDpVQ538vsZqaSUhxbVsvTCL+jQDWup+38VhTnOY3o81uIJt0IFnC
 Gi4MUyCDcTxNzy0TjIT0x7ze7MAajCw4YE0jbITtiQb3EIq15QFM9oHM0TQa4yDQ
 OxiDpiixaQEF+DWL4OMwhFPplX5I9ojWBH35p7iK4AugUchtR7fnDJPpaQ8d5P6w
 SRdv7I3OFg1wm7MfXqn0pgUscicSiYounYk30Ls/KeEMOcIaYmoVKtdhHb0DE+6s
 i3md5zxpNeF7HIdPQaVecivkIDciKbp5w9GI/ITVU8x67/+lx9HdWJkDducXOSTX
 55AwwdqN7uW8R+4TNH3cICesApO0LXsqqPGJb8ADdg1SRfxxdgVI7Pv/AnpntcuA
 Zzz2pzijepUSnmX1iyip
 =owjE
 -----END PGP SIGNATURE-----
 

[LifetimeSafety] Track dereference operators for GSL pointers in STL (#176643)

Improve lifetime analysis for STL iterators in range-based `for` loops
by tracking dereference operator of GSL pointers.

Added support for dereference operators (`*`) for GSL pointers in STL to
track pointer value instead of `this` arg reference.

Tests:
- Removed a test which started to fail and didn't look correctly
annotated (?).
- Added new test cases for range-based for loop variables and iterator
arrow operators

## **Thoughts on overall direction:**

I feel we are twisting clang too much here to hardcode heuristics which
cannot be otherwise expressed through available annotations. This had
initially started by the intention of implicitly annotating STL to
benefit every implementation out there. But this has moved to a
direction where we have heuristics which cannot be anymore expressed by
annotations (like transparent accessors and inner pointers). This is
also a fallout of making [[clang::lifetimebound]] and [[gsl::*]]
annotations work together.

Some takeaways for me here are:
1. It is great to have inferred annotations for STL but they should be
expressible through explicit annotations especially when STL
implementers are willing to add these (e.g.
https://github.com/llvm/llvm-project/pull/112751).
2. We need a simple way to express transparent accessor functions of GSL
pointers.

### Transparent functions:
```cpp
int* transparent(int* in) { return in; }
```
There is no "outlives" constraint imposed by this function. Instead, it
introduces only an aliasing effect. The return value is an alias to
`in`. This aliasing effect can be expressed through
`clang::lifetimebound`.
```cpp
int* transparent(int* in [[clang::lifetimebound]]) { return in; }
```
Same is true for `view` types.
```cpp
// return view aliases 'in' which points to some char* owned by some 'std::string'.
// This helps in upholding the contract "that std::string should outlive the value returned here".
std::string_view transparent(std::string_view in [[clang::lifetimebound]]) { return in; }
```
This gets complicated when we have references to `view` types.
```cpp
// Not possible to annotate this to express the same effect/contract.
std::string_view transparent2(const std::string_view& in) { return in; }
```
This gets much harder when we want to express this for accessor methods
of view types as implicit this arg is always a reference.
```cpp
class [[gsl::Pointer]] MySpan {
  MySpan(MyVector<int>& v [[clang::lifetimebound]]);  // 'MySpan' should not outlive 'v'. Ok.
  // 'begin' aliases MySpan which aliases 'v'. No way to express this.
  const MyVector* begin() const { return begin; }
  const MyVector* end() const { return end; }
private:
  const MyVector* begin;
  const MyVector* end;
};

// Again possible to annotate free methods provided view types is accepted as a value.
const MyVector* getBegin(MySpan my_span [[clang::lifetimebound]]) { // returns the pointee of the pointer 'my_span'.
  return my_span.begin();
}
```

The problematic cases are quite similar though:
```cpp
std::string_view transparent2(const std::string_view& in) { return in; }

class [[gsl::Pointer]] MySpan {
  const MyVector* begin() const { return begin; }
};
```

These essentially talk about **inner** pointer. For `transparent2`, we
want to express that it aliases the inner pointer of `const
std::string_view&`. For `MySpan::begin()`, we want to the express that
it aliases the inner pointer of `const MySpan&` type which is the type
of implicit `this` parameter.

### Options:
- `[[clang::lifetimebound(2)]]`: Refer to the inner pointer after
peeling the outer pointer/reference. More generally
`[[clang::lifetimebound(x)]]` where `x` is a positive integer to peel
off `x` layers of pointers.

cc: @Xazax-hun