Teach the Clang Static Analyzer to understand lifetime annotations

The Clang Static Analyzer (CSA) can find a wide range of temporal memory errors such as use-after-free and dangling references. Some of its checkers, like cplusplus.InnerPointer, rely on hardcoded knowledge about the behavior of specific APIs. The Clang community has introduced lifetime annotations: [[clang::lifetimebound]] and [[clang::lifetime_capture_by(X)]] that let developers express lifetime relationships directly on their declarations and -Wlifetime-safety makes use of them. However, in partially annotated code, a single missing annotation is enough to prevent -Wlifetime-safety from finding the bug. The CSA can help in these situations by inlining the unannotated function. In my proposed project, I intend to implement a new standalone checker that reads lifetime annotations and tracks the resulting dependencies along different execution paths, using them as a fallback when the analyzer cannot inline a function body. The expected result is that the CSA detects lifetime bugs in both annotated and partially annotated code that it currently cannot catch, complementing the coverage provided by -Wlifetime-safety.