[analyzer] Fix a false memory leak reports involving placement new #144341

necto · 2025-06-16T12:31:17Z

Placement new does not allocate memory, so it should not be reported as a memory leak. A recent MallocChecker refactor changed inlining of placement-new calls with manual evaluation by MallocChecker. 339282d

This change avoids marking the value returned by placement new as allocated and hence avoids the false leak reports.

Note that the there are two syntaxes to invoke placement new: new (p) int and an explicit operator call operator new(sizeof(int), p). The first syntax was already properly handled by the engine. This change corrects handling of the second syntax.

CPP-6375

Placement new does not allocate memory, so it should not be reported as a memory leak. A recent MallocChecker refactor changed inlining of placement-new calls with manual evaluation by MallocChecker. llvm@339282d This change avoids marking the value returned by placement new as allocated and hence avoids the false leak reports. --- CPP-6375

llvmbot · 2025-06-16T12:31:51Z

@llvm/pr-subscribers-clang

Author: Arseniy Zaostrovnykh (necto)

Changes

Placement new does not allocate memory, so it should not be reported as a memory leak. A recent MallocChecker refactor changed inlining of placement-new calls with manual evaluation by MallocChecker. 339282d

This change avoids marking the value returned by placement new as allocated and hence avoids the false leak reports.

Note that the there are two syntaxes to invoke placement new: new (p) int and an explicit operator call operator new(sizeof(int), p). The first syntax was already properly handled by the engine. This change corrects handling of the second syntax.

CPP-6375

Full diff: https://github.com/llvm/llvm-project/pull/144341.diff

2 Files Affected:

(modified) clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp (+21)
(modified) clang/test/Analysis/NewDelete-checker-test.cpp (+39-2)

diff --git a/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
index fef33509c0b6e..4a78f64797bba 100644
--- a/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
@@ -1371,6 +1371,19 @@ void MallocChecker::checkIfFreeNameIndex(ProgramStateRef State,
   C.addTransition(State);
 }
 
+bool isVoidStar(QualType T) {
+  return !T.isNull() && T->isPointerType() && T->getPointeeType()->isVoidType();
+}
+
+const Expr* getPlacementNewBufferArg(const CallExpr *CE, const FunctionDecl *FD) {
+  if (CE->getNumArgs() == 1)
+    return nullptr;
+  // Second argument of placement new must be void*
+  if (!isVoidStar(FD->getParamDecl(1)->getType()))
+    return nullptr;
+  return CE->getArg(1);
+}
+
 void MallocChecker::checkCXXNewOrCXXDelete(ProgramStateRef State,
                                            const CallEvent &Call,
                                            CheckerContext &C) const {
@@ -1386,6 +1399,14 @@ void MallocChecker::checkCXXNewOrCXXDelete(ProgramStateRef State,
   // processed by the checkPostStmt callbacks for CXXNewExpr and
   // CXXDeleteExpr.
   const FunctionDecl *FD = C.getCalleeDecl(CE);
+  if (const auto *BufArg = getPlacementNewBufferArg(CE, FD)) {
+    // Placement new does not allocate memory
+    auto RetVal = State->getSVal(BufArg, Call.getLocationContext());
+    State = State->BindExpr(CE, C.getLocationContext(), RetVal);
+    C.addTransition(State);
+    return;
+  }
+
   switch (FD->getOverloadedOperator()) {
   case OO_New:
     State = MallocMemAux(C, Call, CE->getArg(0), UndefinedVal(), State,
diff --git a/clang/test/Analysis/NewDelete-checker-test.cpp b/clang/test/Analysis/NewDelete-checker-test.cpp
index 06754f669b1e6..0820600a63559 100644
--- a/clang/test/Analysis/NewDelete-checker-test.cpp
+++ b/clang/test/Analysis/NewDelete-checker-test.cpp
@@ -26,9 +26,10 @@
 // RUN:   -analyzer-checker=cplusplus.NewDeleteLeaks
 //
 // RUN: %clang_analyze_cc1 -std=c++17 -fblocks -verify %s \
-// RUN:   -verify=expected,leak \
+// RUN:   -verify=expected,leak,inspection \
 // RUN:   -analyzer-checker=core \
-// RUN:   -analyzer-checker=cplusplus.NewDeleteLeaks
+// RUN:   -analyzer-checker=cplusplus.NewDeleteLeaks \
+// RUN:   -analyzer-checker=debug.ExprInspection
 
 #include "Inputs/system-header-simulator-cxx.h"
 
@@ -63,6 +64,42 @@ void testGlobalNoThrowPlacementExprNewBeforeOverload() {
   int *p = new(std::nothrow) int;
 } // leak-warning{{Potential leak of memory pointed to by 'p'}}
 
