[clang] [analyzer] Implemented the DanglingPtrDeref checker to detect use-after-scope lifetime errors (PR #209278)

Balázs Benics via cfe-commits cfe-commits at lists.llvm.org
Mon Jul 13 13:52:11 PDT 2026


================
@@ -97,10 +113,37 @@ void LifetimeModeling::checkPostCall(const CallEvent &Call,
   C.addTransition(State);
 }
 
+void LifetimeModeling::checkLifetimeEnd(const VarDecl *VD,
+                                        CheckerContext &C) const {
+  ProgramStateRef State = C.getState();
+  if (!VD)
+    return;
+
+  SVal SourceVal = State->getLValue(VD, C.getStackFrame());
+  if (const MemRegion *SourceValRegion = SourceVal.getAsRegion()) {
+    State = State->add<DeallocatedSourceSet>(SourceValRegion);
+    C.addTransition(State);
+  }
+}
+
+void LifetimeModeling::checkPreStmt(const DeclStmt *DS,
+                                    CheckerContext &C) const {
+  ProgramStateRef State = C.getState();
+  for (const auto *I : DS->decls()) {
+    if (const VarDecl *VD = dyn_cast<VarDecl>(I)) {
----------------
steakhal wrote:

We filter out BindingDecls here. That is the "variable name" inside structured bindings (DecompositionDecl). Have a look at the AST for structured bindings. Although, probably the best is to create a card for it on your project board and address this later in a dedicated patch.

https://github.com/llvm/llvm-project/pull/209278


More information about the cfe-commits mailing list