[analyzer] Differentiate lifetime extended temporaries

[tomasz-kaminski-sonarsource]

Summary

This patch introduces a new CXXLifetimeExtendedObjectRegion as a representation
of the memory for the temporary object that is lifetime extended by the reference
to which they are bound.

This separation provides an ability to detect the use of dangling pointers
(either binding or dereference) in a robust manner.
For example, the ref is conditionally dangling in the following example:

template<typename T>
T const& select(bool cond, T const& t, T const& u) { return cond ? t : u; }

int const& le = Composite{}.x;
auto&& ref = select(cond, le, 10);

Before the change, regardless of the value of cond, the select() call would
have returned a temp_object region.
With the proposed change we would produce a (non-dangling) lifetime_extended_object
region with lifetime bound to le or a temp_object region for the dangling case.

We believe that such separation is desired, as such lifetime extended temporaries
are closer to the variables. For example, they may have a static storage duration
(this patch removes a static temporary region, which was an abomination).
We also think that alternative approaches are not viable.

While for some cases it may be possible to determine if the region is lifetime
extended by searching the parents of the initializer expr, this quickly becomes
complex in the presence of the conditions operators like this one:

Composite cc;
// Ternary produces prvalue 'int' which is extended, as branches differ in value category
auto&& x = cond ? Composite{}.x : cc.x;

// Ternary produces xvalue, and extends the Composite object
auto&& y = cond ? Composite{}.x : std::move(cc).x;

Finally, the lifetime of the CXXLifetimeExtendedObjectRegion is tied to the lifetime of
the corresponding variables, however, the "liveness" (or reachability) of the extending
variable does not imply the reachability of all symbols in the region.
In conclusion CXXLifetimeExtendedObjectRegion, in contrast to VarRegions, does not
need any special handling in SymReaper.

RFC: https://discourse.llvm.org/t/rfc-detecting-uses-of-dangling-references/70731

[steakhal]

Please leave a link in the summary to the RFC to discuss.

[xazax.hun]

I generally support the idea of a CXXLifetimeExtendedObj region, definitely cleaner than a CXXTempObjectRegion with static lifetime.

[NoQ]

I totally support this! There's no reason why the region wouldn't carry such information.

This patch is surprisingly tiny, but this matches my grep observations: almost nothing in the static analyzer treats CXXTempObjectRegion specially. Even in case of live symbols/regions analysis, it simply relies on how temporary region is bound in the Store to the lifetime-extending reference, so it doesn't need to be handled explicitly.

I see that there's no change in MoveChecker which treats CXXTempObjectRegion specially, and I suspect it may start emitting more warnings after this patch, but I'm not sure if it's a good thing or a bad thing. Could be worth experimenting (eg. by analyzing LLVM itself, it has enough move semantics to demonstrate potential problems).

Do you have any preferences on creating a common base class for CXXTempObjectRegion and CXXLifetimeExtendedObjectRegion? Or, as an opposite extreme, simply add a nullable ExD field to CXXTempObjectRegion instead of making a new class? Both could save us some code when these regions do need to be treated uniformly, but it doesn't look like a popular situation to worry about.

[tomasz-kaminski-sonarsource]

In D151325#4374326, @NoQ wrote:

I totally support this! There's no reason why the region wouldn't carry such information.

This patch is surprisingly tiny, but this matches my grep observations: almost nothing in the static analyzer treats CXXTempObjectRegion specially. Even in case of live symbols/regions analysis, it simply relies on how temporary region is bound in the Store to the lifetime-extending reference, so it doesn't need to be handled explicitly.

Indeed. However, I think that this could be a side product of CXXTempObjectRegion not representing actual short lived temporaries.

I see that there's no change in MoveChecker which treats CXXTempObjectRegion specially, and I suspect it may start emitting more warnings after this patch, but I'm not sure if it's a good thing or a bad thing. Could be worth experimenting (eg. by analyzing LLVM itself, it has enough move semantics to demonstrate potential problems).

I have performed our internal test, which includes LLVM, and it has no changes in the results due to this patch.
For the MoveChecker, after inspecting the code I believe that we should exclude only CXXTempObjectsRegions from that checker, as it is certainly possible to perform operations on moved from lifetime extended object.

Do you have any preferences on creating a common base class for CXXTempObjectRegion and CXXLifetimeExtendedObjectRegion? Or, as an opposite extreme, simply add a nullable ExD field to CXXTempObjectRegion instead of making a new class? Both could save us some code when these regions do need to be treated uniformly, but it doesn't look like a popular situation to worry about.

Despite them, both being referred to as temporary, they are very different in nature. Thus I believe they should be considered separately by each checker, thus I prefer them to not be related. This is why I skipped Temp word in the name of the region.
If any, I would group them with VarRegion.

[tomasz-kaminski-sonarsource]

Updated MoveChecker to handle CXXLifetimeExtendedObjects, in this case they need to be handled the same as other VarRegions.

[tomasz-kaminski-sonarsource]

Remove excessive reformating

[tomasz-kaminski-sonarsource]

Fixed formatting to match clang-format

[tomasz-kaminski-sonarsource]

Added function to query stack frame for temporary object.

[tomasz-kaminski-sonarsource]

Rebasing on main

[steakhal]

Ping @NoQ @xazax.hun

[xazax.hun]

Overall looks good to me. I think the changes to the notes already make the analyzer more useful so there are some observable benefits to this patch.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

1282

Do we actually need this Expr in the memory region?

[tomasz-kaminski-sonarsource]

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

1282

Yes they are needed for region identification, as one variable my be lifetime extending multiple temporary.
For illustration consider following example from test:

auto const& viaReference = RefAggregate{10, Composite{}}; // extends `int`, `Composite`, and `RefAggregate`
clang_analyzer_dump(viaReference);    // expected-warning-re {{&lifetime_extended_object{RefAggregate, viaReference, S{{[0-9]+}}} }}
clang_analyzer_dump(viaReference.rx); // expected-warning-re {{&lifetime_extended_object{int, viaReference, S{{[0-9]+}}} }}
clang_analyzer_dump(viaReference.ry); // expected-warning-re {{&lifetime_extended_object{Composite, viaReference, S{{[0-9]+}}} }}

viaReference declaration is extending 3 temporaries, and they get identified by expression.

