[clang][dataflow] Model the behavior of non-standard optional assignment

[sgatev]

Summary

Model nullopt, value, and conversion assignment operators.

[xazax.hun]

clang/lib/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.cpp

94

While really like the convenience matchers will give us building data flow analyses, I wonder whether a lot of duplicated work is happening in the background. E.g. will we end up string comparing the class name of the parent of the method in the matcher built by optionalClass whenever we process an overloaded operator=?

In a handwritten implementation we would only do this once, store the address of the canonical declaration somewhere and subsequent checks would only look up the canonical declaration of the called method and do a pointer comparison.

In case this matcher approach is not that efficient, I wonder if it would be possible to come up with some APIs where the matching is only done once and subsequent transfer functions would only use the cached pointers to declarations/types. In case the matchers are already doing something smart in the background feel free to ignore this comment.

173–174

If we never assign values to Parens, shouldn't getValue do the skipping instead?

296

Is this duplicated across here and transferValueOrConversionConstructor? Should we have a separate function like IsValueOperation?

[sgatev]

Address comments.

[sgatev]

clang/lib/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.cpp

94

That's a great point! Unfortunately, I'm not familiar with the implementation of matchers so I'll need to take a closer look/ask around to understand if such an optimization is already in place. Let me take a note of this for now. I suggest revising the APIs once we know more about the internals of matchers.

clang/include/clang/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.h

+//===-- UncheckedOptionalAccessModel.h --------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+//  This file defines a dataflow analysis that detects unsafe uses of optional
+//  values.
+//
+//===----------------------------------------------------------------------===//
+
 #ifndef CLANG_ANALYSIS_FLOWSENSITIVE_MODELS_UNCHECKEDOPTIONALACCESSMODEL_H
 #define CLANG_ANALYSIS_FLOWSENSITIVE_MODELS_UNCHECKEDOPTIONALACCESSMODEL_H
 
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Stmt.h"
 #include "clang/Analysis/FlowSensitive/DataflowAnalysis.h"
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
 #include "clang/Analysis/FlowSensitive/MatchSwitch.h"

clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp

 
 void Environment::setStorageLocation(const Expr &E, StorageLocation &Loc) {
   assert(ExprToLoc.find(&E) == ExprToLoc.end());
   ExprToLoc[&E] = &Loc;
 }
 
 StorageLocation *Environment::getStorageLocation(const Expr &E,
                                                  SkipPast SP) const {
-  auto It = ExprToLoc.find(&E);
+  // FIXME: Add a test with parens.
+  auto It = ExprToLoc.find(E.IgnoreParens());
   return It == ExprToLoc.end() ? nullptr : &skip(*It->second, SP);
 }
 
 StorageLocation *Environment::getThisPointeeStorageLocation() const {
   return DACtx->getThisPointeeStorageLocation();
 }
 
 void Environment::setValue(const StorageLocation &Loc, Value &Val) {

clang/lib/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.cpp

+//===-- UncheckedOptionalAccessModel.cpp ------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+//  This file defines a dataflow analysis that detects unsafe uses of optional
+//  values.
+//
+//===----------------------------------------------------------------------===//
+
 #include "clang/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/Stmt.h"
 #include "clang/ASTMatchers/ASTMatchers.h"
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
 #include "clang/Analysis/FlowSensitive/MatchSwitch.h"

 auto isOptionalValueOrConversionConstructor() {
   return cxxConstructExpr(
       hasOptionalType(),
       unless(hasDeclaration(
           cxxConstructorDecl(anyOf(isCopyConstructor(), isMoveConstructor())))),
       argumentCountIs(1), hasArgument(0, unless(hasNulloptType())));
 }
 
+auto isOptionalValueOrConversionAssignment() {
+  return cxxOperatorCallExpr(
+      hasOverloadedOperatorName("="),
+      callee(cxxMethodDecl(ofClass(optionalClass()))),
+      unless(hasDeclaration(cxxMethodDecl(
+          anyOf(isCopyAssignmentOperator(), isMoveAssignmentOperator())))),
+      argumentCountIs(2), hasArgument(1, unless(hasNulloptType())));
+}
+
+auto isOptionalNulloptAssignment() {
+  return cxxOperatorCallExpr(hasOverloadedOperatorName("="),
+                             callee(cxxMethodDecl(ofClass(optionalClass()))),
+                             argumentCountIs(2),
+                             hasArgument(1, hasNulloptType()));
+}
+
 /// Creates a symbolic value for an `optional` value using `HasValueVal` as the
 /// symbolic value of its "has_value" property.
 StructValue &createOptionalValue(Environment &Env, BoolValue &HasValueVal) {
   auto OptionalVal = std::make_unique<StructValue>();
   OptionalVal->setProperty("has_value", HasValueVal);
   return Env.takeOwnership(std::move(OptionalVal));
 }
 
