in `clang-analyzer`, `StackAddressEscape` has problems with user-declared destructors

[jmcclellan-figma]

The following code:

struct A {
  int& x;
};

struct B {
  A a;
  ~B() {}
  B(A a) : a{a} {}
};

static B getA() {
  int x;
  return B{A{.x = x}};
}

incorrectly passes clang tidy with --checks=clang-analyzer-core.StackAddressEscape.

However, this very similar code correctly triggers the warning.

struct A {
  int& x;
};

struct B {
  A a;
  B(A a) : a{a} {}
};

static B getA() {
  int x;
  return B{A{.x = x}};
}

[llvmbot]

@llvm/issue-subscribers-clang-static-analyzer

Author: Russell McClellan (jmcclellan-figma)

The following code:

struct A {
  int& x;
};

struct B {
  A a;
  B(A a) : a{a} {}
  ~B();
};

static B getA() {
  int x;
  return B{A{.x = x}};
}

B::~B() = default;

incorrectly passes clang tidy with --checks=clang-analyzer-core.StackAddressEscape.

However, this very similar code correctly triggers the warning.

struct A {
  int& x;
};

struct B {
  A a;
  B(A a) : a{a} {}
};

static B getA() {
  int x;
  return B{A{.x = x}};
}

[steakhal]

Fair point. One would need to hop into a debugger and see why the StackAddrEscapeChecker::checkPreStmt doesn't find this.

FWIW the CFG looks different in the two scenario, which might have a part in this:

In case B dtor is defaulted within the class:

 [B1]
   1: int x;
   2: x
   3: {.x = [B1.2]}
   4: A[B1.3] (CXXFunctionalCastExpr, NoOp, A)
   5: B{[B1.4]} (CXXConstructExpr, [B1.6], B)
   6: return [B1.5];

In case B dtor is defaulted outside of the class:

 [B1]
   1: int x;
   2: x
   3: {.x = [B1.2]}
   4: A[B1.3] (CXXFunctionalCastExpr, NoOp, A)
   5: B{[B1.4]} (CXXConstructExpr, [B1.7], [B1.6], B)
   6: [B1.5] (BindTemporary)
   7: return [B1.6];

Notice the BindTemporary step in the latter.