[llvm-branch-commits] [clang] [analyzer] Add aggregate lifetime source binding to DanglingPtrDeref (PR #214825)

[Benedek Kaibas via llvm-branch-commits]

https://github.com/benedekaibas updated https://github.com/llvm/llvm-project/pull/214825

>From c845a70ed69fcf0908a208c5a0736192f35e71c2 Mon Sep 17 00:00:00 2001
From: benedekaibas <kaibas01 at allegheny.edu>
Date: Fri, 7 Aug 2026 20:41:27 +0200
Subject: [PATCH] [analyzer] Add aggregate lifetime source binding to
 DanglingPtrDeref

---
 clang/lib/StaticAnalyzer/Checkers/DanglingPtrDeref.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/clang/lib/StaticAnalyzer/Checkers/DanglingPtrDeref.cpp b/clang/lib/StaticAnalyzer/Checkers/DanglingPtrDeref.cpp
index bd4cd864cb768..5161561dab2a3 100644
--- a/clang/lib/StaticAnalyzer/Checkers/DanglingPtrDeref.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/DanglingPtrDeref.cpp
@@ -59,6 +59,14 @@ void DanglingPtrDeref::checkPostCall(const CallEvent &Call,
     return;
 
   for (unsigned Idx = 0; Idx < Call.getNumArgs(); Idx++) {
+    SmallVector<const MemRegion *, 4> AggrRegs =
+        lifetime_modeling::getRegionsFromAggrVal(Call.getArgSVal(Idx), C);
+    for (const MemRegion *I : AggrRegs) {
+      if (lifetime_modeling::isDeallocated(State, I))
+        if (ExplodedNode *N = C.generateNonFatalErrorNode())
+          reportUseAfterScope(I, Call.getArgExpr(Idx), N, C);
+    }
+
     if (const MemRegion *ArgRegion = Call.getArgSVal(Idx).getAsRegion())
       if (lifetime_modeling::isDeallocated(State, ArgRegion))
         if (ExplodedNode *N = C.generateNonFatalErrorNode())