if (OptionalVal->getProperty("has_value") == nullptr) {
       OptionalVal->setProperty("has_value", State.Env.makeAtomicBoolValue());
     }
   }
 }
 
 void transferUnwrapCall(const Expr *UnwrapExpr, const Expr *ObjectExpr,
                         LatticeTransferState &State) {
   if (auto *OptionalVal = cast_or_null<StructValue>(
           State.Env.getValue(*ObjectExpr, SkipPast::ReferenceThenPointer))) {
     auto *HasValueVal = getHasValue(OptionalVal);
     assert(HasValueVal != nullptr);
 
     if (State.Env.flowConditionImplies(*HasValueVal))
       return;
   }
 
   // Record that this unwrap is *not* provably safe.
   State.Lattice.getSourceLocations().insert(ObjectExpr->getBeginLoc());
void assignOptionalValue(const Expr &E, LatticeTransferState &State,
                          BoolValue &HasValueVal) {
   if (auto *OptionalLoc =
           State.Env.getStorageLocation(E, SkipPast::ReferenceThenPointer)) {
     State.Env.setValue(*OptionalLoc,
                        createOptionalValue(State.Env, HasValueVal));
   }
 }
 
+/// Returns a symbolic value for the "has_value" property of an `optional<T>`
+/// value that is constructed/assigned from a value of type `U` or `optional<U>`
+/// where `T` is constructible from `U`.
+BoolValue &
+getValueOrConversionHasValue(const FunctionDecl &F, const Expr &E,
+                             const MatchFinder::MatchResult &MatchRes,
+                             LatticeTransferState &State) {
+  assert(F.getTemplateSpecializationArgs()->size() > 0);
+
+  const int TemplateParamOptionalWrappersCount = countOptionalWrappers(
+      *MatchRes.Context,
+      stripReference(F.getTemplateSpecializationArgs()->get(0).getAsType()));
+  const int ArgTypeOptionalWrappersCount =
+      countOptionalWrappers(*MatchRes.Context, stripReference(E.getType()));
+
+  // Check if this is a constructor/assignment call for `optional<T>` with
+  // argument of type `U` such that `T` is constructible from `U`.
+  if (TemplateParamOptionalWrappersCount == ArgTypeOptionalWrappersCount)
+    return State.Env.getBoolLiteralValue(true);
+
+  // This is a constructor/assignment call for `optional<T>` with argument of
+  // type `optional<U>` such that `T` is constructible from `U`.
+  if (BoolValue *Val = getHasValue(State.Env.getValue(E, SkipPast::Reference)))
+    return *Val;
+  return State.Env.makeAtomicBoolValue();
+}
+
 void transferValueOrConversionConstructor(
     const CXXConstructExpr *E, const MatchFinder::MatchResult &MatchRes,
     LatticeTransferState &State) {
-  assert(E->getConstructor()->getTemplateSpecializationArgs()->size() > 0);
   assert(E->getNumArgs() > 0);
 
-  const int TemplateParamOptionalWrappersCount = countOptionalWrappers(
-      *MatchRes.Context, stripReference(E->getConstructor()
-                                            ->getTemplateSpecializationArgs()
-                                            ->get(0)
-                                            .getAsType()));
-  const int ArgTypeOptionalWrappersCount = countOptionalWrappers(
-      *MatchRes.Context, stripReference(E->getArg(0)->getType()));
-  auto *HasValueVal =
-      (TemplateParamOptionalWrappersCount == ArgTypeOptionalWrappersCount)
-          // This is a constructor call for optional<T> with argument of type U
-          // such that T is constructible from U.
-          ? &State.Env.getBoolLiteralValue(true)
-          // This is a constructor call for optional<T> with argument of type
-          // optional<U> such that T is constructible from U.
-          : getHasValue(State.Env.getValue(*E->getArg(0), SkipPast::Reference));
-  if (HasValueVal == nullptr)
-    HasValueVal = &State.Env.makeAtomicBoolValue();
+  assignOptionalValue(*E, State,
+                      getValueOrConversionHasValue(*E->getConstructor(),
+                                                   *E->getArg(0), MatchRes,
+                                                   State));
+}
 
