[all-commits] [llvm/llvm-project] 6a7f6a: [analyzer] Implement BugReporterVisitor for UseAft...

[Benedek Kaibas via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 6a7f6a02bb95a75c615cde3194ad77d776b869c5
      https://github.com/llvm/llvm-project/commit/6a7f6a02bb95a75c615cde3194ad77d776b869c5
  Author: Benedek Kaibas <82393336+benedekaibas at users.noreply.github.com>
  Date:   2026-08-03 (Mon, 03 Aug 2026)

  Changed paths:
    M clang/lib/StaticAnalyzer/Checkers/LifetimeModeling.cpp
    M clang/lib/StaticAnalyzer/Checkers/LifetimeModeling.h
    M clang/lib/StaticAnalyzer/Checkers/UseAfterLifetimeEnd.cpp
    M clang/test/Analysis/lifetime-bound.cpp

  Log Message:
  -----------
  [analyzer] Implement BugReporterVisitor for UseAfterLifetimeEnd to trace lifetime source binding (#207052)

Currently the `UseAfterLifetimeEnd` checker can emit warnings, but those
warnings cannot clearly describe to which annotated parameter the return
value is actually bound. When multiple parameters are annotated, it is
unclear which one the return value is bound to. Using
`BugReporterVisitor` to trace back the nodes and emit a note that
explains where the lifetime of the annotated parameter (the source)
ended can be helpful for users.

***NOTE***: This PR is built on #205951. It should only be merged after
#205951 is merged.

Consider the following case: 

```cpp
#include <stddef.h>

class Arena {
  char buf[128];
  char *buffer = buf;
  size_t offset = 0;

public:
  void *allocate(size_t size) [[clang::lifetimebound]] {
    void *p = buffer + offset;
    offset += size;
    return p;
  }
  void reset() {offset = 0;}
};

void *arena_dangling() {
  Arena arena;
  void *p = arena.allocate(128);
  arena.reset();
  return p; // arena goes out of scope therefore p dangles
}
```

The `UseAfterLifetimeEnd` checker correctly detects this error and emits
path notes that trace where the value was bound and where its lifetime
ends:

```text
temp.cpp:21:3: warning: Returning value bound to 'arena' that will go out of scope [alpha.cplusplus.UseAfterLifetimeEnd]
   21 |   return p;
      |   ^~~~~~~~
temp.cpp:19:13: note: Value bound to 'arena' here
   19 |   void *p = arena.allocate(128);
      |             ^~~~~~~~~~~~~~~~~~~
temp.cpp:21:3: note: Lifetime of 'arena' ended here
   21 |   return p;
      |   ^~~~~~~~
1 warning generated.
```

The motivating example comes from here:
https://discourse.llvm.org/t/clang-static-analyzer-gsoc-2025-teach-the-clang-static-analyzer-to-understand-lifetime-annotations/84487/41?u=bkaibas01



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications