AST Matcher varDecl() in lambda bug

[segoon]

In test program:

  int Mov{};
  auto Lambda = [=]() mutable {
    Mov = 1;
  };
  Lambda();
}

AST matcher declRefExpr(to(varDecl().bind("decl"))).bind("expr") matches:

Match #2:

/home/segoon/projects/llvm-project/build/../clang-tools-extra/test/clang-tidy/checkers/performance/lambda.cpp:2:3: note: "decl" binds here
    2 |   int Mov{};
      |   ^~~~~~~~~
/home/segoon/projects/llvm-project/build/../clang-tools-extra/test/clang-tidy/checkers/performance/lambda.cpp:4:5: note: "expr" binds here
    4 |     Mov = 1;
      |   

I would expect varDecl of Mov inside of lambda to be equal to lambda's catched parameter, not the outer variable that was the source of catched parameter. If it is expected varDecl() behaviour (IOW, it's not a bug), then how can I catch lambda's Mov field?

[llvmbot]

@llvm/issue-subscribers-clang-frontend

Author: Vasiliy Kulikov (segoon)

In test program: ```void lambdaCaptureValueTester3() { int Mov{}; auto Lambda = [=]() mutable { Mov = 1; }; Lambda(); } ```

AST matcher declRefExpr(to(varDecl().bind("decl"))).bind("expr") matches:

Match #<!-- -->2:

/home/segoon/projects/llvm-project/build/../clang-tools-extra/test/clang-tidy/checkers/performance/lambda.cpp:2:3: note: "decl" binds here
    2 |   int Mov{};
      |   ^~~~~~~~~
/home/segoon/projects/llvm-project/build/../clang-tools-extra/test/clang-tidy/checkers/performance/lambda.cpp:4:5: note: "expr" binds here
    4 |     Mov = 1;
      |   

I would expect varDecl of Mov inside of lambda to be equal to lambda's catched parameter, not the outer variable that was the source of catched parameter. If it is expected varDecl() behaviour (IOW, it's not a bug), then how can I catch lambda's Mov field?

[AaronBallman]

I don't think the current behavior is a bug per se; the AST matcher is matching the AST: https://godbolt.org/z/P8ErPW7YE

    |     `-CompoundStmt <col:31, line:5:3>
    |       `-BinaryOperator <line:4:5, col:11> 'int' lvalue '='
    |         |-DeclRefExpr <col:5> 'int' lvalue Var 0x2b1e8ea8 'Mov' 'int' refers_to_enclosing_variable_or_capture
    |         `-IntegerLiteral <col:11> 'int' 1

I think you have to start from the lambda expression and go from the capture, something like this should get you close I think:

declRefExpr(allOf(
  to(varDecl().bind("decl")),
  hasAncestor(
    lambdaExpr(forEachLambdaCapture(
      lambdaCapture(capturesVar(varDecl(equalsBoundNode("decl")))).bind("capture")
    ))
  )
))

[segoon]

IMO it makes hard to distinguish real references to variable from "fake" in-lambda. E.g. if I want to find all usages of variable, I have to filter out all fake usages from lambdas.

Also it is very confusing that Mov's declaration is outside lambda - variable usage (in lambda) may be executed with variable declaration destroyed (outside lambda) because lambda may outlive source variables.

IOW, I don't say that AST matching is buggy; I say that built AST is somewhat confusing.

[AaronBallman]

IMO it makes hard to distinguish real references to variable from "fake" in-lambda. E.g. if I want to find all usages of variable, I have to filter out all fake usages from lambdas.

Also it is very confusing that Mov's declaration is outside lambda - variable usage (in lambda) may be executed with variable declaration destroyed (outside lambda) because lambda may outlive source variables.

IOW, I don't say that AST matching is buggy; I say that built AST is somewhat confusing.

There's not a one-to-one relationship between captured variables and the captures themselves, and the AST reflects that. Each lambda tracks its own list of captures, and each variable may be captured several times (and via several levels of indirection via nested lambdas).

I'm sure this could be made simpler via the AST matcher interfaces (perhaps via an isCaptured() narrowing matcher on VarDecl), but we've not had a need for such a thing in-tree yet.