[tomasz-kaminski-sonarsource]

In D151325#4470832, @xazax.hun wrote:

Overall looks good to me. I think the changes to the notes already make the analyzer more useful so there are some observable benefits to this patch.

Also, user-after-move now correctly detect the use of of move-from lifetime extended temporaries.

[tomasz-kaminski-sonarsource]

Reformatting and link to revelant core issue.

[xazax.hun]

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

1282

Ah, OK. Makes sense, thanks!

[xazax.hun]

clang/lib/StaticAnalyzer/Checkers/MoveChecker.cpp

556

I think strictly speaking this might be "unsound" resulting in false positives in scenarios like:

void f(bool reset) {
  static T&& extended = getTemp();
  if (reset) {
    extended = getTemp();
    return;
  }
  consume(std::move(extended));
  f(true);
  extended.use();
}

In case the call to f(true) is not inlined (or in other cases there is some aliasing the analyzer does not know about), we might not realize that the object is reset and might falsely report a use after move.

But I think this is probably sufficiently rare that we do not care about those.

clang/lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp

101

Is this a good wording for static lifetime extended temporaries?

[tomasz-kaminski-sonarsource]

clang/lib/StaticAnalyzer/Checkers/MoveChecker.cpp

556

Aren't such case already excluded by the isa<StackSpaceRegion>(MR->getMemorySpace()), in a same way as we do for variables?
In such case, we should be creating getCXXStaticLifetimeExtendedObjectRegion so it will not be located on stack.

clang/lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp

101

Lifetime extended static temporaries should never enter here, as they are not in StackSpaceRegion.
Previously we have had CXXStaticTempObjects and now they are turned into CXXStaticLifetimeExtendedObjectRegion.

[xazax.hun]

clang/lib/StaticAnalyzer/Checkers/MoveChecker.cpp

556

Whoops, indeed, sorry.

clang/lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp

101

Ah, my bad.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

 class CXXTempObjectRegion : public TypedValueRegion {
   friend class MemRegionManager;
 
   Expr const *Ex;
 
   CXXTempObjectRegion(Expr const *E, MemSpaceRegion const *sReg)
       : TypedValueRegion(sReg, CXXTempObjectRegionKind), Ex(E) {
     assert(E);
-    assert(isa<StackLocalsSpaceRegion>(sReg) ||
-           isa<GlobalInternalSpaceRegion>(sReg));
+    assert(isa<StackLocalsSpaceRegion>(sReg));
   }
 
   static void ProfileRegion(llvm::FoldingSetNodeID &ID,
                             Expr const *E, const MemRegion *sReg);
 
 public:
   LLVM_ATTRIBUTE_RETURNS_NONNULL
   const Expr *getExpr() const { return Ex; }
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
+  const StackFrameContext *getStackFrame() const;
+
   QualType getValueType() const override { return Ex->getType(); }
 
   void dumpToStream(raw_ostream &os) const override;
 
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 
   static bool classof(const MemRegion* R) {
     return R->getKind() == CXXTempObjectRegionKind;
   }
 };
 
+// C++ temporary object that have lifetime extended to lifetime of the
+// variable. Usually they represent temporary bounds to reference variables.
+class CXXLifetimeExtendedObjectRegion : public TypedValueRegion {
+  friend class MemRegionManager;
+
+  Expr const *Ex;
+  ValueDecl const *ExD;
+
+  CXXLifetimeExtendedObjectRegion(Expr const *E, ValueDecl const *D,
+                                  MemSpaceRegion const *sReg)
+      : TypedValueRegion(sReg, CXXLifetimeExtendedObjectRegionKind), Ex(E),
+        ExD(D) {
+    assert(E);
+    assert(D);
+    assert((isa<StackLocalsSpaceRegion, GlobalInternalSpaceRegion>(sReg)));
+  }
+
+  static void ProfileRegion(llvm::FoldingSetNodeID &ID, Expr const *E,
+                            ValueDecl const *D, const MemRegion *sReg);
+
+public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
+  const Expr *getExpr() const { return Ex; }
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
+  const ValueDecl *getExtendingDecl() const { return ExD; }
+  /// It might return null.
+  const StackFrameContext *getStackFrame() const;
+
+  QualType getValueType() const override { return Ex->getType(); }
+
+  void dumpToStream(raw_ostream &os) const override;
+
+  void Profile(llvm::FoldingSetNodeID &ID) const override;
+
+  static bool classof(const MemRegion *R) {
+    return R->getKind() == CXXLifetimeExtendedObjectRegionKind;
+  }
+};
+
 // CXXBaseObjectRegion represents a base object within a C++ object. It is
 // identified by the base class declaration and the region of its parent object.
 class CXXBaseObjectRegion : public TypedValueRegion {
   friend class MemRegionManager;
 
   llvm::PointerIntPair<const CXXRecordDecl *, 1, bool> Data;
 
   CXXBaseObjectRegion(const CXXRecordDecl *RD, bool IsVirtual,
public:
   ///   to the containing region (which typically represents the Objective-C
   ///   object).
   const ObjCIvarRegion *getObjCIvarRegion(const ObjCIvarDecl *ivd,
                                           const SubRegion* superRegion);
 
   const CXXTempObjectRegion *getCXXTempObjectRegion(Expr const *Ex,
                                                     LocationContext const *LC);
 
