[clang][dataflow] Add analysis that detects unsafe accesses to optionals

[sgatev]

Summary

Adds a dataflow analysis that detects unsafe accesses to values of type
std::optional, absl::optional, or base::Optional.

Also moves TestingSupport.h|cc out of the unittest directory so that it
can be used by model tests.

[sgatev]

Mark functions as static and add TODOs.

[ymandel]

Maybe add explanation to the patch description for move of TestingSupport.h? Also, mention that this just a core implementation, and fuller support is coming?

clang/include/clang/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.h

21

Delete?

36–37

clang/lib/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.cpp

85

How are we confident that the has_value property is populated? Since we're only picking up on declr-refs and members, I think this won't hold otherwise.

[sgatev]

Address reviewers' comments.

[sgatev]

clang/include/clang/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.h

21

Why? I do think it makes sense to separate the model of optional types from the analysis that tracks unsafe uses. I don't think we're in a place to do the separation yet so that's why I added the FIXME.

clang/lib/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.cpp

85

I think that's fine. This isn't set in stone and can change as new tests are added. I don't claim that the implementation in this patch covers all features of the language.

[ymandel]

clang/include/clang/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.h

21

Sorry, I misread it. Fine as is.

[xazax.hun]

clang/lib/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.cpp

116

One very important omission seems to be optional::operator bool. This is a widely used method and I'd love to see it supported.

Also would love to see FIXMEs for some of the most more frequently used functions/methods:

• make_optional makes a non-empty optional
• swap (free function and method)
• value_or returning its argument when the optional is known to be empty
• Model the value semantics: Copy ctor, assignment operator
• Model the move semantics
• Default constructed optional is empty
• Invalidation: passing optional by non-const reference/pointer can invalidate its state

[sgatev]

Address reviewers' comments.

clang/lib/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.cpp

116

Most of these will be implemented in follow up patches soon and you can already find the list in the FIXME in UncheckedOptionalAccessModelTest.cpp. I added to it invalidation so that it covers all features you mentioned here.

[Szelethus]

Seems like all new files are missing the header blurb about the licence.

[sgatev]

In D121197#3385669, @Szelethus wrote:

Seems like all new files are missing the header blurb about the licence.

Thanks for spotting that! I'll prepare a patch to fix it.

clang/include/clang/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.h

+#ifndef CLANG_ANALYSIS_FLOWSENSITIVE_MODELS_UNCHECKEDOPTIONALACCESSMODEL_H
+#define CLANG_ANALYSIS_FLOWSENSITIVE_MODELS_UNCHECKEDOPTIONALACCESSMODEL_H
+
+#include "clang/AST/ASTContext.h"
+#include "clang/AST/Stmt.h"
+#include "clang/Analysis/FlowSensitive/DataflowAnalysis.h"
+#include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
+#include "clang/Analysis/FlowSensitive/MatchSwitch.h"
+#include "clang/Analysis/FlowSensitive/SourceLocationsLattice.h"
+
+namespace clang {
+namespace dataflow {
+
+/// Dataflow analysis that discovers unsafe accesses of optional values and
+/// adds the respective source locations to the lattice.
+///
+/// Models the `std::optional`, `absl::optional`, and `base::Optional` types.
+///
+/// FIXME: Consider separating the models from the unchecked access analysis.
+class UncheckedOptionalAccessModel
+    : public DataflowAnalysis<UncheckedOptionalAccessModel,
+                              SourceLocationsLattice> {
+public:
+  explicit UncheckedOptionalAccessModel(ASTContext &AstContext);
+
+  static SourceLocationsLattice initialElement() {
+    return SourceLocationsLattice();
+  }
+
+  void transfer(const Stmt *Stmt, SourceLocationsLattice &State,
+                Environment &Env);
+
+private:
+  MatchSwitch<TransferState<SourceLocationsLattice>> TransferMatchSwitch;
+};
+
+} // namespace dataflow
+} // namespace clang
+
+#endif // CLANG_ANALYSIS_FLOWSENSITIVE_MODELS_UNCHECKEDOPTIONALACCESSMODEL_H

clang/include/clang/Analysis/FlowSensitive/TestingSupport.h

 //===--- TestingSupport.h - Testing utils for dataflow analyses -*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // This file defines utilities to simplify testing of dataflow analyses.
 //
 //===----------------------------------------------------------------------===//
 
