`clang-analyzer-cplusplus.Move` not reported for usage after `std::move()` with range

[firewave]

#include <algorithm>
#include <iostream>
#include <iterator>
#include <list>
#include <string>

int main()
{
    std::list<std::string> l1 = { "1" };

    std::list<std::string> l2;
    std::move(l1.begin(), l1.end(), std::back_inserter(l2));

    std::cout << "l1: " << *l1.cbegin() << '\n'; // <--- should have a use-after-move
    std::cout << "l2: " << *l2.cbegin() << '\n';
}

https://godbolt.org/z/Y96a6nv7h

https://en.cppreference.com/w/cpp/algorithm/move

Also not detected by bugprone-use-after-move clang-tidy check: #137156

[llvmbot]

@llvm/issue-subscribers-clang-static-analyzer

Author: Oliver Stöneberg (firewave)

``` #include <algorithm> #include <iostream> #include <iterator> #include <list> #include <string>

int main()
{
std::list<std::string> l1 = { "1" };

std::list<std::string> l2;
std::move(l1.begin(), l1.end(), std::back_inserter(l2));

std::cout << "l1: " << *l1.cbegin() << '\n';
std::cout << "l2: " << *l2.cbegin() << '\n';

}

https://godbolt.org/z/Y96a6nv7h

https://en.cppreference.com/w/cpp/algorithm/move

Also not detected by `bugprone-use-after-move` clang-tidy check: #<!-- -->137156
</details>

[chrchr-github]

Probably requires tracking the state of container elements, which doesn't seem to exist yet (FNs for code below):

int main()
{
    std::vector<std::string> v = { "1", "2", "3" };

    std::string s = std::move(v[1]);

    return static_cast<int>(s.size() + v[1].size());
}

https://godbolt.org/z/Pjh4Gh5ao

[steakhal]

I believe the checker should know and handle the range variant of std::move, and it should be a fairly easy bug to fix.
One just needs to debug what controlflow is taken in the checker that makes it miss the bug.

[llvmbot]

Hi!

This issue may be a good introductory issue for people new to working on LLVM. If you would like to work on this issue, your first steps are:

1. Check that no other contributor has already been assigned to this issue. If you believe that no one is actually working on it despite an assignment, ping the person. After one week without a response, the assignee may be changed.
2. In the comments of this issue, request for it to be assigned to you, or just create a pull request after following the steps below. Mention this issue in the description of the pull request.
3. Fix the issue locally.
4. Run the test suite locally. Remember that the subdirectories under test/ create fine-grained testing targets, so you can e.g. use make check-clang-ast to only run Clang's AST tests.
5. Create a Git commit.
6. Run git clang-format HEAD~1 to format your changes.
7. Open a pull request to the upstream repository on GitHub. Detailed instructions can be found in GitHub's documentation. Mention this issue in the description of the pull request.

If you have any further questions about this issue, don't hesitate to ask via a comment in the thread below.

[llvmbot]

@llvm/issue-subscribers-good-first-issue

Author: Oliver Stöneberg (firewave)

``` #include <algorithm> #include <iostream> #include <iterator> #include <list> #include <string>

int main()
{
std::list<std::string> l1 = { "1" };

std::list<std::string> l2;
std::move(l1.begin(), l1.end(), std::back_inserter(l2));

std::cout << "l1: " << *l1.cbegin() << '\n';
std::cout << "l2: " << *l2.cbegin() << '\n';

}

https://godbolt.org/z/Y96a6nv7h

https://en.cppreference.com/w/cpp/algorithm/move

Also not detected by `bugprone-use-after-move` clang-tidy check: #<!-- -->137156
</details>

[hapeeeeee]

I attempted to locate the root cause of the problem and found that it is not easy to resolve.

Currently, the mechanism for detecting use-after-move is as follows:
When a move operation occurs, the moved-from address is marked. The relevant source code is located at

llvm-project/clang/lib/StaticAnalyzer/Checkers/MoveChecker.cpp

Lines 489 to 494 in a37e475

	if (shouldBeTracked(OK)) {
	// Mark object as moved-from.
	State = State->set<TrackedRegionMap>(ArgRegion, RegionState::getMoved());
	C.addTransition(State);
	return;
	}

When a memory region is accessed, the analyzer checks whether it has been marked. The relevant source code for this check is located at

llvm-project/clang/lib/StaticAnalyzer/Checkers/MoveChecker.cpp

Lines 357 to 370 in a37e475

	const RegionState *RS = State->get<TrackedRegionMap>(Region);
	ObjectKind OK = classifyObject(State, Region, RD);
	// Just in case: if it's not a smart pointer but it does have operator *,
	// we shouldn't call the bug a dereference.
	if (MK == MK_Dereference && OK.StdKind != SK_SmartPtr)
	MK = MK_FunCall;
	if (!RS || !shouldWarnAbout(OK, MK)
	|| isInMoveSafeContext(C.getLocationContext())) {
	// Finalize changes made by the caller.
	C.addTransition(State);
	return;
	}

In this particular issue, the reason why the Clang Static Analyzer does not report a warning is that the address marked during the move and the address accessed afterward are not the same.Specifically, when std::move(v[1]) is called, it marks the address (e.g., 0x1111), but when v[1].some_func() is subsequently called, it accesses a different address.

As a result, the analyzer fails to detect the use-after-move.

I am unable to definitively determine why this address mismatch occurs.
From what I can tell, the inputs to both std::move(v[1]) and v[1].some_func() seem correct (since operations like std::string new_s = std::move(old_s) work without issues).

I suspect that std::vector may perform reinitialization or other modifications to the element after it has been moved (although I am not familiar with the internals of the STL implementation),
which could explain why the address changes, thereby preventing detection based on the original memory location.