+  /// Create a CXXLifetimeExtendedObjectRegion for temporaries which are
+  /// lifetime-extended by local references.
+  const CXXLifetimeExtendedObjectRegion *
+  getCXXLifetimeExtendedObjectRegion(Expr const *Ex, ValueDecl const *VD,
+                                     LocationContext const *LC);
+
+  /// Create a CXXLifetimeExtendedObjectRegion for temporaries which are
+  /// lifetime-extended by *static* references.
+  /// This differs from \ref getCXXLifetimeExtendedObjectRegion(Expr const *,
+  /// ValueDecl const *, LocationContext const *) in the super-region used.
+  const CXXLifetimeExtendedObjectRegion *
+  getCXXStaticLifetimeExtendedObjectRegion(const Expr *Ex, ValueDecl const *VD);
+
   /// Create a CXXBaseObjectRegion with the given base class for region
   /// \p Super.
   ///
   /// The type of \p Super is assumed be a class deriving from \p BaseClass.
   const CXXBaseObjectRegion *
   getCXXBaseObjectRegion(const CXXRecordDecl *BaseClass, const SubRegion *Super,
                          bool IsVirtual);
 
public:
   /// getBlockDataRegion - Get the memory region associated with an instance
   ///  of a block.  Unlike many other MemRegions, the LocationContext*
   ///  argument is allowed to be NULL for cases where we have no known
   ///  context.
   const BlockDataRegion *getBlockDataRegion(const BlockCodeRegion *bc,
                                             const LocationContext *lc,
                                             unsigned blockCount);
 
-  /// Create a CXXTempObjectRegion for temporaries which are lifetime-extended
-  /// by static references. This differs from getCXXTempObjectRegion in the
-  /// super-region used.
-  const CXXTempObjectRegion *getCXXStaticTempObjectRegion(const Expr *Ex);
-
 private:
   template <typename RegionTy, typename SuperTy,
             typename Arg1Ty>
   RegionTy* getSubRegion(const Arg1Ty arg1,
                          const SuperTy* superRegion);
 
   template <typename RegionTy, typename SuperTy,
             typename Arg1Ty, typename Arg2Ty>

clang/include/clang/StaticAnalyzer/Core/PathSensitive/Regions.def

ABSTRACT_REGION(CodeTextRegion, TypedRegion)
       REGION(FunctionCodeRegion, CodeTextRegion)
       REGION_RANGE(CODE_TEXT_REGIONS, BlockCodeRegionKind,
                                       FunctionCodeRegionKind)
     ABSTRACT_REGION(TypedValueRegion, TypedRegion)
       REGION(CompoundLiteralRegion, TypedValueRegion)
       REGION(CXXBaseObjectRegion, TypedValueRegion)
       REGION(CXXDerivedObjectRegion, TypedValueRegion)
       REGION(CXXTempObjectRegion, TypedValueRegion)
+      REGION(CXXLifetimeExtendedObjectRegion, TypedValueRegion)
       REGION(CXXThisRegion, TypedValueRegion)
       ABSTRACT_REGION(DeclRegion, TypedValueRegion)
         REGION(FieldRegion, DeclRegion)
         REGION(ObjCIvarRegion, DeclRegion)
         ABSTRACT_REGION(VarRegion, DeclRegion)
           REGION(NonParamVarRegion, VarRegion)
           REGION(ParamVarRegion, VarRegion)
         REGION_RANGE(VAR_REGIONS, NonParamVarRegionKind,

clang/lib/StaticAnalyzer/Checkers/MoveChecker.cpp

 
 MoveChecker::ObjectKind
 MoveChecker::classifyObject(const MemRegion *MR,
                             const CXXRecordDecl *RD) const {
   // Local variables and local rvalue references are classified as "Local".
   // For the purposes of this checker, we classify move-safe STL types
   // as not-"STL" types, because that's how the checker treats them.
   MR = unwrapRValueReferenceIndirection(MR);
-  bool IsLocal = isa_and_nonnull<VarRegion>(MR) &&
-                 isa<StackSpaceRegion>(MR->getMemorySpace());
+  bool IsLocal =
+      isa_and_nonnull<VarRegion, CXXLifetimeExtendedObjectRegion>(MR) &&
 
   if (!RD || !RD->getDeclContext()->isStdNamespace())
     return { IsLocal, SK_NonStd };
 
   if (belongsTo(RD, StdSmartPtrClasses))
     return { IsLocal, SK_SmartPtr };
 
   if (belongsTo(RD, StdSafeClasses))

clang/lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp

if (const auto *CR = dyn_cast<CompoundLiteralRegion>(R)) {
     SourceLocation L = BD->getBeginLoc();
     range = BD->getSourceRange();
     os << "stack-allocated block declared on line "
        << SM.getExpansionLineNumber(L);
   } else if (const auto *VR = dyn_cast<VarRegion>(R)) {
     os << "stack memory associated with local variable '" << VR->getString()
        << '\'';
     range = VR->getDecl()->getSourceRange();
+  } else if (const auto *LER = dyn_cast<CXXLifetimeExtendedObjectRegion>(R)) {
+    QualType Ty = LER->getValueType().getLocalUnqualifiedType();
+    os << "stack memory associated with temporary object of type '";
+    Ty.print(os, Ctx.getPrintingPolicy());
+    os << "' lifetime extended by local variable";
+    if (const IdentifierInfo *ID = LER->getExtendingDecl()->getIdentifier())
+      os << " '" << ID->getName() << '\'';
+    range = LER->getExpr()->getSourceRange();
   } else if (const auto *TOR = dyn_cast<CXXTempObjectRegion>(R)) {
     QualType Ty = TOR->getValueType().getLocalUnqualifiedType();
     os << "stack memory associated with temporary object of type '";
     Ty.print(os, Ctx.getPrintingPolicy());
     os << "'";
     range = TOR->getExpr()->getSourceRange();
   } else {
     llvm_unreachable("Invalid region in ReturnStackAddressChecker.");
for (const auto &P : Cb.V) {
 