+//----- Standard pointer placement operators
+void testGlobalPointerPlacementNew() {
+  int i;
+  void *p1 = operator new(0, &i); // no warn
+
+  void *p2 = operator new[](0, &i); // no warn
+
+  int *p3 = new(&i) int; // no warn
+
+  int *p4 = new(&i) int[0]; // no warn
+}
+
+template<typename T>
+void clang_analyzer_dump(T x);
+
+void testPlacementNewBufValue() {
+  int i = 10;
+  int *p = new(&i) int;
+  clang_analyzer_dump(p); // inspection-warning{{&i}}
+  clang_analyzer_dump(*p); // inspection-warning{{10}}
+}
+
+void testPlacementNewBufValueExplicitOp() {
+  int i = 10;
+  int *p = (int*)operator new(sizeof(int), &i);
+  clang_analyzer_dump(p); // inspection-warning{{&i}}
+  clang_analyzer_dump(*p); // inspection-warning{{10}}
+}
+
+void testPlacementArrNewBufValueExplicitArrOp() {
+  int i = 10;
+  int *p = (int*)operator new[](sizeof(int), &i);
+  clang_analyzer_dump(p); // inspection-warning{{&i}}
+  clang_analyzer_dump(*p); // inspection-warning{{10}}
+}
+
 //----- Other cases
 void testNewMemoryIsInHeap() {
   int *p = new int;

necto · 2025-06-16T12:31:52Z

@balazs-benics-sonarsource

llvmbot · 2025-06-16T12:31:52Z

@llvm/pr-subscribers-clang-static-analyzer-1

Author: Arseniy Zaostrovnykh (necto)

Changes

Placement new does not allocate memory, so it should not be reported as a memory leak. A recent MallocChecker refactor changed inlining of placement-new calls with manual evaluation by MallocChecker. 339282d

This change avoids marking the value returned by placement new as allocated and hence avoids the false leak reports.

Note that the there are two syntaxes to invoke placement new: new (p) int and an explicit operator call operator new(sizeof(int), p). The first syntax was already properly handled by the engine. This change corrects handling of the second syntax.

CPP-6375

Full diff: https://github.com/llvm/llvm-project/pull/144341.diff

2 Files Affected:

(modified) clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp (+21)
(modified) clang/test/Analysis/NewDelete-checker-test.cpp (+39-2)

diff --git a/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
index fef33509c0b6e..4a78f64797bba 100644
--- a/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
@@ -1371,6 +1371,19 @@ void MallocChecker::checkIfFreeNameIndex(ProgramStateRef State,
   C.addTransition(State);
 }
 
+bool isVoidStar(QualType T) {
+  return !T.isNull() && T->isPointerType() && T->getPointeeType()->isVoidType();
+}
+
+const Expr* getPlacementNewBufferArg(const CallExpr *CE, const FunctionDecl *FD) {
+  if (CE->getNumArgs() == 1)
+    return nullptr;
+  // Second argument of placement new must be void*
+  if (!isVoidStar(FD->getParamDecl(1)->getType()))
+    return nullptr;
+  return CE->getArg(1);
+}
+
 void MallocChecker::checkCXXNewOrCXXDelete(ProgramStateRef State,
                                            const CallEvent &Call,
                                            CheckerContext &C) const {
@@ -1386,6 +1399,14 @@ void MallocChecker::checkCXXNewOrCXXDelete(ProgramStateRef State,
   // processed by the checkPostStmt callbacks for CXXNewExpr and
   // CXXDeleteExpr.
   const FunctionDecl *FD = C.getCalleeDecl(CE);
+  if (const auto *BufArg = getPlacementNewBufferArg(CE, FD)) {
+    // Placement new does not allocate memory
+    auto RetVal = State->getSVal(BufArg, Call.getLocationContext());
+    State = State->BindExpr(CE, C.getLocationContext(), RetVal);
+    C.addTransition(State);
+    return;
+  }
+
   switch (FD->getOverloadedOperator()) {
   case OO_New:
     State = MallocMemAux(C, Call, CE->getArg(0), UndefinedVal(), State,
diff --git a/clang/test/Analysis/NewDelete-checker-test.cpp b/clang/test/Analysis/NewDelete-checker-test.cpp
index 06754f669b1e6..0820600a63559 100644
--- a/clang/test/Analysis/NewDelete-checker-test.cpp
+++ b/clang/test/Analysis/NewDelete-checker-test.cpp
@@ -26,9 +26,10 @@
 // RUN:   -analyzer-checker=cplusplus.NewDeleteLeaks
 //
 // RUN: %clang_analyze_cc1 -std=c++17 -fblocks -verify %s \
-// RUN:   -verify=expected,leak \
+// RUN:   -verify=expected,leak,inspection \
 // RUN:   -analyzer-checker=core \
-// RUN:   -analyzer-checker=cplusplus.NewDeleteLeaks
+// RUN:   -analyzer-checker=cplusplus.NewDeleteLeaks \
+// RUN:   -analyzer-checker=debug.ExprInspection
 