-#ifndef LLVM_CLANG_ANALYSIS_FLOW_SENSITIVE_TESTING_SUPPORT_H_
-#define LLVM_CLANG_ANALYSIS_FLOW_SENSITIVE_TESTING_SUPPORT_H_
+#ifndef CLANG_ANALYSIS_FLOWSENSITIVE_TESTING_SUPPORT_H
+#define CLANG_ANALYSIS_FLOWSENSITIVE_TESTING_SUPPORT_H
 
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/Stmt.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/ASTMatchers/ASTMatchers.h"
 #include "clang/ASTMatchers/ASTMatchersInternal.h"
 #include "clang/Analysis/CFG.h"

 ///
 ///  `Name` must be unique in `ASTCtx`.
 const ValueDecl *findValueDecl(ASTContext &ASTCtx, llvm::StringRef Name);
 
 } // namespace test
 } // namespace dataflow
 } // namespace clang
 
-#endif // LLVM_CLANG_ANALYSIS_FLOW_SENSITIVE_TESTING_SUPPORT_H_
+#endif // CLANG_ANALYSIS_FLOWSENSITIVE_TESTING_SUPPORT_H

clang/lib/Analysis/FlowSensitive/CMakeLists.txt

 add_clang_library(clangAnalysisFlowSensitive
   ControlFlowContext.cpp
   DataflowAnalysisContext.cpp
   DataflowEnvironment.cpp
   SourceLocationsLattice.cpp
+  TestingSupport.cpp
   Transfer.cpp
   TypeErasedDataflowAnalysis.cpp
   WatchedLiteralsSolver.cpp
 
   LINK_LIBS
   clangAnalysis
   clangAST
   clangBasic
   )
+
+add_subdirectory(Models)

clang/lib/Analysis/FlowSensitive/Models/CMakeLists.txt

+add_clang_library(clangAnalysisFlowSensitiveModels
+  UncheckedOptionalAccessModel.cpp
+
+  LINK_LIBS
+  clangAnalysis
+  clangAnalysisFlowSensitive
+  clangAST
+  clangASTMatchers
+  clangBasic
+  )