     // Generate a report for this bug.
     const StringRef CommonSuffix =
         "upon returning to the caller.  This will be a dangling reference";
     SmallString<128> Buf;
     llvm::raw_svector_ostream Out(Buf);
     const SourceRange Range = genName(Out, Referred, Ctx.getASTContext());
 
-    if (isa<CXXTempObjectRegion>(Referrer)) {
+    if (isa<CXXTempObjectRegion, CXXLifetimeExtendedObjectRegion>(Referrer)) {
       Out << " is still referred to by a temporary object on the stack "
           << CommonSuffix;
       auto Report =
           std::make_unique<PathSensitiveBugReport>(*BT_stackleak, Out.str(), N);
       Ctx.emitReport(std::move(Report));
       return;
     }
 

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

ProgramStateRef ExprEngine::createTemporaryRegionIfNeeded(
   // (which are currently present in the Environment, because Init is an rvalue)
   // into that region. This is not correct, but it is better than nothing.
   const TypedValueRegion *TR = nullptr;
   if (const auto *MT = dyn_cast<MaterializeTemporaryExpr>(Result)) {
     if (std::optional<SVal> V = getObjectUnderConstruction(State, MT, LC)) {
       State = finishObjectConstruction(State, MT, LC);
       State = State->BindExpr(Result, LC, *V);
       return State;
-    } else {
+    } else if (const ValueDecl *VD = MT->getExtendingDecl()) {
       StorageDuration SD = MT->getStorageDuration();
+      assert(SD != SD_FullExpression);
       // If this object is bound to a reference with static storage duration, we
       // put it in a different region to prevent "address leakage" warnings.
       if (SD == SD_Static || SD == SD_Thread) {
-        TR = MRMgr.getCXXStaticTempObjectRegion(Init);
+        TR = MRMgr.getCXXStaticLifetimeExtendedObjectRegion(Init, VD);
       } else {
-        TR = MRMgr.getCXXTempObjectRegion(Init, LC);
+        TR = MRMgr.getCXXLifetimeExtendedObjectRegion(Init, VD, LC);
       }
+    } else {
+      assert(MT->getStorageDuration() == SD_FullExpression);
+      TR = MRMgr.getCXXTempObjectRegion(Init, LC);
     }
   } else {
     TR = MRMgr.getCXXTempObjectRegion(Init, LC);
   }
 
   SVal Reg = loc::MemRegionVal(TR);
   SVal BaseReg = Reg;
 

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

if (CC) {
     }
     case ConstructionContext::SimpleTemporaryObjectKind: {
       const auto *TCC = cast<TemporaryObjectConstructionContext>(CC);
       const MaterializeTemporaryExpr *MTE = TCC->getMaterializedTemporaryExpr();
 
       CallOpts.IsTemporaryCtorOrDtor = true;
       if (MTE) {
         if (const ValueDecl *VD = MTE->getExtendingDecl()) {
-          assert(MTE->getStorageDuration() != SD_FullExpression);
+          StorageDuration SD = MTE->getStorageDuration();
+          assert(SD != SD_FullExpression);
           if (!VD->getType()->isReferenceType()) {
             // We're lifetime-extended by a surrounding aggregate.
             // Automatic destructors aren't quite working in this case
             // on the CFG side. We should warn the caller about that.
             // FIXME: Is there a better way to retrieve this information from
             // the MaterializeTemporaryExpr?
             CallOpts.IsTemporaryLifetimeExtendedViaAggregate = true;
           }
-        }
 
-        if (MTE->getStorageDuration() == SD_Static ||
-            MTE->getStorageDuration() == SD_Thread)
-          return loc::MemRegionVal(MRMgr.getCXXStaticTempObjectRegion(E));
+          if (SD == SD_Static || SD == SD_Thread)
+            return loc::MemRegionVal(
+                MRMgr.getCXXStaticLifetimeExtendedObjectRegion(E, VD));
+
+          return loc::MemRegionVal(
+              MRMgr.getCXXLifetimeExtendedObjectRegion(E, VD, LCtx));
+        }
+        assert(MTE->getStorageDuration() == SD_FullExpression);
       }
 
       return loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx));
     }
     case ConstructionContext::LambdaCaptureKind: {
       CallOpts.IsTemporaryCtorOrDtor = true;
 
       const auto *LCC = cast<LambdaCaptureConstructionContext>(CC);
void ExprEngine::handleConstructor(const Expr *E,
   // This can lose coverage because the destructor, if it were present
   // in the CFG, would be called at the end of the full expression or
   // later (for life-time extended temporaries) -- but avoids infeasible
   // paths when no-return temporary destructors are used for assertions.
   ExplodedNodeSet DstEvaluatedPostProcessed;
   StmtNodeBuilder Bldr(DstEvaluated, DstEvaluatedPostProcessed, *currBldrCtx);
   const AnalysisDeclContext *ADC = LCtx->getAnalysisDeclContext();
   if (!ADC->getCFGBuildOptions().AddTemporaryDtors) {
-    if (llvm::isa_and_nonnull<CXXTempObjectRegion>(TargetRegion) &&
+    if (llvm::isa_and_nonnull<CXXTempObjectRegion,
+                              CXXLifetimeExtendedObjectRegion>(TargetRegion) &&
         cast<CXXConstructorDecl>(Call->getDecl())
             ->getParent()
             ->isAnyDestructorNoReturn()) {
 
       // If we've inlined the constructor, then DstEvaluated would be empty.
       // In this case we still want a sink, which could be implemented
       // in processCallExit. But we don't have that implemented at the moment,
       // so if you hit this assertion, see if you can avoid inlining

clang/lib/StaticAnalyzer/Core/MemRegion.cpp

MemRegionManager &SubRegion::getMemRegionManager() const {
   } while (true);
 }
 
 const StackFrameContext *VarRegion::getStackFrame() const {
   const auto *SSR = dyn_cast<StackSpaceRegion>(getMemorySpace());
   return SSR ? SSR->getStackFrame() : nullptr;
 }
 
