TestDanglingOnTemporary.cpp (2476B)
1 #define MOZ_NO_DANGLING_ON_TEMPORARIES \ 2 __attribute__((annotate("moz_no_dangling_on_temporaries"))) 3 4 class AnnotateConflict { 5 MOZ_NO_DANGLING_ON_TEMPORARIES int *get() && { return nullptr; } // expected-error {{methods annotated with MOZ_NO_DANGLING_ON_TEMPORARIES cannot be && ref-qualified}} 6 MOZ_NO_DANGLING_ON_TEMPORARIES int test() { return 0; } // expected-error {{methods annotated with MOZ_NO_DANGLING_ON_TEMPORARIES must return a pointer}} 7 }; 8 9 class NS_ConvertUTF8toUTF16 { 10 public: 11 MOZ_NO_DANGLING_ON_TEMPORARIES int *get() { return nullptr; } 12 operator int*() 13 { 14 return get(); // This should be ignored because the call is implcitly on this 15 } 16 }; 17 18 NS_ConvertUTF8toUTF16 TemporaryFunction() { return NS_ConvertUTF8toUTF16(); } 19 20 void UndefinedFunction(int* test); 21 22 void NoEscapeFunction(int *test) {} 23 24 int *glob; // expected-note {{through the variable declared here}} 25 void EscapeFunction1(int *test) { glob = test; } // expected-note {{the raw pointer escapes the function scope here}} 26 27 void EscapeFunction2(int *test, int *&escape) { escape = test; } // expected-note {{the raw pointer escapes the function scope here}} \ 28 expected-note {{through the parameter declared here}} 29 30 int *EscapeFunction3(int *test) { return test; } // expected-note {{the raw pointer escapes the function scope here}} \ 31 expected-note {{through the return value of the function declared here}} 32 33 int main() { 34 int *test = TemporaryFunction().get(); // expected-error {{calling `get` on a temporary, potentially allowing use after free of the raw pointer}} 35 int *test2 = NS_ConvertUTF8toUTF16().get(); // expected-error {{calling `get` on a temporary, potentially allowing use after free of the raw pointer}} 36 37 UndefinedFunction(NS_ConvertUTF8toUTF16().get()); 38 39 NoEscapeFunction(TemporaryFunction().get()); 40 EscapeFunction1(TemporaryFunction().get()); // expected-error {{calling `get` on a temporary, potentially allowing use after free of the raw pointer}} 41 42 int *escape; 43 EscapeFunction2(TemporaryFunction().get(), escape); // expected-error {{calling `get` on a temporary, potentially allowing use after free of the raw pointer}} 44 int *escape2 = EscapeFunction3(TemporaryFunction().get()); // expected-error {{calling `get` on a temporary, potentially allowing use after free of the raw pointer}} 45 }