clang/lib/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.cpp

+#include "clang/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.h"
+#include "clang/AST/ASTContext.h"
+#include "clang/AST/Expr.h"
+#include "clang/AST/ExprCXX.h"
+#include "clang/AST/Stmt.h"
+#include "clang/ASTMatchers/ASTMatchers.h"
+#include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
+#include "clang/Analysis/FlowSensitive/MatchSwitch.h"
+#include "clang/Analysis/FlowSensitive/SourceLocationsLattice.h"
+#include "clang/Analysis/FlowSensitive/Value.h"
+#include "llvm/ADT/StringRef.h"
+#include "llvm/Support/Casting.h"
+#include <cassert>
+
+namespace clang {
+namespace dataflow {
+namespace {
+
+using namespace ::clang::ast_matchers;
+
+using LatticeTransferState = TransferState<SourceLocationsLattice>;
+
+static auto optionalClass() {
+  return classTemplateSpecializationDecl(
+      anyOf(hasName("std::optional"), hasName("std::__optional_storage_base"),
+            hasName("__optional_destruct_base"), hasName("absl::optional"),
+            hasName("base::Optional")),
+      hasTemplateArgument(0, refersToType(type().bind("T"))));
+}
+
+static auto hasOptionalType() { return hasType(optionalClass()); }
+
+static auto isOptionalMemberCallWithName(llvm::StringRef MemberName) {
+  return cxxMemberCallExpr(
+      on(expr(unless(cxxThisExpr()))),
+      callee(cxxMethodDecl(hasName(MemberName), ofClass(optionalClass()))));
+}
+
+static auto isOptionalOperatorCallWithName(llvm::StringRef OperatorName) {
+  return cxxOperatorCallExpr(hasOverloadedOperatorName(OperatorName),
+                             callee(cxxMethodDecl(ofClass(optionalClass()))));
+}
+
+/// Returns the symbolic value that represents the "has_value" property of the
+/// optional value `Val`. Returns null if `Val` is null.
+static BoolValue *getHasValue(Value *Val) {
+  if (auto *OptionalVal = cast_or_null<StructValue>(Val)) {
+    return cast<BoolValue>(OptionalVal->getProperty("has_value"));
+  }
+  return nullptr;
+}
+
+static void initializeOptionalReference(const Expr *OptionalExpr,
+                                        LatticeTransferState &State) {
+  if (auto *OptionalVal = cast_or_null<StructValue>(
+          State.Env.getValue(*OptionalExpr, SkipPast::Reference))) {
+    if (OptionalVal->getProperty("has_value") == nullptr) {
+      OptionalVal->setProperty("has_value", State.Env.makeAtomicBoolValue());
+    }
+  }
+}
+
+static void transferUnwrapCall(const Expr *UnwrapExpr, const Expr *ObjectExpr,
+                               LatticeTransferState &State) {
+  if (auto *OptionalVal = cast_or_null<StructValue>(
+          State.Env.getValue(*ObjectExpr, SkipPast::ReferenceThenPointer))) {
+    auto *HasValueVal = getHasValue(OptionalVal);
+    assert(HasValueVal != nullptr);
+
+    if (State.Env.flowConditionImplies(*HasValueVal))
+      return;
+  }
+
+  // Record that this unwrap is *not* provably safe.
+  State.Lattice.getSourceLocations().insert(ObjectExpr->getBeginLoc());
+}
+
+static void transferOptionalHasValueCall(const CXXMemberCallExpr *CallExpr,
+                                         LatticeTransferState &State) {
+  if (auto *OptionalVal = cast_or_null<StructValue>(
+          State.Env.getValue(*CallExpr->getImplicitObjectArgument(),
+                             SkipPast::ReferenceThenPointer))) {
+    auto *HasValueVal = getHasValue(OptionalVal);
+    assert(HasValueVal != nullptr);
+
+    auto &CallExprLoc = State.Env.createStorageLocation(*CallExpr);
+    State.Env.setValue(CallExprLoc, *HasValueVal);
+    State.Env.setStorageLocation(*CallExpr, CallExprLoc);
+  }
+}
+
+static auto buildTransferMatchSwitch() {
+  return MatchSwitchBuilder<LatticeTransferState>()
+      // Attach a symbolic "has_value" state to optional values that we see for
+      // the first time.
+      .CaseOf(expr(anyOf(declRefExpr(), memberExpr()), hasOptionalType()),
+              initializeOptionalReference)
+
+      // optional::value
+      .CaseOf(
+          isOptionalMemberCallWithName("value"),
+          +[](const CXXMemberCallExpr *E, LatticeTransferState &State) {
+            transferUnwrapCall(E, E->getImplicitObjectArgument(), State);
+          })
+
+      // optional::operator*, optional::operator->
+      .CaseOf(
+          expr(anyOf(isOptionalOperatorCallWithName("*"),
+                     isOptionalOperatorCallWithName("->"))),
+          +[](const CallExpr *E, LatticeTransferState &State) {
+            transferUnwrapCall(E, E->getArg(0), State);
+          })
+
+      // optional::has_value
+      .CaseOf(isOptionalMemberCallWithName("has_value"),
+              transferOptionalHasValueCall)
+
+      .Build();
+}
+
+} // namespace
+
+UncheckedOptionalAccessModel::UncheckedOptionalAccessModel(ASTContext &Ctx)
+    : DataflowAnalysis<UncheckedOptionalAccessModel, SourceLocationsLattice>(
+          Ctx),
+      TransferMatchSwitch(buildTransferMatchSwitch()) {}
+
+void UncheckedOptionalAccessModel::transfer(const Stmt *S,
+                                            SourceLocationsLattice &L,
+                                            Environment &Env) {
+  LatticeTransferState State(L, Env);
+  TransferMatchSwitch(*S, getASTContext(), State);
+}
+
+} // namespace dataflow
+} // namespace clang

