hasAncestor finds ancestors' siblings

Clang Frontend Static Analyzer
1

Greetings. The clang-query query

m cxxConstructExpr(hasAncestor(cxxConstructorDecl(isDefaulted()).bind("x")))

on the program

struct S1 {};
struct S9 {
	S1 s1 = *(new S1);
};
void f() {
	S9 s9;
}

returns several matches in which hasAncestor() appears to be matching an ancestor’s sibling.

The AST for S9 is:

CXXRecordDecl 0x20473df7ad0 <C:\ast\hasAncestorBug.cpp:2:1, line:4:1> line:2:8 referenced struct S9 definition
|-DefinitionData pass_in_registers aggregate standard_layout trivially_copyable literal has_constexpr_non_copy_move_ctor can_const_default_init
| |-DefaultConstructor exists non_trivial constexpr defaulted_is_constexpr
| |-CopyConstructor simple trivial has_const_param implicit_has_const_param
| |-MoveConstructor exists simple trivial
| |-CopyAssignment simple trivial has_const_param needs_implicit implicit_has_const_param
| |-MoveAssignment exists simple trivial needs_implicit
| `-Destructor simple irrelevant trivial needs_implicit
|-CXXRecordDecl 0x20473df7be8 <col:1, col:8> col:8 implicit struct S9
|-FieldDecl 0x20473df7cc0 <line:3:2, col:18> col:5 s1 'S1':'S1'
| `-CXXConstructExpr 0x20473e037f0 <col:8, col:18> 'S1':'S1' 'void (const S1 &) noexcept'
|   `-ImplicitCastExpr 0x20473e03798 <col:10, col:18> 'const S1':'const S1' lvalue <NoOp>
|     `-UnaryOperator 0x20473e03780 <col:10, col:18> 'S1':'S1' lvalue prefix '*' cannot overflow
|       `-ParenExpr 0x20473e03760 <col:11, col:18> 'S1 *'
|         `-CXXNewExpr 0x20473e03720 <col:12, col:16> 'S1 *' Function 0x20473df7ec0 'operator new' 'void *(unsigned long long)'
|           `-CXXConstructExpr 0x20473e036f8 <col:16> 'S1':'S1' 'void () noexcept'
|-CXXConstructorDecl 0x20473e039f0 <line:2:8> col:8 implicit used constexpr S9 'void () noexcept(false)' inline default
| |-CXXCtorInitializer Field 0x20473df7cc0 's1' 'S1':'S1'
| | `-CXXDefaultInitExpr 0x20473e040f0 <col:8> 'S1':'S1'
| `-CompoundStmt 0x20473e04140 <col:8>
|-CXXConstructorDecl 0x20473e03c18 <col:8> col:8 implicit constexpr S9 'void (const S9 &)' inline default trivial noexcept-unevaluated 0x20473e03c18
| `-ParmVarDecl 0x20473e03d38 <col:8> col:8 'const S9 &'
`-CXXConstructorDecl 0x20473e03e18 <col:8> col:8 implicit constexpr S9 'void (S9 &&)' inline default trivial noexcept-unevaluated 0x20473e03e18
  `-ParmVarDecl 0x20473e03f38 <col:8> col:8 'S9 &&'

and the matches are:

Match #1:

Binding for "root":
CXXConstructExpr 0x20473e037f0 <C:\ast\hasAncestorBug.cpp:3:8, col:18> 'S1':'S1' 'void (const S1 &) noexcept'
`-ImplicitCastExpr 0x20473e03798 <col:10, col:18> 'const S1':'const S1' lvalue <NoOp>
  `-UnaryOperator 0x20473e03780 <col:10, col:18> 'S1':'S1' lvalue prefix '*' cannot overflow
    `-ParenExpr 0x20473e03760 <col:11, col:18> 'S1 *'
      `-CXXNewExpr 0x20473e03720 <col:12, col:16> 'S1 *' Function 0x20473df7ec0 'operator new' 'void *(unsigned long long)'
        `-CXXConstructExpr 0x20473e036f8 <col:16> 'S1':'S1' 'void () noexcept'

Binding for "x":
CXXConstructorDecl 0x20473e039f0 <C:\ast\hasAncestorBug.cpp:2:8> col:8 implicit used constexpr S9 'void () noexcept(false)' inline default
|-CXXCtorInitializer Field 0x20473df7cc0 's1' 'S1':'S1'
| `-CXXDefaultInitExpr 0x20473e040f0 <col:8> 'S1':'S1'
`-CompoundStmt 0x20473e04140 <col:8>

Match #2:

Binding for "root":
CXXConstructExpr 0x20473e036f8 <C:\ast\hasAncestorBug.cpp:3:16> 'S1':'S1' 'void () noexcept'

Binding for "x":
CXXConstructorDecl 0x20473e039f0 <C:\ast\hasAncestorBug.cpp:2:8> col:8 implicit used constexpr S9 'void () noexcept(false)' inline default
|-CXXCtorInitializer Field 0x20473df7cc0 's1' 'S1':'S1'
| `-CXXDefaultInitExpr 0x20473e040f0 <col:8> 'S1':'S1'
`-CompoundStmt 0x20473e04140 <col:8>

As you can see, the cxxConstructorDecl 0x20473e039f0 has no CXXConstructExpr descendants, so searching for the ancestors of CXXConstructExpr nodes shouldn’t yield any matches to cxxConstructorDecl 0x20473e039f0. And yet it does.

Am I missing something obvious here?

BTW, clang-query also returns matches 3 and 4, which are identical to matches 1 and 2, respectively.

I am using clang-query v.17.0.2.0, which I believe Mozilla built.

2

I think I’ve seen this one.

The CXXDefaultInitExpr is actually hidden within a FieldDecl. In anyways, https://github.com/llvm/llvm-project/commit/8698262a4365bf22b5b0c96e77bfecd3dcf084a7 changed the traversal for AST visitors so that now inside a CXXDefaultInitExpr node, we will also traverse the initializer expression too (if shouldVisitImplicitCode is set to true, which is by default false if I recall).

So try reverting that patch locally to confirm that that commit affects you.

3

Thanks for looking at this issue. I don’t currently build Clang locally, so it’ll be awhile before I can test your hypothesis.