+const StackFrameContext *
+CXXLifetimeExtendedObjectRegion::getStackFrame() const {
+  const auto *SSR = dyn_cast<StackSpaceRegion>(getMemorySpace());
+  return SSR ? SSR->getStackFrame() : nullptr;
+}
+
+const StackFrameContext *
+CXXTempObjectRegion::getStackFrame() const {
+  assert(isa<StackSpaceRegion>(getMemorySpace()) &&
+         "A temporary object can only be allocated on the stack");
+  return cast<StackSpaceRegion>(getMemorySpace())->getStackFrame();
+}
+
 ObjCIvarRegion::ObjCIvarRegion(const ObjCIvarDecl *ivd, const SubRegion *sReg)
     : DeclRegion(sReg, ObjCIvarRegionKind), IVD(ivd) {
   assert(IVD);
 }
 
 const ObjCIvarDecl *ObjCIvarRegion::getDecl() const { return IVD; }
 
 QualType ObjCIvarRegion::getValueType() const {
void CXXTempObjectRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
   ID.AddPointer(Ex);
   ID.AddPointer(sReg);
 }
 
 void CXXTempObjectRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   ProfileRegion(ID, Ex, getSuperRegion());
 }
 
+void CXXLifetimeExtendedObjectRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
+                                                    const Expr *E,
+                                                    const ValueDecl *D,
+                                                    const MemRegion *sReg) {
+  ID.AddPointer(E);
+  ID.AddPointer(D);
+  ID.AddPointer(sReg);
+}
+
+void CXXLifetimeExtendedObjectRegion::Profile(
+    llvm::FoldingSetNodeID &ID) const {
+  ProfileRegion(ID, Ex, ExD, getSuperRegion());
+}
+
 void CXXBaseObjectRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
                                         const CXXRecordDecl *RD,
                                         bool IsVirtual,
                                         const MemRegion *SReg) {
   ID.AddPointer(RD);
   ID.AddBoolean(IsVirtual);
   ID.AddPointer(SReg);
 }
void CompoundLiteralRegion::dumpToStream(raw_ostream &os) const {
   os << "{ S" << CL->getID(getContext()) <<  " }";
 }
 
 void CXXTempObjectRegion::dumpToStream(raw_ostream &os) const {
   os << "temp_object{" << getValueType() << ", "
      << "S" << Ex->getID(getContext()) << '}';
 }
 
+void CXXLifetimeExtendedObjectRegion::dumpToStream(raw_ostream &os) const {
+  os << "lifetime_extended_object{" << getValueType() << ", ";
+  if (const IdentifierInfo *ID = ExD->getIdentifier())
+    os << ID->getName();
+  else
+    os << "D" << ExD->getID();
+  os << ", "
+     << "S" << Ex->getID(getContext()) << '}';
+}
+
 void CXXBaseObjectRegion::dumpToStream(raw_ostream &os) const {
   os << "Base{" << superRegion << ',' << getDecl()->getName() << '}';
 }
 
 void CXXDerivedObjectRegion::dumpToStream(raw_ostream &os) const {
   os << "Derived{" << superRegion << ',' << getDecl()->getName() << '}';
 }
 
DefinedOrUnknownSVal MemRegionManager::getStaticSize(const MemRegion *MR,
   case MemRegion::StringRegionKind:
     return SVB.makeIntVal(
         cast<StringRegion>(SR)->getStringLiteral()->getByteLength() + 1,
         SVB.getArrayIndexType());
   case MemRegion::CompoundLiteralRegionKind:
   case MemRegion::CXXBaseObjectRegionKind:
   case MemRegion::CXXDerivedObjectRegionKind:
   case MemRegion::CXXTempObjectRegionKind:
+  case MemRegion::CXXLifetimeExtendedObjectRegionKind:
   case MemRegion::CXXThisRegionKind:
   case MemRegion::ObjCIvarRegionKind:
   case MemRegion::NonParamVarRegionKind:
   case MemRegion::ParamVarRegionKind:
   case MemRegion::ElementRegionKind:
   case MemRegion::ObjCStringRegionKind: {
     QualType Ty = cast<TypedValueRegion>(SR)->getDesugaredValueType(Ctx);
     if (isa<VariableArrayType>(Ty))
if (!IsArcManagedBlock && LC) {
       // without context-sensitivity.
       sReg = getUnknownRegion();
     }
   }
 
   return getSubRegion<BlockDataRegion>(BC, LC, blockCount, sReg);
 }
 
-const CXXTempObjectRegion *
-MemRegionManager::getCXXStaticTempObjectRegion(const Expr *Ex) {
-  return getSubRegion<CXXTempObjectRegion>(
-      Ex, getGlobalsRegion(MemRegion::GlobalInternalSpaceRegionKind, nullptr));
-}
-
 const CompoundLiteralRegion*
 MemRegionManager::getCompoundLiteralRegion(const CompoundLiteralExpr *CL,
                                            const LocationContext *LC) {
   const MemSpaceRegion *sReg = nullptr;
 
   if (CL->isFileScope())
     sReg = getGlobalsRegion();
   else {

 const CXXTempObjectRegion*
 MemRegionManager::getCXXTempObjectRegion(Expr const *E,
                                          LocationContext const *LC) {
   const StackFrameContext *SFC = LC->getStackFrame();
   assert(SFC);
   return getSubRegion<CXXTempObjectRegion>(E, getStackLocalsRegion(SFC));
 }
 
