[clang] [analyzer] Detect dangling pointers passed to function calls (PR #211045)

[Balázs Benics via cfe-commits]

steakhal wrote:

> > Feel free to leave `recieve` opaque.
> 
> I have simplified it, the checker still does not detect the dangling pointer. I have also built the exploded graph for it. <img alt="Screenshot 2026-07-21 at 21 45 16" width="631" height="376" src="https://private-user-images.githubusercontent.com/82393336/624687024-3c8a615d-dcb1-489e-823e-f919719038b1.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODQ3MjA1OTcsIm5iZiI6MTc4NDcyMDI5NywicGF0aCI6Ii84MjM5MzMzNi82MjQ2ODcwMjQtM2M4YTYxNWQtZGNiMS00ODllLTgyM2UtZjkxOTcxOTAzOGIxLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNjA3MjIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjYwNzIyVDExMzgxN1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTQ2OGJkNTQ0MWQ2ZWY2YWI5MWM5ZTJkYzhhZjI1OTVmNTI0MGE3ZWYyNWZiNmEwOWFiYjkxNzBiZGQ2ZGYxNjQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JnJlc3BvbnNlLWNvbnRlbnQtdHlwZT1pbWFnZSUyRnBuZyJ9.g4ZEM108qBRznKK2qtk3xINlKmtFZRS3ZcBmDdVBK0U">
> 
> I think in order to handle these cases the checker should "see inside" the struct and then walk the fields. If a given field is related to lifetime analysis (pointer/reference type fields) then check if they point to deallocated region.

This is the by value struct case, thus falls into the LCV bucket. Just leave a fixme there.

https://github.com/llvm/llvm-project/pull/211045