Analyzer should catch return of local address even when address passed through function

[llvmbot]

Bugzilla Link	10754
Version	trunk
OS	Linux
Reporter	LLVM Bugzilla Contributor
CC	@efriedma-quic,@tkremenek

Extended Description

Take the following code:

int &foo(); long const &nop(long const &l) { return l; } long const returns_temp_missed() { return &nop(foo()); // temp object created } long const returns_temp_caught() { long const &lr = foo(); // temp object created. return &lr; }

Both returns_temp functions optimize to the same code, but clang --analyze only catches the second one.

We've caught two instances of this recently when gcc's DCE pass deleted the initialization of the local variable whose address was returned, and then its -Wuninitialized warning complained, in the calling function, that was used without initialization. Clang should be able to give us a better warning than that.

[tkremenek]

Another case of "we don't do any interprocedural analysis".

More specifically, context-sensitive interprocedural analysis.

[efriedma-quic]

Another case of "we don't do any interprocedural analysis".

[llvmbot]

assigned to @tkremenek