[clang] [analyzer] Detect leak of a stack address through output arguments 2/3 (PR #105653)

[Donát Nagy via cfe-commits]

================
@@ -297,20 +314,29 @@ std::optional<std::string> printReferrer(const MemRegion *Referrer) {
       return "global";
     assert(isa<StackSpaceRegion>(Space));
     return "stack";
-  }(Referrer->getMemorySpace());
-
-  // We should really only have VarRegions here.
-  // Anything else is really surprising, and we should get notified if such
-  // ever happens.
-  const auto *ReferrerVar = dyn_cast<VarRegion>(Referrer);
-  if (!ReferrerVar) {
-    assert(false && "We should have a VarRegion here");
-    return std::nullopt; // Defensively skip this one.
+  }(getStackOrGlobalSpaceRegion(Referrer));
+
+  while (!Referrer->canPrintPretty()) {
+    if (const auto *SymReg = dyn_cast<SymbolicRegion>(Referrer)) {
+      Referrer = SymReg->getSymbol()->getOriginRegion()->getBaseRegion();
+    } else if (isa<CXXThisRegion>(Referrer)) {
+      // Skip members of a class, it is handled by
+      // warn_bind_ref_member_to_parameter_addr
----------------
NagyDonat wrote:

I see, it seems that `CheckExprLifetime.cpp` was probably refactored, because the message that you reference does not appear and instead there are two very similarly named messages:

![image](https://github.com/user-attachments/assets/d1384f02-d375-4d5c-9469-a77b5f58bb32)

https://github.com/llvm/llvm-project/blame/f53bfa39a7dae444650a9c0e16d52301a733f5fc/clang/lib/Sema/CheckExprLifetime.cpp#L1166

You should probably update the name `warn_bind_ref_member_to_parameter_addr` to either `warn_bind_ref_member_to_parameter` or `warn_init_ptr_member_to_parameter_addr` (whichever is the right one) _and_ also mention `CheckExprLifetime.cpp` as a less accurate but more robust reference.

https://github.com/llvm/llvm-project/pull/105653