+const CXXLifetimeExtendedObjectRegion *
+MemRegionManager::getCXXLifetimeExtendedObjectRegion(
+    const Expr *Ex, const ValueDecl *VD, const LocationContext *LC) {
+  const StackFrameContext *SFC = LC->getStackFrame();
+  assert(SFC);
+  return getSubRegion<CXXLifetimeExtendedObjectRegion>(
+      Ex, VD, getStackLocalsRegion(SFC));
+}
+
+const CXXLifetimeExtendedObjectRegion *
+MemRegionManager::getCXXStaticLifetimeExtendedObjectRegion(
+    const Expr *Ex, const ValueDecl *VD) {
+  return getSubRegion<CXXLifetimeExtendedObjectRegion>(
+      Ex, VD,
+      getGlobalsRegion(MemRegion::GlobalInternalSpaceRegionKind, nullptr));
+}
+
 /// Checks whether \p BaseClass is a valid virtual or direct non-virtual base
 /// class of the type of \p Super.
 static bool isValidBaseClass(const CXXRecordDecl *BaseClass,
                              const TypedValueRegion *Super,
                              bool IsVirtual) {
   BaseClass = BaseClass->getCanonicalDecl();
 
   const CXXRecordDecl *Class = Super->getValueType()->getAsCXXRecordDecl();
while (true) {
     case MemRegion::AllocaRegionKind:
     case MemRegion::CompoundLiteralRegionKind:
     case MemRegion::CXXThisRegionKind:
     case MemRegion::StringRegionKind:
     case MemRegion::ObjCStringRegionKind:
     case MemRegion::NonParamVarRegionKind:
     case MemRegion::ParamVarRegionKind:
     case MemRegion::CXXTempObjectRegionKind:
+    case MemRegion::CXXLifetimeExtendedObjectRegionKind:
       // Usual base regions.
       goto Finish;
 
     case MemRegion::ObjCIvarRegionKind:
       // This is a little strange, but it's a compromise between
       // ObjCIvarRegions having unknown compile-time offsets (when using the
       // non-fragile runtime) and yet still being distinct, non-overlapping
       // regions. Thus we treat them as "like" base regions for the purposes

clang/lib/StaticAnalyzer/Core/Store.cpp

switch (R->getKind()) {
     case MemRegion::AllocaRegionKind:
     case MemRegion::CompoundLiteralRegionKind:
     case MemRegion::FieldRegionKind:
     case MemRegion::ObjCIvarRegionKind:
     case MemRegion::ObjCStringRegionKind:
     case MemRegion::NonParamVarRegionKind:
     case MemRegion::ParamVarRegionKind:
     case MemRegion::CXXTempObjectRegionKind:
+    case MemRegion::CXXLifetimeExtendedObjectRegionKind:
     case MemRegion::CXXBaseObjectRegionKind:
     case MemRegion::CXXDerivedObjectRegionKind:
       return MakeElementRegion(cast<SubRegion>(R), PointeeTy);
 
     case MemRegion::ElementRegionKind: {
       // If we are casting from an ElementRegion to another type, the
       // algorithm is as follows:
       //

