[clang] [analyzer] Match dangling subobjects by their base region in DanglingPtrDeref (PR #211552)

Benedek Kaibas via cfe-commits cfe-commits at lists.llvm.org
Thu Jul 23 07:04:27 PDT 2026


================
@@ -66,13 +66,21 @@ void DanglingPtrDeref::checkPostCall(const CallEvent &Call,
   }
 }
 
+static std::string getRegionName(const MemRegion *Reg) {
+  // FIXME: Once the checker supports heap allocation, more region kinds
+  // should be handled to produce the correct descriptive name.
+  if (const std::string RegName = Reg->getDescriptiveName(); !RegName.empty())
+    return RegName;
+  return "the region";
+}
+
 void DanglingPtrDeref::reportUseAfterScope(const MemRegion *Region,
                                            ExplodedNode *N,
                                            CheckerContext &C) const {
   auto BR = std::make_unique<PathSensitiveBugReport>(
       BugMsg,
-      (llvm::Twine("Use of '") + Region->getString() +
-       "' after its lifetime ended."),
+      (llvm::Twine("Use of ") + getRegionName(Region) +
+       " after its lifetime ended."),
----------------
benedekaibas wrote:

`getString` also had problem printing region vs. base region, so I decided to switch to `getDescriptiveName()`, but when I ran the tests I saw that I cannot just use it on the `Region` variable in this function (it returns an emptry string for regions it cannot print). `ArrayBoundChecker` helped a lot to understand the whole structure.

https://github.com/llvm/llvm-project/pull/211552


More information about the cfe-commits mailing list