[LifetimeSafety] False-positive when paths are moved to a longer-lived storage

[usx95]

#include <stdint.h>

#include <span>
#include <utility>
#include <vector>

void foo() {
    std::vector<int> src_data;
    std::span<int> src_span;
    {
        std::vector<int> temp_src_data = {1, 2, 3};
        temp_src_data.push_back(12);

        src_span = temp_src_data;
//                 ^~~~~~~~~~~~~

        src_data = std::move(temp_src_data);
    }
//  ^ destroyed here

    (void)src_span[0];
//        ^~~~~~~~ note: later used here
}

https://godbolt.org/z/74WzPPnT1

[llvmbot]

@llvm/issue-subscribers-clang-temporal-safety

Author: Utkarsh Saxena (usx95)

```cpp #include <stdint.h>

#include <span>
#include <utility>
#include <vector>

void foo() {
std::vector<int> src_data;
std::span<int> src_span;
{
std::vector<int> temp_src_data = {1, 2, 3};
temp_src_data.push_back(12);

    src_span = temp_src_data;

// ^~~~~~~~~~~~~

    src_data = std::move(temp_src_data);
}

// ^ destroyed here

(void)src_span[0];

// ^~~~~~~~ note: later used here
}

https://godbolt.org/z/74WzPPnT1
</details>

[usx95]

This came up while trying this analysis on chromium here

The code above seems correct based on https://en.cppreference.com/w/cpp/container/vector/vector which says:

After container move construction (overload (8)), references, pointers, and iterators (other than the end iterator) to other remain valid, but refer to elements that are now in *this. The current standard makes this guarantee via the blanket statement in container.reqmts/67, and a more direct guarantee is under consideration via LWG issue 2321.

That said, the analysis cannot atm differentiate between storage inside the vector and the vector's lvalue itself.

E.g., This is a true positive: https://godbolt.org/z/Mxn8fWPev

void foo() {
    std::vector<int> src_data;
    std::vector<int>* src_ptr;
    {
        std::vector<int> temp_src_data = {1, 2, 3};
        temp_src_data.push_back(12);

        src_ptr = &temp_src_data;
//                 ^~~~~~~~~~~~~~
        src_data = std::move(temp_src_data);
    }
//  ^ destroyed here

    (void)src_ptr;
//        ^~~~~~~~ note: later used here
}

A simpler not-so-principled workaround would be to ignore expirations of loans to paths which are moved from. Another option would be to diagnose this in strict mode only.