[llvm-branch-commits] [clang] [analyzer] Only bind aggregate lifetime sources in LifetimeModeling for annotated functions (PR #214824)

[Benedek Kaibas via llvm-branch-commits]

https://github.com/benedekaibas updated https://github.com/llvm/llvm-project/pull/214824

>From d7a3105f75ffaab7968df8670d0ded7224c6d7cf Mon Sep 17 00:00:00 2001
From: benedekaibas <kaibas01 at allegheny.edu>
Date: Fri, 7 Aug 2026 15:22:52 +0200
Subject: [PATCH] [analyzer] Only bind aggregate lifetime sources in
 LifetimeModeling for annotated functions

---
 .../Checkers/LifetimeModeling.cpp             | 21 +++++++++---
 clang/test/Analysis/lifetime-bound.cpp        | 32 +++++++++++++++++++
 2 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/clang/lib/StaticAnalyzer/Checkers/LifetimeModeling.cpp b/clang/lib/StaticAnalyzer/Checkers/LifetimeModeling.cpp
index 882c90d10d72a..1f359d5f35cf6 100644
--- a/clang/lib/StaticAnalyzer/Checkers/LifetimeModeling.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/LifetimeModeling.cpp
@@ -167,6 +167,17 @@ lifetime_modeling::getRegionsFromAggrVal(SVal Val, CheckerContext &C) {
   return {};
 }
 
+static bool isAnnotated(const FunctionDecl *FD) {
+  for (const ParmVarDecl *PVD : FD->parameters()) {
+    if (PVD->hasAttr<LifetimeBoundAttr>())
+      return true;
+  }
+
+  if (lifetimes::implicitObjectParamIsLifetimeBound(FD))
+    return true;
+  return false;
+}
+
 void LifetimeModeling::checkPostCall(const CallEvent &Call,
                                      CheckerContext &C) const {
   ProgramStateRef State = C.getState();
@@ -180,11 +191,13 @@ void LifetimeModeling::checkPostCall(const CallEvent &Call,
     return;
 
   SVal RetVal = Call.getReturnValue();
-  SmallVector<const MemRegion *, 4> AggrRegs =
-      lifetime_modeling::getRegionsFromAggrVal(RetVal, C);
 
-  for (const MemRegion *I : AggrRegs) {
-    State = bindSource(State, RetVal, I);
+  if (isAnnotated(FD)) {
+    SmallVector<const MemRegion *, 4> AggrRegs =
+        lifetime_modeling::getRegionsFromAggrVal(RetVal, C);
+    for (const MemRegion *I : AggrRegs) {
+      State = bindSource(State, RetVal, I);
+    }
   }
 
   for (const ParmVarDecl *PVD : FD->parameters()) {
diff --git a/clang/test/Analysis/lifetime-bound.cpp b/clang/test/Analysis/lifetime-bound.cpp
index 749f264fe53eb..c421ba17325d4 100644
--- a/clang/test/Analysis/lifetime-bound.cpp
+++ b/clang/test/Analysis/lifetime-bound.cpp
@@ -471,3 +471,35 @@ IntPtrArr return_array_field_not_yet_detected() {
   // expected-note at -2    {{Address of stack memory associated with local variable 'z' returned to caller}}
   // expected-warning at -3 {{address of stack memory associated with local variable 'z' returned}}
 }
+
+struct Hold {
+  int *ptr;
+};
+
+Hold retPtr(int &x) {
+  return Hold{&x};
+}
+// Even though there is a lifetime error in the function
+// UseAfterLifetimeEnd should not emit a warning for this
+// case since there is no annotation present in the code.
+// The warning present in the test comes from core.StackAddressEscape
+// checker.
+Hold return_by_val_no_ann() {
+  int num = 4;
+  return retPtr(num);
+  // expected-warning at -1 {{Address of stack memory associated with local variable 'num' returned to caller}}
+  // expected-note at -2    {{Address of stack memory associated with local variable 'num' returned to caller}}
+}
+
+int *unwrap(Hold i [[clang::lifetimebound]]) { return i.ptr; }
+
+// FIXME: If an annotated argument is a by-value struct then
+// Arg.getAsRegion() returns null for CompoundVal/LazyCompoundVal
+// and the dangling pointer will not be detected.
+int *arg_aggregate_lifetimebound() {
+  int local_num = 5;
+  Hold h{&local_num};
+  return unwrap(h);
+  // expected-warning at -1 {{Address of stack memory associated with local variable 'local_num' returned to caller}}
+  // expected-note at -2    {{Address of stack memory associated with local variable 'local_num' returned to caller}}
+}