[clang] [analyzer] Implement BugReporterVisitor for UseAfterLifetimeEnd to trace lifetime source binding (PR #207052)

[Gábor Horváth via cfe-commits]

================
@@ -51,10 +101,68 @@ void UseAfterLifetimeEnd::reportDanglingSource(const MemRegion *Source,
       (llvm::Twine("Returning value bound to ") +
        lifetime_modeling::getRegionName(Source) + " that will go out of scope"),
       N);
+
+  if (SourceRange Range = getRegionDeclRange(Source); Range.isValid())
+    BR->addRange(Range);
+
+  BR->addVisitor<UseAfterLifetimeEndBRVisitor>(RetVal, Source);
   bugreporter::trackStoredValue(RetVal, Source, *BR);
   C.emitReport(std::move(BR));
 }
 
+PathDiagnosticPieceRef UseAfterLifetimeEndBRVisitor::createSourcePiece(
+    const ExplodedNode *N, BugReporterContext &BRC, StringRef Message) const {
+  const Stmt *S = N->getStmtForDiagnostics();
+  if (!S)
+    return nullptr;
+
+  const Expr *RetExpr = dyn_cast_or_null<Expr>(S);
+  const Expr *Arg = getLifetimeBoundArg(RetExpr);
----------------
Xazax-hun wrote:

This only returns the first lifetimebound arg. I wonder if we need to generalise this since the first might not be the one that is problematic. Maybe the second one was the one that is out of scope and the first is fine. Do you have a test for that case? Could potentially be a follow up. 

https://github.com/llvm/llvm-project/pull/207052