<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/106834>106834</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            `clang-analyzer-core.StackAddressEscape` false-positive
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          zufuliu
      </td>
    </tr>
</table>

<pre>
    https://godbolt.org/z/Yqr53rz4s

```cpp
extern void copy(char *output, const char *input, unsigned size);
extern bool foo(const char *input);
extern void bar(char *output, unsigned count);
extern bool baz(char *output, const char *input);

void repo(const char *input, char *output) {
    char temp[64];
 copy(temp, input, sizeof(temp));

    char result[64];
    input = temp;
    if (foo(temp)) {
        bar(result, sizeof(result));
 input = result;
    }
    if (!baz(output, input)) {
 copy(output, input, sizeof(result));
 }
}
```

```
<source>:16:5: warning: Address of stack memory associated with local variable 'temp' is still referred to by the caller variable 'input' upon returning to the caller.  This will be a dangling reference [clang-analyzer-core.StackAddressEscape]
    7 |     char temp[64];
      |     ~~~~~~~~~~~~~
    8 |     copy(temp, input, sizeof(temp));
    9 | 
   10 |     char result[64];
   11 | input = temp;
   12 |     if (foo(temp)) {
   13 |         bar(result, sizeof(result));
   14 |         input = result;
   15 |     }
   16 |     if (!baz(output, input)) {
      |     ^
[<source>:12:9: note: Assuming the condition is false](javascript:;)
   12 |     if (foo(temp)) {
      |         ^~~~~~~~~
[<source>:12:5: note: Taking false branch](javascript:;)
   12 |     if (foo(temp)) {
      | ^
[<source>:16:9: note: Assuming the condition is false](javascript:;)
 16 |     if (!baz(output, input)) {
      | ^~~~~~~~~~~~~~~~~~~
[<source>:16:5: note: Taking false branch](javascript:;)
   16 |     if (!baz(output, input)) {
      | ^
<source>:16:5: note: Address of stack memory associated with local variable 'temp' is still referred to by the caller variable 'input' upon returning to the caller.  This will be a dangling reference
    7 | char temp[64];
      |     ~~~~~~~~~~~~~
    8 |     copy(temp, input, sizeof(temp));
    9 | 
   10 |     char result[64];
   11 | input = temp;
   12 |     if (foo(temp)) {
   13 |         bar(result, sizeof(result));
   14 |         input = result;
   15 |     }
   16 |     if (!baz(output, input)) {
      |     ^
1 warning generated.
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzsV82SozYQfhr50mUXSGDgwME_6xfIXnIUorG1KyMiCU_sQ549JcDYeMY7U1OTQ1KhphiQur_-1P21jLi1cl8j5iRek3g74607aJNf2qpVsp0VujznB-caS9iK0B2hu70uC63cQps9obsLobvf_zAxM5fIkmBLgtVwXwb9n2iafgT_dGhqOGlZgtDNmdBUHLgBQle6dU3rCN2A0LV1cB2X9TDc1h3NEqy8IKEZYesJaKG1gkprj_kWwiuHjkXBzZskxmhCt_Vb3l24gl8-voQbRH_v4htsnjLewCNyBiQZMACgn3Z4bEi8XkYk3o4RrtntJukGRkSfPF2NM9lrWiOwQdsq9xoaoIcDwrZ99MlUBYSmfR1uMaa8_dUnfohxT-w6NKF2F3GYv49Jku0jAULDvji3ooxlmNAZEvXK7F1GY9Dbw1XvbzbB8Mo2VrdGIGHfCFuFS8JWMWEreOGmlvXeP67K0qC1oCuwjoufcMSjNmfg1mohucMSXqQ7gNKCKzhxI3mhEAhN-oQnIC1YJ5UCgxUagyU4DcUZ3AFBcKXQTNyGJSfQNroGg67tuHinm8cC4PtBWnjxuAUCh5LXe-XtuihYCwQSr4Xi9X7Oa67OFzRzoQ0ufvPLGJb1zQreoFfUWLIESLKBdxQNfaV7u7_ur5tBegP6hP69X9YhjO9hMKX2vCfCsLN83hkhHaE-0CMhG60_0S0AYTTx_1X7hPFoet9I4fKB74dbalIpEn8blB-vH8VPCVtlXvG1dtgp39r22CnPy07XpXRS117OFVe2Ew1Nf_ATt8LIxvkfJLb28T-X5DuaA9WppJ5Qju8pf-c_PeGOHxSG1-LwD9H8VSaXX5zJLyj-XTYfW_XJAr4gr19C-52dekzxv3abftx5_991_7O7bnj9sIA91mi8KhcPHyazMmdlxjI-wzxMaBxkLKLx7JDTYEnjJEhSJjApoirNeClYFhThMhBRGM5kTgMaBSkLg5QlQbyIU54IjKlAjLGiFYkCPHKpFkqdjv64MJPWtpiHwTJl0UzxApXtzh2U1vgC3Syh1B9DTO6d5kW7tyQKlLTO3mCcdApzf7T42NfGMuh3knmjrXTyhLPWqMdTjXSHtlgIfSR05yMN_-aN0T9QOEJ3HT9L6G5YwCmnfwcAAP__hKrHrQ">