[llvm-branch-commits] [clang] [analyzer] Only bind aggregate lifetime sources in LifetimeModeling for annotated functions (PR #214824)

[Balázs Benics via llvm-branch-commits]

================
@@ -471,3 +471,35 @@ IntPtrArr return_array_field_not_yet_detected() {
   // expected-note at -2    {{Address of stack memory associated with local variable 'z' returned to caller}}
   // expected-warning at -3 {{address of stack memory associated with local variable 'z' returned}}
 }
+
+struct Hold {
+  int *ptr;
+};
+
+Hold retPtr(int &x) {
+  return Hold{&x};
+}
+// Even though there is a lifetime error in the function
+// UseAfterLifetimeEnd should not emit a warning for this
+// case since there is no annotation present in the code.
+// The warning present in the test comes from core.StackAddressEscape
+// checker.
+Hold return_by_val_no_ann() {
+  int num = 4;
+  return retPtr(num);
+  // expected-warning at -1 {{Address of stack memory associated with local variable 'num' returned to caller}}
+  // expected-note at -2    {{Address of stack memory associated with local variable 'num' returned to caller}}
+}
+
+int *unwrap(Hold i [[clang::lifetimebound]]) { return i.ptr; }
+
+// FIXME: If an annotated argument is a by-value struct then
+// Arg.getAsRegion() returns null for CompoundVal/LazyCompoundVal
+// and the dangling pointer will not be detected.
+int *arg_aggregate_lifetimebound() {
+  int local_num = 5;
+  Hold h{&local_num};
+  return unwrap(h);
----------------
steakhal wrote:

I think the FIXME mislead me believing that the CSA checker is not able to find this. That was surprising to me, thus raised this. Now that the fixme is gone and the checker actually reports there I'll close this thread.

https://github.com/llvm/llvm-project/pull/214824