clang/lib/Analysis/FlowSensitive/TestingSupport.cpp

-#include "TestingSupport.h"
+#include "clang/Analysis/FlowSensitive/TestingSupport.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/Stmt.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/ASTMatchers/ASTMatchers.h"
 #include "clang/Analysis/CFG.h"
 #include "clang/Analysis/FlowSensitive/DataflowAnalysis.h"
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"

clang/unittests/Analysis/FlowSensitive/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   FrontendOpenMP
   Support
   )
 
 add_clang_unittest(ClangAnalysisFlowSensitiveTests
   DataflowAnalysisContextTest.cpp
   DataflowEnvironmentTest.cpp
   MapLatticeTest.cpp
   MatchSwitchTest.cpp
   MultiVarConstantPropagationTest.cpp
   SingleVarConstantPropagationTest.cpp
   SourceLocationsLatticeTest.cpp
-  TestingSupport.cpp
   TestingSupportTest.cpp
   TransferTest.cpp
   TypeErasedDataflowAnalysisTest.cpp
   SolverTest.cpp
   )
 
 clang_target_link_libraries(ClangAnalysisFlowSensitiveTests
   PRIVATE
   clangAnalysis
   clangAnalysisFlowSensitive
   clangAST
   clangASTMatchers
   clangBasic
   clangFrontend
   clangLex
   clangSerialization
   clangTesting
   clangTooling
   )
 
 target_link_libraries(ClangAnalysisFlowSensitiveTests
   PRIVATE
   LLVMTestingSupport
   )
+
+add_subdirectory(Models)

clang/unittests/Analysis/FlowSensitive/DataflowEnvironmentTest.cpp

 //===- unittests/Analysis/FlowSensitive/DataflowEnvironmentTest.cpp -------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
 #include "NoopAnalysis.h"
-#include "TestingSupport.h"
 #include "clang/Analysis/FlowSensitive/DataflowAnalysisContext.h"
+#include "clang/Analysis/FlowSensitive/TestingSupport.h"
 #include "clang/Analysis/FlowSensitive/Value.h"
 #include "clang/Analysis/FlowSensitive/WatchedLiteralsSolver.h"
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include <memory>
 
 namespace {
 

clang/unittests/Analysis/FlowSensitive/MatchSwitchTest.cpp

 //===- unittests/Analysis/FlowSensitive/MatchSwitchTest.cpp ---------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines a simplistic version of Constant Propagation as an example
 //  of a forward, monotonic dataflow analysis. The analysis tracks all
 //  variables in the scope, but lacks escape analysis.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/Analysis/FlowSensitive/MatchSwitch.h"
-#include "TestingSupport.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/Stmt.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/ASTMatchers/ASTMatchers.h"
 #include "clang/Analysis/FlowSensitive/DataflowAnalysis.h"
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
 #include "clang/Analysis/FlowSensitive/DataflowLattice.h"
 #include "clang/Analysis/FlowSensitive/MapLattice.h"
+#include "clang/Analysis/FlowSensitive/TestingSupport.h"
 #include "clang/Tooling/Tooling.h"
 #include "llvm/ADT/None.h"
 #include "llvm/ADT/Optional.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/ADT/Twine.h"
 #include "llvm/Support/Error.h"
 #include "llvm/Testing/Support/Annotations.h"
 #include "llvm/Testing/Support/Error.h"

