From 17081268e25326cb2afd21f56e5d12ac445a832c Mon Sep 17 00:00:00 2001
From: Akira Hatanaka <ahatanaka@apple.com>
Date: Wed, 19 Apr 2017 17:54:08 +0000
Subject: [PATCH] [Sema][ObjC] Disallow jumping into ObjC fast enumeration
 loops.

rdar://problem/31635406

Differential Revision: https://reviews.llvm.org/D32187

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@300722 91177308-0d34-0410-b5e6-96231b3b80d8
---
 include/clang/Basic/DiagnosticSemaKinds.td |  2 ++
 lib/Sema/JumpDiagnostics.cpp               |  9 ++++++++
 lib/Sema/SemaStmt.cpp                      |  1 +
 test/SemaObjC/foreach.m                    | 24 ++++++++++++++++++++++
 4 files changed, 36 insertions(+)

diff --git a/include/clang/Basic/DiagnosticSemaKinds.td b/include/clang/Basic/DiagnosticSemaKinds.td
index 3912a85491..6cb872cc27 100644
--- a/include/clang/Basic/DiagnosticSemaKinds.td
+++ b/include/clang/Basic/DiagnosticSemaKinds.td
@@ -5000,6 +5000,8 @@ def note_protected_by_if_available : Note<
   "jump enters controlled statement of if available">;
 def note_protected_by_vla : Note<
   "jump bypasses initialization of variable length array">;
+def note_protected_by_objc_fast_enumeration : Note<
+  "jump enters Objective-C fast enumeration loop">;
 def note_protected_by_objc_try : Note<
   "jump bypasses initialization of @try block">;
 def note_protected_by_objc_catch : Note<
diff --git a/lib/Sema/JumpDiagnostics.cpp b/lib/Sema/JumpDiagnostics.cpp
index 899d3fa83c..865aea9e22 100644
--- a/lib/Sema/JumpDiagnostics.cpp
+++ b/lib/Sema/JumpDiagnostics.cpp
@@ -287,6 +287,15 @@ void JumpScopeChecker::BuildScopeInformation(Stmt *S,
     IndirectJumpTargets.push_back(cast<AddrLabelExpr>(S)->getLabel());
     break;
 
+  case Stmt::ObjCForCollectionStmtClass: {
+    auto *CS = cast<ObjCForCollectionStmt>(S);
+    unsigned Diag = diag::note_protected_by_objc_fast_enumeration;
+    unsigned NewParentScope = Scopes.size();
+    Scopes.push_back(GotoScope(ParentScope, Diag, 0, S->getLocStart()));
+    BuildScopeInformation(CS->getBody(), NewParentScope);
+    return;
+  }
+
   case Stmt::IndirectGotoStmtClass:
     // "goto *&&lbl;" is a special case which we treat as equivalent
     // to a normal goto.  In addition, we don't calculate scope in the
diff --git a/lib/Sema/SemaStmt.cpp b/lib/Sema/SemaStmt.cpp
index 9be1c56f06..9ffc23b5ad 100644
--- a/lib/Sema/SemaStmt.cpp
+++ b/lib/Sema/SemaStmt.cpp
@@ -1783,6 +1783,7 @@ StmtResult
 Sema::ActOnObjCForCollectionStmt(SourceLocation ForLoc,
                                  Stmt *First, Expr *collection,
                                  SourceLocation RParenLoc) {
+  getCurFunction()->setHasBranchProtectedScope();
 
   ExprResult CollectionExprResult =
     CheckObjCForCollectionOperand(ForLoc, collection);
diff --git a/test/SemaObjC/foreach.m b/test/SemaObjC/foreach.m
index 91ea2ec4e0..477c4fc383 100644
--- a/test/SemaObjC/foreach.m
+++ b/test/SemaObjC/foreach.m
@@ -55,3 +55,27 @@ void test2(NSObject<NSFastEnumeration> *collection) {
   for (obj.prop in collection) { /* expected-error {{selector element is not a valid lvalue}} */
   }
 }
+
+int cond();
+
+void test3(NSObject<NSFastEnumeration> *a0, NSObject<NSFastEnumeration> *a1) {
+  for (id i in a0) { /* expected-note 2 {{jump enters Objective-C fast enumeration loop}} */
+    for (id j in a1) { /* expected-note 2 {{jump enters Objective-C fast enumeration loop}} */
+      (void)i, (void)j;
+label0:
+      if (cond())
+        goto label1;
+    }
+label1:
+    if (cond())
+      goto label0; /* expected-error {{cannot jump from this goto statement to its label}} */
+    if (cond())
+      goto label2;
+  }
+
+label2:
+  if (cond())
+    goto label0; /* expected-error {{cannot jump from this goto statement to its label}} */
+  if (cond())
+    goto label1; /* expected-error{{cannot jump from this goto statement to its label}} */
+}
-- 
2.40.0