StdVariantChecker: the variant template arguments are retrieved incorrectly when type aliases are involved, causing crashes and FPs/FNs

Author: guillem-bartrina-sonarsource

clang/lib/StaticAnalyzer/Checkers/StdVariantChecker.cpp

@@ -90,6 +90,9 @@ bool isStdVariant(const Type *Type) {
 static std::optional<ArrayRef<TemplateArgument>>
 getTemplateArgsFromVariant(const Type *VariantType) {
   const auto *TempSpecType = VariantType->getAs<TemplateSpecializationType>();
+  while (TempSpecType && TempSpecType->isTypeAlias())
+    TempSpecType =
+        TempSpecType->getAliasedType()->getAs<TemplateSpecializationType>();
   if (!TempSpecType)
     return {};
 

clang/test/Analysis/std-variant-checker.cpp

@@ -361,9 +361,25 @@ void nonInlineFunctionCallPtr() {
 // Misc
 // ----------------------------------------------------------------------------//
 
-using uintptr_t = unsigned long long;
-
 void unknownVal() {
   // force the argument to be UnknownVal
-  (void)std::get<int>(*(std::variant<int, float>*)(uintptr_t)3.14f); // no crash
+  (void)std::get<int>(*(std::variant<int, float>*)(int)3.14f); // no crash
+}
+
+template <typename T>
+using MyVariant = std::variant<int, float>;
+
+void typeAlias() {
+  MyVariant<bool> v;
+
+  (void)std::get<int>(v); // no-warning
+}
+
+template <template<typename> typename Container>
+using MySpecialVariant = std::variant<int, float>;
+
+void complexTypeAlias() {
+  MySpecialVariant<std::vector> v;
+
+  (void)std::get<int>(v); // no crash
 }