clang/unittests/Analysis/FlowSensitive/Models/CMakeLists.txt

+set(LLVM_LINK_COMPONENTS
+  FrontendOpenMP
+  Support
+  )
+
+add_clang_unittest(ClangAnalysisFlowSensitiveModelsTests
+  UncheckedOptionalAccessModelTest.cpp
+  )
+
+clang_target_link_libraries(ClangAnalysisFlowSensitiveModelsTests
+  PRIVATE
+  clangAnalysis
+  clangAnalysisFlowSensitive
+  clangAnalysisFlowSensitiveModels
+  clangAST
+  clangASTMatchers
+  clangBasic
+  clangFrontend
+  clangLex
+  clangSerialization
+  clangTesting
+  clangTooling
+  )
+
+target_link_libraries(ClangAnalysisFlowSensitiveModelsTests
+  PRIVATE
+  LLVMTestingSupport
+  )

clang/unittests/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModelTest.cpp

+#include "clang/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.h"
+#include "clang/AST/ASTContext.h"
+#include "clang/ASTMatchers/ASTMatchers.h"
+#include "clang/Analysis/FlowSensitive/SourceLocationsLattice.h"
+#include "clang/Analysis/FlowSensitive/TestingSupport.h"
+#include "clang/Tooling/Tooling.h"
+#include "llvm/ADT/ArrayRef.h"
+#include "llvm/ADT/StringExtras.h"
+#include "llvm/Support/Error.h"
+#include "gmock/gmock.h"
+#include "gtest/gtest.h"
+#include <string>
+#include <utility>
+#include <vector>
+
+using namespace clang;
+using namespace dataflow;
+using namespace test;
+
+using ::testing::Pair;
+using ::testing::UnorderedElementsAre;
+
+static constexpr char StdTypeTraitsHeader[] = R"(
+namespace std {
+
+template< class T > struct remove_reference      {typedef T type;};
+template< class T > struct remove_reference<T&>  {typedef T type;};
+template< class T > struct remove_reference<T&&> {typedef T type;};
+
+template <class T>
+  using remove_reference_t = typename remove_reference<T>::type;
+
+} // namespace std
+)";
+
+static constexpr char StdUtilityHeader[] = R"(
+#include "std_type_traits.h"
+
+namespace std {
+
+template <typename T>
+constexpr std::remove_reference_t<T>&& move(T&& x);
+
+} // namespace std
+)";
+
+static constexpr char StdOptionalHeader[] = R"(
+namespace std {
+
+template <typename T>
+class optional {
+ public:
+  constexpr optional() noexcept;
+
+  const T& operator*() const&;
+  T& operator*() &;
+  const T&& operator*() const&&;
+  T&& operator*() &&;
+
+  const T* operator->() const;
+  T* operator->();
+
+  const T& value() const&;
+  T& value() &;
+  const T&& value() const&&;
+  T&& value() &&;
+
+  constexpr bool has_value() const noexcept;
+};
+
+} // namespace std
+)";
+
+static constexpr char AbslOptionalHeader[] = R"(
+namespace absl {
+
+template <typename T>
+class optional {
+ public:
+  constexpr optional() noexcept;
+
+  const T& operator*() const&;
+  T& operator*() &;
+  const T&& operator*() const&&;
+  T&& operator*() &&;
+
+  const T* operator->() const;
+  T* operator->();
+
+  const T& value() const&;
+  T& value() &;
+  const T&& value() const&&;
+  T&& value() &&;
+
+  constexpr bool has_value() const noexcept;
+};
+
+} // namespace absl
+)";
+
+static constexpr char BaseOptionalHeader[] = R"(
+namespace base {
+
+template <typename T>
+class Optional {
+ public:
+  constexpr Optional() noexcept;
+
+  const T& operator*() const&;
+  T& operator*() &;
+  const T&& operator*() const&&;
+  T&& operator*() &&;
+
+  const T* operator->() const;
+  T* operator->();
+
+  const T& value() const&;
+  T& value() &;
+  const T&& value() const&&;
+  T&& value() &&;