clang/test/Analysis/lifetime-extended-regions.cpp

+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.core\
+// RUN:                    -analyzer-checker=debug.ExprInspection\
+// RUN:                    -Wno-dangling -Wno-c++1z-extensions\
+// RUN:                    -verify=expected,cpp14\
+// RUN:                    -x c++ -std=c++14 %s
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.core\
+// RUN:                    -analyzer-checker=debug.ExprInspection\
+// RUN:                    -analyzer-config elide-constructors=false\
+// RUN:                    -Wno-dangling -Wno-c++1z-extensions\
+// RUN:                    -verify=expected,cpp14\
+// RUN:                    -x c++ -std=c++14 %s
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.core\
+// RUN:                    -analyzer-checker=debug.ExprInspection\
+// RUN:                    -Wno-dangling -verify=expected,cpp17\
+// RUN:                    -x c++ -std=c++17 %s
+
+template<typename T>
+void clang_analyzer_dump(T&&) {}
+
+template<typename T>
+T create() { return T{}; }
+
+template<typename T>
+T const& select(bool cond, T const& t, T const& u) { return cond ? t : u; }
+
+struct Composite {
+  int x;
+  int y;
+};
+
+struct Derived : Composite {
+  int z;
+};
+
+template<typename T>
+struct Array {
+  T array[20];
+
+  T&& front() && { return static_cast<T&&>(array[0]); }
+};
+
+void whole_object() {
+  int const& i = 10; // extends `int`
+  clang_analyzer_dump(i); // expected-warning-re {{&lifetime_extended_object{int, i, S{{[0-9]+}}} }}
+  Composite&& c = Composite{}; // extends `Composite`
+  clang_analyzer_dump(c); // expected-warning-re {{&lifetime_extended_object{Composite, c, S{{[0-9]+}}} }}
+  auto&& a = Array<int>{}; // extends `Array<int>`
+  clang_analyzer_dump(a); // expected-warning-re {{&lifetime_extended_object{Array<int>, a, S{{[0-9]+}}} }}
+  Composite&& d = Derived{}; // extends `Derived`
+  clang_analyzer_dump(d); // expected-warning-re {{&Base{lifetime_extended_object{Derived, d, S{{[0-9]+}}},Composite} }}
+}
+
+void member_access() {
+  int&& x = Composite{}.x;  // extends `Composite`
+  clang_analyzer_dump(x); // expected-warning-re {{&lifetime_extended_object{Composite, x, S{{[0-9]+}}}.x }}
+  int&& y = create<Composite>().y; // extends `Composite`
+  clang_analyzer_dump(y); // expected-warning-re {{&lifetime_extended_object{struct Composite, y, S{{[0-9]+}}}.y }}
+  int&& d = Array<int>{}.front(); // dangles `Array<int>`
+  clang_analyzer_dump(d); // expected-warning-re {{&Element{temp_object{Array<int>, S{{[0-9]+}}}.array,0 S64b,int} }}
+}
+
+void array_subscript() {
+  int&& i = Array<int>{}.array[0]; // extends `Array<int>`
+  clang_analyzer_dump(i); // expected-warning-re {{&Element{lifetime_extended_object{Array<int>, i, S{{[0-9]+}}}.array,0 S64b,int} }}
+  auto&& c = Array<Composite>{}.array[0]; // extends `Array<int>`
+  clang_analyzer_dump(c); // expected-warning-re {{&Element{lifetime_extended_object{Array<Composite>, c, S{{[0-9]+}}}.array,0 S64b,struct Composite} }}
+  auto&& x = Array<Composite>{}.array[0].x; // extends `Array<Composite>`
+  clang_analyzer_dump(x); // expected-warning-re {{&Element{lifetime_extended_object{Array<Composite>, x, S{{[0-9]+}}}.array,0 S64b,struct Composite}.x }}
+}
+
+void ternary(bool cond) {
+  Composite cc;
+  // Value category mismatch of the operands (lvalue and xvalue), ternary produces prvalue
+  auto&& ternaryProducesPRvalue = cond ? Composite{}.x : cc.x; // extends prvalue of 'int', `Composite` in true branch is destroyed
+  clang_analyzer_dump(ternaryProducesPRvalue); // expected-warning-re {{&lifetime_extended_object{int, ternaryProducesPRvalue, S{{[0-9]+}}} }}
+
+  // Value category agrees (xvalues), lifetime extension is triggered
+  auto&& branchesExtended = cond ? Composite{}.x : static_cast<Composite&&>(cc).x; // extends `Composite` in true branch
+  clang_analyzer_dump(branchesExtended);
+  // expected-warning-re@-1 {{&lifetime_extended_object{Composite, branchesExtended, S{{[0-9]+}}}.x }}
+  // expected-warning@-2 {{&cc.x }}
+
+  // Object of different types in branches are lifetime extended
+  auto&& extendingDifferentTypes = cond ? Composite{}.x : Array<int>{}.array[0]; // extends `Composite` or `Array<int>`
+  clang_analyzer_dump(extendingDifferentTypes);
+  // expected-warning-re@-1 {{&lifetime_extended_object{Composite, extendingDifferentTypes, S{{[0-9]+}}}.x }}
+  // expected-warning-re@-2 {{&Element{lifetime_extended_object{Array<int>, extendingDifferentTypes, S{{[0-9]+}}}.array,0 S64b,int} }}
+
+  Composite const& variableAndExtended = cond ? static_cast<Composite&&>(cc) : Array<Composite>{}.array[0]; // extends `Array<Composite>` in false branch
+  clang_analyzer_dump(variableAndExtended);
+  // expected-warning@-1 {{&cc }}
+  // expected-warning-re@-2 {{&Element{lifetime_extended_object{Array<Composite>, variableAndExtended, S{{[0-9]+}}}.array,0 S64b,struct Composite} }}
+
+  int const& extendAndDangling = cond ? Array<int>{}.array[0] : Array<int>{}.front(); // extends `Array<int>` only in true branch, false branch dangles
+  clang_analyzer_dump(extendAndDangling);
+  // expected-warning-re@-1 {{&Element{lifetime_extended_object{Array<int>, extendAndDangling, S{{[0-9]+}}}.array,0 S64b,int} }}
+  // expected-warning-re@-2 {{&Element{temp_object{Array<int>, S{{[0-9]+}}}.array,0 S64b,int} }}
+}
+
+struct RefAggregate {
+  int const& rx;
+  Composite&& ry = Composite{};
+};
+
+void aggregateWithReferences() {
+  RefAggregate multipleExtensions = {10, Composite{}}; // extends `int` and `Composite`
+  clang_analyzer_dump(multipleExtensions.rx); // expected-warning-re {{&lifetime_extended_object{int, multipleExtensions, S{{[0-9]+}}} }}
+  clang_analyzer_dump(multipleExtensions.ry); // expected-warning-re {{&lifetime_extended_object{Composite, multipleExtensions, S{{[0-9]+}}} }}
+
+  RefAggregate danglingAndExtended{Array<int>{}.front(), Composite{}}; // extends only `Composite`, `Array<int>` dangles
+  clang_analyzer_dump(danglingAndExtended.rx); // expected-warning-re {{&Element{temp_object{Array<int>, S{{[0-9]+}}}.array,0 S64b,int} }}
+  clang_analyzer_dump(danglingAndExtended.ry); // expected-warning-re {{&lifetime_extended_object{Composite, danglingAndExtended, S{{[0-9]+}}} }}
+
+  int i = 10;
+  RefAggregate varAndExtended{i, Composite{}};  // extends `Composite`
+  clang_analyzer_dump(varAndExtended.rx); // expected-warning {{&i }}
+  clang_analyzer_dump(varAndExtended.ry); // expected-warning-re {{&lifetime_extended_object{Composite, varAndExtended, S{{[0-9]+}}} }}
+
+  auto const& viaReference = RefAggregate{10, Composite{}}; // extends `int`, `Composite`, and `RefAggregate`
+  clang_analyzer_dump(viaReference);    // expected-warning-re {{&lifetime_extended_object{RefAggregate, viaReference, S{{[0-9]+}}} }}
+  clang_analyzer_dump(viaReference.rx); // expected-warning-re {{&lifetime_extended_object{int, viaReference, S{{[0-9]+}}} }}
+  clang_analyzer_dump(viaReference.ry); // expected-warning-re {{&lifetime_extended_object{Composite, viaReference, S{{[0-9]+}}} }}
+
+  // clang does not currently implement extending lifetime of object bound to reference members of aggregates,
+  // that are created from default member initializer (see `warn_unsupported_lifetime_extension` from `-Wdangling`)
+  RefAggregate defaultInitExtended{i}; // clang-bug does not extend `Composite`
+  clang_analyzer_dump(defaultInitExtended.ry); // expected-warning {{Unknown }}
+}
+
+void lambda() {
+  auto const& lambdaRef = [capture = create<Composite>()] {};
+  clang_analyzer_dump(lambdaRef); // expected-warning-re {{lifetime_extended_object{class (lambda at {{[^)]+}}), lambdaRef, S{{[0-9]+}}} }}
+
+  // The capture [&refCapture = create<Composite const>()] { ... } per [expr.prim.lambda.capture] p6 equivalent to:
+  //   auto& refCapture = create<Composite const>(); // Well-formed, deduces auto = Composite const, and performs lifetime extension
+  //   [&refCapture] { ... }
+  // Where 'refCapture' has the same lifetime as the lambda itself.
+  // However, compilers differ: Clang lifetime-extends from C++17, GCC rejects the code, and MSVC dangles
+  auto const refExtendingCapture = [&refCapture = create<Composite const>()] {
+     clang_analyzer_dump(refCapture);
+     // cpp14-warning-re@-1 {{&temp_object{const struct Composite, S{{[0-9]+}}} }}
+     // cpp17-warning-re@-2 {{&lifetime_extended_object{const struct Composite, refExtendingCapture, S{{[0-9]+}}} }}
+  };
+  refExtendingCapture();
+}
+
+void viaStructuredBinding() {
+  auto&& [x, y] = Composite{}; // extends `Composite` and binds it to unnamed decomposed object
+  clang_analyzer_dump(x); // expected-warning-re {{&lifetime_extended_object{Composite, D{{[0-9]+}}, S{{[0-9]+}}}.x }}
+  clang_analyzer_dump(y); // expected-warning-re {{&lifetime_extended_object{Composite, D{{[0-9]+}}, S{{[0-9]+}}}.y }}
+
+  auto&& [rx, ry] = RefAggregate{10, Composite{}}; // extends `int`, `Composite`, and `RefAggregate`, and binds them to unnamed decomposed object
+  clang_analyzer_dump(rx); // expected-warning-re {{&lifetime_extended_object{int, D{{[0-9]+}}, S{{[0-9]+}}} }}
+  clang_analyzer_dump(ry); // expected-warning-re {{&lifetime_extended_object{Composite, D{{[0-9]+}}, S{{[0-9]+}}} }}
+}
+
+void propagation(bool cond) {
+  int const& le = Composite{}.x;
+  // May return lifetime-extended region or dangling temporary
+  auto&& oneDangling = select(cond, le, 10); // does not extend lifetime of arguments
+  clang_analyzer_dump(oneDangling);
+  // expected-warning-re@-1 {{&lifetime_extended_object{Composite, le, S{{[0-9]+}}}.x }}
+  // expected-warning-re@-2 {{&temp_object{int, S{{[0-9]+}}} }}
+
+  // Always dangles
+  auto&& bothDangling = select(cond, 10, 20); // does not extend lifetime of arguments
+  clang_analyzer_dump(bothDangling);
+  // expected-warning-re@-1 {{&temp_object{int, S{{[0-9]+}}} }}
+  // expected-warning-re@-2 {{&temp_object{int, S{{[0-9]+}}} }}
+}