-  assignOptionalValue(*E, State, *HasValueVal);
+void transferAssignment(const CXXOperatorCallExpr *E, BoolValue &HasValueVal,
+                        LatticeTransferState &State) {
+  assert(E->getNumArgs() > 0);
+
+  auto *OptionalLoc =
+      State.Env.getStorageLocation(*E->getArg(0), SkipPast::Reference);
+  assert(OptionalLoc != nullptr);
+
+  State.Env.setValue(*OptionalLoc, createOptionalValue(State.Env, HasValueVal));
+
+  // Assign a storage location for the whole expression.
+  State.Env.setStorageLocation(*E, *OptionalLoc);
+}
+
+void transferValueOrConversionAssignment(
+    const CXXOperatorCallExpr *E, const MatchFinder::MatchResult &MatchRes,
+    LatticeTransferState &State) {
+  assert(E->getNumArgs() > 1);
+  transferAssignment(E,
+                     getValueOrConversionHasValue(
+                         *E->getDirectCallee(), *E->getArg(1), MatchRes, State),
+                     State);
+}
+
+void transferNulloptAssignment(const CXXOperatorCallExpr *E,
+                               const MatchFinder::MatchResult &,
+                               LatticeTransferState &State) {
+  transferAssignment(E, State.Env.getBoolLiteralValue(false), State);
 }
 
 auto buildTransferMatchSwitch() {
+  // FIXME: Evaluate the efficiency of matchers. If using matchers results in a
+  // lot of duplicated work (e.g. string comparisons), consider providing APIs
+  // that avoid it through memoization.
   return MatchSwitchBuilder<LatticeTransferState>()
       // Attach a symbolic "has_value" state to optional values that we see for
       // the first time.
       .CaseOf<Expr>(expr(anyOf(declRefExpr(), memberExpr()), hasOptionalType()),
                     initializeOptionalReference)
 
       // make_optional
       .CaseOf<CallExpr>(isMakeOptionalCall(), transferMakeOptionalCall)
 
-      // constructors:
+      // optional::optional
       .CaseOf<CXXConstructExpr>(
           isOptionalInPlaceConstructor(),
           [](const CXXConstructExpr *E, const MatchFinder::MatchResult &,
              LatticeTransferState &State) {
             assignOptionalValue(*E, State, State.Env.getBoolLiteralValue(true));
           })
       .CaseOf<CXXConstructExpr>(
           isOptionalNulloptConstructor(),
           [](const CXXConstructExpr *E, const MatchFinder::MatchResult &,
              LatticeTransferState &State) {
             assignOptionalValue(*E, State,
                                 State.Env.getBoolLiteralValue(false));
           })
       .CaseOf<CXXConstructExpr>(isOptionalValueOrConversionConstructor(),
                                 transferValueOrConversionConstructor)
 
+      // optional::operator=
+      .CaseOf<CXXOperatorCallExpr>(isOptionalValueOrConversionAssignment(),
+                                   transferValueOrConversionAssignment)
+      .CaseOf<CXXOperatorCallExpr>(isOptionalNulloptAssignment(),
+                                   transferNulloptAssignment)
+
       // optional::value
       .CaseOf<CXXMemberCallExpr>(
           isOptionalMemberCallWithName("value"),
           [](const CXXMemberCallExpr *E, const MatchFinder::MatchResult &,
              LatticeTransferState &State) {
             transferUnwrapCall(E, E->getImplicitObjectArgument(), State);
           })
 

clang/lib/Analysis/FlowSensitive/Transfer.cpp

if (S->getOperator() == OO_Equal) {
       auto *ObjectLoc = Env.getStorageLocation(*Arg0, SkipPast::Reference);
       if (ObjectLoc == nullptr)
         return;
 
       auto *Val = Env.getValue(*Arg1, SkipPast::Reference);
       if (Val == nullptr)
         return;
 
+      // Assign a value to the storage location of the object.
       Env.setValue(*ObjectLoc, *Val);
+
+      // FIXME: Add a test for the value of the whole expression.
+      // Assign a storage location for the whole expression.
+      Env.setStorageLocation(*S, *ObjectLoc);
     }
   }
 
   void VisitCXXFunctionalCastExpr(const CXXFunctionalCastExpr *S) {
     if (S->getCastKind() == CK_ConstructorConversion) {
       // The CFG does not contain `ParenExpr` as top-level statements in basic
       // blocks, however sub-expressions can still be of that type.
       assert(S->getSubExpr() != nullptr);

clang/unittests/Analysis/FlowSensitive/UncheckedOptionalAccessModelTest.cpp

 using namespace clang;
 using namespace dataflow;
 using namespace test;
 
 using ::testing::Pair;
 using ::testing::UnorderedElementsAre;
 
 // FIXME: Move header definitions in separate file(s).
+static constexpr char CSDtdDefHeader[] = R"(
+#ifndef CSTDDEF_H
+#define CSTDDEF_H
+
+namespace std {
+
+typedef decltype(sizeof(char)) size_t;
+
+using nullptr_t = decltype(nullptr);
+
+} // namespace std
+
+#endif // CSTDDEF_H
+)";
+
 static constexpr char StdTypeTraitsHeader[] = R"(
 #ifndef STD_TYPE_TRAITS_H
 #define STD_TYPE_TRAITS_H
 
