[clang] [analyzer] Implemented the DanglingPtrDeref checker to detect use-after-scope lifetime errors (PR #209278)

Benedek Kaibas via cfe-commits cfe-commits at lists.llvm.org
Tue Jul 14 05:46:17 PDT 2026


================
@@ -0,0 +1,86 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.cplusplus.ReportDanglingPtrDeref \
+// RUN:   -analyzer-config cfg-lifetime=true -analyzer-output=text -verify %s
+
+void test_case_one() {
+  int *ptr = nullptr;
+  {
+    int num = 5;
+    ptr = #
+  }
+  // expected-note at -1 {{'num' is destroyed here}}
+  *ptr = 6;
+  // expected-warning at -1 {{Use of 'num' after its lifetime ended}}
+  // expected-note at -2    {{Use of 'num' after its lifetime ended}}
+}
+
+void test_case_two() {
+  int *ptr_one = nullptr;
+  int *ptr_two = nullptr;
+  {
+    int n = 1;
+    int m = 2;
+    ptr_one = &n;
+    ptr_two = &m;
+  }
+  // expected-note at -1 {{'n' is destroyed here}}
+  // expected-note at -2 {{'m' is destroyed here}}
+  *ptr_one = 6;
+  *ptr_two = 7; 
+  // expected-warning at -2 {{Use of 'n' after its lifetime ended}}
+  // expected-note at -3    {{Use of 'n' after its lifetime ended}}
----------------
benedekaibas wrote:

I agree that the note can feel as a duplicate of the warning, but it is needed for cases where the destruction point and the point of the dangling reference are different locations. It might seem confusing in the test suite for some cases, but I think we should not change it.

https://github.com/llvm/llvm-project/pull/209278


More information about the cfe-commits mailing list