+
+  constexpr bool has_value() const noexcept;
+};
+
+} // namespace base
+)";
+
+/// Converts `L` to string.
+static std::string ConvertToString(const SourceLocationsLattice &L,
+                                   const ASTContext &Ctx) {
+  return L.getSourceLocations().empty() ? "safe"
+                                        : "unsafe: " + DebugString(L, Ctx);
+}
+
+/// Replaces all occurrences of `Pattern` in `S` with `Replacement`.
+static void ReplaceAllOccurrences(std::string &S, const std::string &Pattern,
+                                  const std::string &Replacement) {
+  size_t Pos = 0;
+  while (true) {
+    Pos = S.find(Pattern, Pos);
+    if (Pos == std::string::npos)
+      break;
+    S.replace(Pos, Pattern.size(), Replacement);
+  }
+}
+
+struct OptionalTypeIdentifier {
+  std::string NamespaceName;
+  std::string TypeName;
+};
+
+class UncheckedOptionalAccessTest
+    : public ::testing::TestWithParam<OptionalTypeIdentifier> {
+protected:
+  template <typename LatticeChecksMatcher>
+  void ExpectLatticeChecksFor(std::string SourceCode,
+                              LatticeChecksMatcher MatchesLatticeChecks) {
+    ExpectLatticeChecksFor(SourceCode, ast_matchers::hasName("target"),
+                           MatchesLatticeChecks);
+  }
+
+private:
+  template <typename FuncDeclMatcher, typename LatticeChecksMatcher>
+  void ExpectLatticeChecksFor(std::string SourceCode,
+                              FuncDeclMatcher FuncMatcher,
+                              LatticeChecksMatcher MatchesLatticeChecks) {
+    ReplaceAllOccurrences(SourceCode, "$ns", GetParam().NamespaceName);
+    ReplaceAllOccurrences(SourceCode, "$optional", GetParam().TypeName);
+
+    std::vector<std::pair<std::string, std::string>> Headers;
+    Headers.emplace_back("std_type_traits.h", StdTypeTraitsHeader);
+    Headers.emplace_back("std_utility.h", StdUtilityHeader);
+    Headers.emplace_back("std_optional.h", StdOptionalHeader);
+    Headers.emplace_back("absl_optional.h", AbslOptionalHeader);
+    Headers.emplace_back("base_optional.h", BaseOptionalHeader);
+    Headers.emplace_back("unchecked_optional_access_test.h", R"(
+      #include "absl_optional.h"
+      #include "base_optional.h"
+      #include "std_optional.h"
+      #include "std_utility.h"
+    )");
+    const tooling::FileContentMappings FileContents(Headers.begin(),
+                                                    Headers.end());
+    llvm::Error Error = checkDataflow<UncheckedOptionalAccessModel>(
+        SourceCode, FuncMatcher,
+        [](ASTContext &Ctx, Environment &) {
+          return UncheckedOptionalAccessModel(Ctx);
+        },
+        [&MatchesLatticeChecks](
+            llvm::ArrayRef<std::pair<
+                std::string, DataflowAnalysisState<SourceLocationsLattice>>>
+                CheckToLatticeMap,
+            ASTContext &Ctx) {
+          // FIXME: Consider using a matcher instead of translating
+          // `CheckToLatticeMap` to `CheckToStringifiedLatticeMap`.
+          std::vector<std::pair<std::string, std::string>>
+              CheckToStringifiedLatticeMap;
+          for (const auto &E : CheckToLatticeMap) {
+            CheckToStringifiedLatticeMap.emplace_back(
+                E.first, ConvertToString(E.second.Lattice, Ctx));
+          }
+          EXPECT_THAT(CheckToStringifiedLatticeMap, MatchesLatticeChecks);