 #include "Inputs/system-header-simulator-cxx.h"
 
@@ -63,6 +64,42 @@ void testGlobalNoThrowPlacementExprNewBeforeOverload() {
   int *p = new(std::nothrow) int;
 } // leak-warning{{Potential leak of memory pointed to by 'p'}}
 
+//----- Standard pointer placement operators
+void testGlobalPointerPlacementNew() {
+  int i;
+  void *p1 = operator new(0, &i); // no warn
+
+  void *p2 = operator new[](0, &i); // no warn
+
+  int *p3 = new(&i) int; // no warn
+
+  int *p4 = new(&i) int[0]; // no warn
+}
+
+template<typename T>
+void clang_analyzer_dump(T x);
+
+void testPlacementNewBufValue() {
+  int i = 10;
+  int *p = new(&i) int;
+  clang_analyzer_dump(p); // inspection-warning{{&i}}
+  clang_analyzer_dump(*p); // inspection-warning{{10}}
+}
+
+void testPlacementNewBufValueExplicitOp() {
+  int i = 10;
+  int *p = (int*)operator new(sizeof(int), &i);
+  clang_analyzer_dump(p); // inspection-warning{{&i}}
+  clang_analyzer_dump(*p); // inspection-warning{{10}}
+}
+
+void testPlacementArrNewBufValueExplicitArrOp() {
+  int i = 10;
+  int *p = (int*)operator new[](sizeof(int), &i);
+  clang_analyzer_dump(p); // inspection-warning{{&i}}
+  clang_analyzer_dump(*p); // inspection-warning{{10}}
+}
+
 //----- Other cases
 void testNewMemoryIsInHeap() {
   int *p = new int;

github-actions · 2025-06-16T12:36:51Z

✅ With the latest revision this PR passed the C/C++ code formatter.

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

clang/test/Analysis/NewDelete-checker-test.cpp

Co-authored-by: Balázs Benics <108414871+balazs-benics-sonarsource@users.noreply.github.com>

NagyDonat

LGTM, nice little patch 😄

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

…lvm#144341) Placement new does not allocate memory, so it should not be reported as a memory leak. A recent MallocChecker refactor changed inlining of placement-new calls with manual evaluation by MallocChecker. llvm@339282d This change avoids marking the value returned by placement new as allocated and hence avoids the false leak reports. Note that the there are two syntaxes to invoke placement new: `new (p) int` and an explicit operator call `operator new(sizeof(int), p)`. The first syntax was already properly handled by the engine. This change corrects handling of the second syntax. CPP-6375

llvmbot added clang Clang issues not falling into any other category clang:static analyzer labels Jun 16, 2025

balazs-benics-sonarsource requested review from Xazax-hun, NagyDonat and pskrgag June 16, 2025 12:35

[NFC] Fix formatting

b18957f

tbaederr reviewed Jun 16, 2025

View reviewed changes

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp Outdated Show resolved Hide resolved

Use isVoidPointerType() and state the checked signature

2b861b6

balazs-benics-sonarsource reviewed Jun 16, 2025

View reviewed changes

clang/test/Analysis/NewDelete-checker-test.cpp Outdated Show resolved Hide resolved

Update clang/test/Analysis/NewDelete-checker-test.cpp

245d8f5

Co-authored-by: Balázs Benics <108414871+balazs-benics-sonarsource@users.noreply.github.com>

NagyDonat approved these changes Jun 16, 2025

View reviewed changes

pskrgag reviewed Jun 16, 2025

View reviewed changes

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp Outdated Show resolved Hide resolved

pskrgag approved these changes Jun 16, 2025

View reviewed changes

Make sure to handle only placement new, not placement delete

4bbdc19

balazs-benics-sonarsource merged commit e2551c1 into llvm:main Jun 17, 2025
6 of 7 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[analyzer] Fix a false memory leak reports involving placement new #144341

[analyzer] Fix a false memory leak reports involving placement new #144341

Uh oh!

necto commented Jun 16, 2025

Uh oh!

llvmbot commented Jun 16, 2025

Uh oh!

necto commented Jun 16, 2025

Uh oh!

llvmbot commented Jun 16, 2025

Uh oh!

github-actions bot commented Jun 16, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

NagyDonat left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

[analyzer] Fix a false memory leak reports involving placement new #144341

[analyzer] Fix a false memory leak reports involving placement new #144341

Uh oh!

Conversation

necto commented Jun 16, 2025

Uh oh!

llvmbot commented Jun 16, 2025

Uh oh!

necto commented Jun 16, 2025

Uh oh!

llvmbot commented Jun 16, 2025

Uh oh!

github-actions bot commented Jun 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

NagyDonat left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jun 16, 2025 •

edited

Loading