[clang] [analyzer] Implemented the DanglingPtrDeref checker to detect use-after-scope lifetime errors (PR #206460)

[Balázs Benics via cfe-commits]

================
@@ -46,33 +47,31 @@ void ReportDanglingPtrDeref::checkLocation(SVal Loc, bool 
IsLoad, const Stmt *S,
 
   if (const MemRegion *LocRegion = Loc.getAsRegion()) {
     if (lifetime_modeling::isDeallocated(State, LocRegion)) {
-      if (ExplodedNode *N =
-              C.generateNonFatalErrorNode(C.getState(), C.getPredecessor()))
-        reportUseAfterScope(LocRegion, N, C);
+      if (ExplodedNode *N = C.generateNonFatalErrorNode(State))
+        reportUseAfterScope(LocRegion, Loc, N, C);
     }
   }
 }
 
 void ReportDanglingPtrDeref::reportUseAfterScope(const MemRegion *Region,
-                                                 ExplodedNode *N,
+                                                 SVal Val, ExplodedNode *N,
                                                  CheckerContext &C) const {
   auto BR = std::make_unique<PathSensitiveBugReport>(
       BugMsg,
       (llvm::Twine("Use of '") + Region->getString() +
-       "' after its lifetime ended.")
-          .str(),
+       "' after its lifetime ended."),
       N);
+  BR->addVisitor(
+      std::make_unique<ReportDanglingPtrDerefBRVisitor>(Val, Region));
   C.emitReport(std::move(BR));
 }
 
 PathDiagnosticPieceRef
-ReportDanglingPtrDeref::ReportDanglingPtrDerefBRVisitor::VisitNode(
-    const ExplodedNode *N, BugReporterContext &BRC,
-    PathSensitiveBugReport &BR) {
-  if (!lifetime_modeling::isBoundToLifetimeSourceSet(N->getState(),
-                                                     BoundRegion) ||
-      lifetime_modeling::isBoundToLifetimeSourceSet(
-          N->getFirstPred()->getState(), BoundRegion))
+ReportDanglingPtrDerefBRVisitor::VisitNode(const ExplodedNode *N,
+                                           BugReporterContext &BRC,
+                                           PathSensitiveBugReport &BR) {
+  if (!isBoundToLifetimeSourceSet(N->getState(), BoundRegion) ||
+      isBoundToLifetimeSourceSet(N->getFirstPred()->getState(), BoundRegion))
----------------
steakhal wrote:

I think the root node might not have a pred. So I think we should check it.

https://github.com/llvm/llvm-project/pull/206460
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits