[clang-tidy] [dataflow] Cache reference accessors for bugprone-unchecked-optional-access

clang/lib/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.cpp

@@ -580,6 +580,26 @@ void handleConstMemberCall(const CallExpr *CE,
     return;
   }
 
+  // Cache if the const method returns a reference
+  if (RecordLoc != nullptr && CE->isGLValue()) {
+    const FunctionDecl *DirectCallee = CE->getDirectCallee();
+    if (DirectCallee == nullptr)
+      return;
+
+    bool isReference =
+        DirectCallee->getReturnType().getTypePtr()->isReferenceType();
+    if (isReference) {
+      StorageLocation &Loc =
+          State.Lattice.getOrCreateConstMethodReturnStorageLocation(
+              *RecordLoc, DirectCallee, State.Env, [&](StorageLocation &Loc) {
+                // no-op
+              });
+
+      State.Env.setStorageLocation(*CE, Loc);
+      return;
+    }
+  }
+
   // Cache if the const method returns a boolean or pointer type.
   // We may decide to cache other return types in the future.
   if (RecordLoc != nullptr &&

clang/unittests/Analysis/FlowSensitive/UncheckedOptionalAccessModelTest.cpp

@@ -3863,6 +3863,192 @@ TEST_P(UncheckedOptionalAccessTest, ConstBoolAccessorWithModInBetween) {
   )cc");
 }
 
+TEST_P(UncheckedOptionalAccessTest,
+       ConstRefAccessorToOptionalViaConstRefAccessorToHoldingObject) {
+  ExpectDiagnosticsFor(R"cc(
+    #include "unchecked_optional_access_test.h"
+
+    class A {
+      public:
+        const $ns::$optional<int>& get() const { return x; }
+
+      private:
+        $ns::$optional<int> x;
+    };
+
+    class B {
+      public:
+        const A& getA() const { return a; }
+
+      private:
+        A a;
+    };
+
+    void target(B& b) {
+      if (b.getA().get().has_value()) {
+        b.getA().get().value();
+      }
+    }
+  )cc");
+}
+
+TEST_P(
+    UncheckedOptionalAccessTest,
+    ConstRefAccessorToOptionalViaConstRefAccessorToHoldingObjectWithoutValueCheck) {
+  ExpectDiagnosticsFor(R"cc(
+    #include "unchecked_optional_access_test.h"
+
+    class A {
+      public:
+        const $ns::$optional<int>& get() const { return x; }
+
+      private:
+        $ns::$optional<int> x;
+    };
+
+    class B {
+      public:
+        const A& getA() const { return a; }
+
+      private:
+        A a;
+    };
+
+    void target(B& b) {
+      b.getA().get().value(); // [[unsafe]]
+    }
+  )cc");
+}
+
+TEST_P(UncheckedOptionalAccessTest,
+       ConstRefToOptionalSavedAsTemporaryVariable) {
+  ExpectDiagnosticsFor(R"cc(
+    #include "unchecked_optional_access_test.h"
+
+    class A {
+      public:
+        const $ns::$optional<int>& get() const { return x; }
+
+      private:
+        $ns::$optional<int> x;
+    };
+
+    class B {
+      public:
+        const A& getA() const { return a; }
+
+      private:
+        A a;
+    };
+
+    void target(B& b) {
+      const auto& opt = b.getA().get();
+      if (opt.has_value()) {
+        opt.value();
+      }
+    }
+  )cc");
+}
+
+TEST_P(UncheckedOptionalAccessTest,
+       ConstRefAccessorToOptionalViaConstValueAccessorToHoldingObject) {
+  ExpectDiagnosticsFor(R"cc(
+    #include "unchecked_optional_access_test.h"
+
+    class A {
+      public:
+        const $ns::$optional<int>& get() const { return x; }
+
+      private:
+        $ns::$optional<int> x;
+    };
+
+    class B {
+      public:
+        const A copyA() const { return a; }
+
+      private:
+        A a;
+    };
+
+    void target(B& b) {
+      if (b.copyA().get().has_value()) {
+        b.copyA().get().value(); // [[unsafe]]
+      }
+    }
+  )cc");
+}
+
+TEST_P(UncheckedOptionalAccessTest,
+       ConstRefAccessorToOptionalViaNonConstRefAccessorToHoldingObject) {
+  ExpectDiagnosticsFor(R"cc(
+    #include "unchecked_optional_access_test.h"
+
+    class A {
+      public:
+        const $ns::$optional<int>& get() const { return x; }
+
+      private:
+        $ns::$optional<int> x;
+    };
+
+    class B {
+      public:
+        A& getA() { return a; }
+
+      private:
+        A a;
+    };
+
+    void target(B& b) {
+      if (b.getA().get().has_value()) {
+        b.getA().get().value(); // [[unsafe]]
+      }
+    }
+  )cc");
+}
+
+TEST_P(
+    UncheckedOptionalAccessTest,
+    ConstRefAccessorToOptionalViaNonConstRefAccessorToHoldingObjectWithModAfterCheck) {
+  ExpectDiagnosticsFor(R"cc(
+    #include "unchecked_optional_access_test.h"
+
+    class A {
+      public:
+        const $ns::$optional<int>& get() const { return x; }
+      private:
+        $ns::$optional<int> x;
+    };
+
+    class B {
+      public:
+        const A& getA() const { return a; }
+
+        A& getA() { return a; }
+
+        void clear() { a = A{}; };
+
+      private:
+        A a;
+    };
+
+    void target(B& b) {
+      // changing field A via non-const getter after const getter check
+      if (b.getA().get().has_value()) {
+        b.getA() = A{};
+        b.getA().get().value(); // [[unsafe]]
+      }
+
+      // calling non-const method which might change field A
+      if (b.getA().get().has_value()) {
+        b.clear();
+        b.getA().get().value(); // [[unsafe]]
+      }
+    }
+  )cc");
+}
+
 // FIXME: Add support for:
 // - constructors (copy, move)
 // - assignment operators (default, copy, move)