Odd Clang Static Analyzer Output

Hi, sorry if this question is answered somewhere else, but I couldn’t find anything about it. I’ve read the checker development manual and looking at past mailing list emails. My question is about how the analysis framework determines how a pointer escapes.

I have the following code:
class A {

int y;

public:

void getY(int * i) const {

*i = y;
}
};

Assuming that the analyzer uses getY as the top level function, I have a bind