+        },
+        {"-fsyntax-only", "-std=c++17", "-Wno-undefined-inline"}, FileContents);
+    if (Error)
+      FAIL() << llvm::toString(std::move(Error));
+  }
+};
+
+INSTANTIATE_TEST_SUITE_P(
+    UncheckedOptionalUseTestInst, UncheckedOptionalAccessTest,
+    ::testing::Values(OptionalTypeIdentifier{"std", "optional"},
+                      OptionalTypeIdentifier{"absl", "optional"},
+                      OptionalTypeIdentifier{"base", "Optional"}),
+    [](const ::testing::TestParamInfo<OptionalTypeIdentifier> &Info) {
+      return Info.param.NamespaceName;
+    });
+
+TEST_P(UncheckedOptionalAccessTest, EmptyFunctionBody) {
+  ExpectLatticeChecksFor(R"(
+    void target() {
+      (void)0;
+      /*[[check]]*/
+    }
+  )",
+                         UnorderedElementsAre(Pair("check", "safe")));
+}
+
+TEST_P(UncheckedOptionalAccessTest, UnwrapUsingValueNoCheck) {
+  ExpectLatticeChecksFor(
+      R"(
+    #include "unchecked_optional_access_test.h"
+
+    void target($ns::$optional<int> opt) {
+      opt.value();
+      /*[[check]]*/
+    }
+  )",
+      UnorderedElementsAre(Pair("check", "unsafe: input.cc:5:7")));
+
+  ExpectLatticeChecksFor(
+      R"(
+    #include "unchecked_optional_access_test.h"
+
+    void target($ns::$optional<int> opt) {
+      std::move(opt).value();
+      /*[[check]]*/
+    }
+  )",
+      UnorderedElementsAre(Pair("check", "unsafe: input.cc:5:7")));
+}
+
+TEST_P(UncheckedOptionalAccessTest, UnwrapUsingOperatorStarNoCheck) {
+  ExpectLatticeChecksFor(
+      R"(
+    #include "unchecked_optional_access_test.h"
+
+    void target($ns::$optional<int> opt) {
+      *opt;
+      /*[[check]]*/
+    }
+  )",
+      UnorderedElementsAre(Pair("check", "unsafe: input.cc:5:8")));
+
+  ExpectLatticeChecksFor(
+      R"(
+    #include "unchecked_optional_access_test.h"
+
+    void target($ns::$optional<int> opt) {
+      *std::move(opt);
+      /*[[check]]*/
+    }
+  )",
+      UnorderedElementsAre(Pair("check", "unsafe: input.cc:5:8")));
+}
+
+TEST_P(UncheckedOptionalAccessTest, UnwrapUsingOperatorArrowNoCheck) {
+  ExpectLatticeChecksFor(
+      R"(
+    #include "unchecked_optional_access_test.h"
+
+    struct Foo {
+      void foo();
+    };
+
+    void target($ns::$optional<Foo> opt) {
+      opt->foo();
+      /*[[check]]*/
+    }
+  )",
+      UnorderedElementsAre(Pair("check", "unsafe: input.cc:9:7")));
+
+  ExpectLatticeChecksFor(
+      R"(
+    #include "unchecked_optional_access_test.h"
+
+    struct Foo {
+      void foo();
+    };
+
+    void target($ns::$optional<Foo> opt) {
+      std::move(opt)->foo();
+      /*[[check]]*/
+    }
+  )",
+      UnorderedElementsAre(Pair("check", "unsafe: input.cc:9:7")));
+}
+
+TEST_P(UncheckedOptionalAccessTest, UnwrapWithCheck) {
+  ExpectLatticeChecksFor(R"(
+    #include "unchecked_optional_access_test.h"
+
+    void target($ns::$optional<int> opt) {
+      if (opt.has_value()) {
+        opt.value();
+        /*[[check]]*/
+      }
+    }
+  )",
+                         UnorderedElementsAre(Pair("check", "safe")));
+}
+
+// FIXME: Add support for:
+// - constructors (default, copy, move, non-standard)
+// - assignment operators (default, copy, move, non-standard)
+// - operator bool
+// - emplace
+// - reset
+// - value_or
+// - swap
+// - make_optional
+// - invalidation (passing optional by non-const reference/pointer)

