Good idea, I'll look into it.

I've thought sometimes about creating a query for Bug #6 in Curiously Recurring C++ Bugs at Facebook (an excellent talk, by the way), but that hasn't been necessary because the "Function declared in block" query has detected that bug.

I understood issue #6 to be a variable declaration, not a function declaration. Can you give me an example where "Function declared in block" catches something serious?

I wrote some test cases and found the LocalVariableHidesGlobalVariable query is pretty effective at finding the problem as I understand it. The issue being, in practice this is often likely to be 'local variable hides class member variable' which I don't think we have a query for. Perhaps that should be the new query?

I'd misremembered Bug #6. I thought it was a variant of this bug, which I thought was easier to trigger.

I think a "local variable hides class member variable" query would be too noisy in practice. I wrote a less strict version of that for Java once to find methods that access a field without a qualifier when a local variable exists with the same name in that method. I think it has quite good results, but it's still very noisy: https://lgtm.com/query/1506250887340/. Anyway, that wouldn't detect Bug #6.

It would be great if we could write a generalised "expression has no effect" query for Bug #6 because I think that's the most general form of the problem. The default constructor probably sets some field to nullptr and does nothing else, and then the destructor has no effect when that field is nullptr. Such a query would unfortunately only work for types whose default constructor and destructor bodies are in the snapshot or are on a hard-coded list.

I thought it was a variant of this bug, which I thought was easier to trigger.

I thought that might create a temporary mutex and lock it, but it seems to do nothing at all. Do you know why?

I'm thinking the way forward is to write some tests for these cases, see which existing queries help, and discuss further.

but it seems to do nothing at all

... oh, because it's a function declaration. Hence the use of Function declared in block.