FYI: Clang has a new lifetime checker that leverages [[gsl::Pointer]] now

[SidneyCogdill]

Refer to https://discourse.llvm.org/t/rfc-intra-procedural-lifetime-analysis-in-clang/86291 for information.

Currently this requires marking the proxy class with the [[gsl::Pointer]] attribute:

template <facade F>
class [[gsl::Pointer]] proxy : ...

https://godbolt.org/z/cov3MG5v5

namespace mem {
    PRO_DEF_MEM_DISPATCH(foo, foo);
}

struct Foo : pro::facade_builder
    ::add_convention<mem::foo, int const*() const>
    ::build {};


struct FooImpl {
    int x = 42;
    int const* foo() const {
        return &x;
    }
};

auto f() {
    pro::proxy_view<Foo> p0{};
    pro::proxy<Foo> p1{};
    pro::proxy<Foo> p2{};
    FooImpl* p3{};

    {
        FooImpl foo{};
        p0 = &foo; // ERROR
    }

    {
        auto foo = std::make_unique<FooImpl>();
        p1 = foo.get(); // ERROR
    }

    {
        auto foo = std::make_unique<FooImpl>();
        p2 = std::move(foo); // no error
    }

    {
        pro::proxy<Foo> pp{};
        auto foo = std::make_unique<FooImpl>();
        p3 = foo.get(); // ERROR
        pp = std::move(foo);
    }
    
    auto result0 = p0->foo();
    auto result1 = p1->foo();
    auto result2 = p2->foo();
    auto result3 = p3->foo();
}

Compiling with the latest Clang trunk, using -std=c++20 -Wno-c++23-extensions -Werror=experimental-lifetime-safety -Werror=experimental-lifetime-safety-cross-tu-suggestions -Wexperimental-lifetime-safety-intra-tu-suggestions -Xclang -fexperimental-lifetime-safety -Xclang -fexperimental-lifetime-safety-inference [1]:

<source>:2873:14: error: object whose reference is captured does not live long enough [-Werror,-Wexperimental-lifetime-safety-permissive]
 2873 |         p = &foo;
      |              ^~~
<source>:2874:5: note: destroyed here
 2874 |     }
      |     ^
<source>:2876:19: note: later used here
 2876 |     auto result = p->foo();
      |                   ^
<source>:2897:14: error: object whose reference is captured does not live long enough [-Werror,-Wexperimental-lifetime-safety-permissive]
 2897 |         p3 = foo.get();
      |              ^~~
<source>:2899:5: note: destroyed here
 2899 |     }
      |     ^
<source>:2903:20: note: later used here
 2903 |     auto result3 = p3->foo();
      |                    ^~
<source>:2886:14: error: object whose reference is captured does not live long enough [-Werror,-Wexperimental-lifetime-safety-permissive]
 2886 |         p1 = foo.get();
      |              ^~~
<source>:2887:5: note: destroyed here
 2887 |     }
      |     ^
<source>:2901:19: note: later used here
 2901 |     auto result = p1->foo();
      |                   ^~

It's still experimental, there are still many cases where the UAF doesn't get caught, the lifetime checker behavior may change any time. Since pro::proxy acts sometimes as a gsl::Owner and sometimes as a gsl::Pointer, I'm not sure whether it will introduce false positives with codes that use Proxy, as the lifetime checker gets stronger and stronger in the future. However, for now it seems to work correctly when interacting with other gsl::Owner types such as unique_ptr.

[1] For some reasons the checker does not inference lifetime constraint when using -std=c++23 / -std=c++26. llvm/llvm-project#176292