clang/unittests/Analysis/FlowSensitive/MultiVarConstantPropagationTest.cpp

 //===- unittests/Analysis/FlowSensitive/SingelVarConstantPropagation.cpp --===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines a simplistic version of Constant Propagation as an example
 //  of a forward, monotonic dataflow analysis. The analysis tracks all
 //  variables in the scope, but lacks escape analysis.
 //
 //===----------------------------------------------------------------------===//
 
-#include "TestingSupport.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/Stmt.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/ASTMatchers/ASTMatchers.h"
 #include "clang/Analysis/FlowSensitive/DataflowAnalysis.h"
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
 #include "clang/Analysis/FlowSensitive/DataflowLattice.h"
 #include "clang/Analysis/FlowSensitive/MapLattice.h"
+#include "clang/Analysis/FlowSensitive/TestingSupport.h"
 #include "clang/Tooling/Tooling.h"
 #include "llvm/ADT/None.h"
 #include "llvm/ADT/Optional.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/ADT/Twine.h"
 #include "llvm/Support/Error.h"
 #include "llvm/Testing/Support/Annotations.h"
 #include "llvm/Testing/Support/Error.h"

clang/unittests/Analysis/FlowSensitive/SingleVarConstantPropagationTest.cpp

 //===- unittests/Analysis/FlowSensitive/SingelVarConstantPropagation.cpp --===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // This file defines a simplistic version of Constant Propagation as an example
 // of a forward, monotonic dataflow analysis. The analysis only tracks one
 // variable at a time -- the one with the most recent declaration encountered.
 //
 //===----------------------------------------------------------------------===//
 
-#include "TestingSupport.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/Stmt.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/ASTMatchers/ASTMatchers.h"
 #include "clang/Analysis/FlowSensitive/DataflowAnalysis.h"
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
 #include "clang/Analysis/FlowSensitive/DataflowLattice.h"
+#include "clang/Analysis/FlowSensitive/TestingSupport.h"
 #include "clang/Tooling/Tooling.h"
 #include "llvm/ADT/None.h"
 #include "llvm/ADT/Optional.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/ADT/Twine.h"
 #include "llvm/Support/Error.h"
 #include "llvm/Testing/Support/Annotations.h"
 #include "llvm/Testing/Support/Error.h"

clang/unittests/Analysis/FlowSensitive/TestingSupportTest.cpp

-#include "TestingSupport.h"
+#include "clang/Analysis/FlowSensitive/TestingSupport.h"
 #include "NoopAnalysis.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/ASTMatchers/ASTMatchers.h"
 #include "clang/Tooling/Tooling.h"
 #include "llvm/Testing/Support/Error.h"
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

 //===- unittests/Analysis/FlowSensitive/TransferTest.cpp ------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "NoopAnalysis.h"
-#include "TestingSupport.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Decl.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/ASTMatchers/ASTMatchers.h"
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
 #include "clang/Analysis/FlowSensitive/StorageLocation.h"
+#include "clang/Analysis/FlowSensitive/TestingSupport.h"
 #include "clang/Analysis/FlowSensitive/Value.h"
 #include "clang/Basic/LangStandard.h"
 #include "llvm/ADT/ArrayRef.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/Support/Casting.h"
 #include "llvm/Testing/Support/Error.h"
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"

clang/unittests/Analysis/FlowSensitive/TypeErasedDataflowAnalysisTest.cpp

 //===- unittests/Analysis/FlowSensitive/TypeErasedDataflowAnalysisTest.cpp ===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "NoopAnalysis.h"
-#include "TestingSupport.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/ASTMatchers/ASTMatchers.h"
 #include "clang/Analysis/CFG.h"
 #include "clang/Analysis/FlowSensitive/DataflowAnalysis.h"
 #include "clang/Analysis/FlowSensitive/DataflowAnalysisContext.h"
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
 #include "clang/Analysis/FlowSensitive/DataflowLattice.h"
+#include "clang/Analysis/FlowSensitive/TestingSupport.h"
 #include "clang/Analysis/FlowSensitive/Value.h"
 #include "clang/Analysis/FlowSensitive/WatchedLiteralsSolver.h"
 #include "clang/Tooling/Tooling.h"
 #include "llvm/ADT/Optional.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallSet.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/Support/Error.h"