clang/test/Analysis/stack-addr-ps.cpp

 }
 
 int get_value();
 
 const int &get_reference1() { return get_value(); } // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}}
 
 const int &get_reference2() {
   const int &x = get_value(); // expected-note {{binding reference variable 'x' here}}
-  return x; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}}
+  return x; // expected-warning{{Address of stack memory associated with temporary object of type 'int' lifetime extended by local variable 'x' returned to caller}} expected-warning {{returning reference to local temporary}} 
 }
 
 const int &get_reference3() {
   const int &x1 = get_value(); // expected-note {{binding reference variable 'x1' here}}
   const int &x2 = x1; // expected-note {{binding reference variable 'x2' here}}
-  return x2; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning reference to local temporary}}
+  return x2; // expected-warning{{Address of stack memory associated with temporary object of type 'int' lifetime extended by local variable 'x1' returned to caller}} expected-warning {{returning reference to local temporary}}
 }
 
 int global_var;
 int *f1() {
   int &y = global_var;
   return &y;
 }
 
 int *f2() {
   int x1;
   int &x2 = x1; // expected-note {{binding reference variable 'x2' here}}
   return &x2; // expected-warning{{Address of stack memory associated with local variable 'x1' returned}} expected-warning {{address of stack memory associated with local variable 'x1' returned}}
 }
 
 int *f3() {
   int x1;
   int *const &x2 = &x1; // expected-note {{binding reference variable 'x2' here}}
   return x2; // expected-warning {{address of stack memory associated with local variable 'x1' returned}} expected-warning {{Address of stack memory associated with local variable 'x1' returned to caller}}
 }
 
 const int *f4() {
   const int &x1 = get_value(); // expected-note {{binding reference variable 'x1' here}}
   const int &x2 = x1; // expected-note {{binding reference variable 'x2' here}}
-  return &x2; // expected-warning{{Address of stack memory associated with temporary object of type 'int' returned}} expected-warning {{returning address of local temporary}}
+  return &x2; // expected-warning{{Address of stack memory associated with temporary object of type 'int' lifetime extended by local variable 'x1' returned to caller}} expected-warning {{returning address of local temporary}}
 }
 
 struct S {
   int x;
 };
 
 int *mf() {
   S s1;

clang/test/Analysis/use-after-move.cpp

 void tempTest() {
   A a = A::get();
   A::get().foo(); // no-warning
   for (int i = 0; i < bignum(); i++) {
     A::get().foo(); // no-warning
   }
 }
 
+void lifeTimeExtendTest() {
+  A&& a = A{};
+  A b = std::move(a); // peaceful-note {{Object is moved}}
+
+  a.foo(); // peaceful-warning {{Method called on moved-from object}}
+           // peaceful-note@-1 {{Method called on moved-from object}}
+}
+
 void interFunTest1(A &a) {
   a.bar(); // peaceful-warning {{Method called on moved-from object 'a'}}
            // peaceful-note@-1 {{Method called on moved-from object 'a'}}
 }
 
 void interFunTest2() {
   A a;
   A b;