-namespace std {
+#include "cstddef.h"
 
-typedef decltype(sizeof(char)) size_t;
+namespace std {
 
 template <typename T, T V>
 struct integral_constant {
   static constexpr T value = V;
 };
 
 using true_type = integral_constant<bool, true>;
 using false_type = integral_constant<bool, false>;

 using __expand_to_true = true_type;
 template <class... _Pred>
 __expand_to_true<__enable_if_t<_Pred::value>...> __and_helper(int);
 template <class...>
 false_type __and_helper(...);
 template <class... _Pred>
 using _And = decltype(__and_helper<_Pred...>(0));
 
+template <class _Pred>
+struct _Not : _BoolConstant<!_Pred::value> {};
+
 struct __check_tuple_constructor_fail {
   static constexpr bool __enable_explicit_default() { return false; }
   static constexpr bool __enable_implicit_default() { return false; }
   template <class...>
   static constexpr bool __enable_explicit() {
     return false;
   }
   template <class...>
   static constexpr bool __enable_implicit() {
     return false;
   }
 };
 
+template <typename, typename _Tp>
+struct __select_2nd {
+  typedef _Tp type;
+};
+template <class _Tp, class _Arg>
+typename __select_2nd<decltype((declval<_Tp>() = declval<_Arg>())),
+                      true_type>::type
+__is_assignable_test(int);
+template <class, class>
+false_type __is_assignable_test(...);
+template <class _Tp, class _Arg,
+          bool = is_void<_Tp>::value || is_void<_Arg>::value>
+struct __is_assignable_imp
+    : public decltype((__is_assignable_test<_Tp, _Arg>(0))) {};
+template <class _Tp, class _Arg>
+struct __is_assignable_imp<_Tp, _Arg, true> : public false_type {};
+template <class _Tp, class _Arg>
+struct is_assignable : public __is_assignable_imp<_Tp, _Arg> {};
+
+template <class _Tp>
+struct __libcpp_is_integral : public false_type {};
+template <>
+struct __libcpp_is_integral<bool> : public true_type {};
+template <>
+struct __libcpp_is_integral<char> : public true_type {};
+template <>
+struct __libcpp_is_integral<signed char> : public true_type {};
+template <>
+struct __libcpp_is_integral<unsigned char> : public true_type {};
+template <>
+struct __libcpp_is_integral<wchar_t> : public true_type {};
+template <>
+struct __libcpp_is_integral<short> : public true_type {};  // NOLINT
+template <>
+struct __libcpp_is_integral<unsigned short> : public true_type {};  // NOLINT
+template <>
+struct __libcpp_is_integral<int> : public true_type {};
+template <>
+struct __libcpp_is_integral<unsigned int> : public true_type {};
+template <>
+struct __libcpp_is_integral<long> : public true_type {};  // NOLINT
+template <>
+struct __libcpp_is_integral<unsigned long> : public true_type {};  // NOLINT
+template <>
+struct __libcpp_is_integral<long long> : public true_type {};  // NOLINT
+template <>                                                    // NOLINTNEXTLINE
+struct __libcpp_is_integral<unsigned long long> : public true_type {};
+template <class _Tp>
+struct is_integral
+    : public __libcpp_is_integral<typename remove_cv<_Tp>::type> {};
+
+template <class _Tp>
+struct __libcpp_is_floating_point : public false_type {};
+template <>
+struct __libcpp_is_floating_point<float> : public true_type {};
+template <>
+struct __libcpp_is_floating_point<double> : public true_type {};
+template <>
+struct __libcpp_is_floating_point<long double> : public true_type {};
+template <class _Tp>
+struct is_floating_point
+    : public __libcpp_is_floating_point<typename remove_cv<_Tp>::type> {};
+
+template <class _Tp>
+struct is_arithmetic
+    : public integral_constant<bool, is_integral<_Tp>::value ||
+                                         is_floating_point<_Tp>::value> {};
+
+template <class _Tp>
+struct __libcpp_is_pointer : public false_type {};
+template <class _Tp>
+struct __libcpp_is_pointer<_Tp*> : public true_type {};
+template <class _Tp>
+struct is_pointer : public __libcpp_is_pointer<typename remove_cv<_Tp>::type> {
+};
+
+template <class _Tp>
+struct __libcpp_is_member_pointer : public false_type {};
+template <class _Tp, class _Up>
+struct __libcpp_is_member_pointer<_Tp _Up::*> : public true_type {};
+template <class _Tp>
+struct is_member_pointer
+    : public __libcpp_is_member_pointer<typename remove_cv<_Tp>::type> {};
+
+template <class _Tp>
+struct __libcpp_union : public false_type {};
+template <class _Tp>
+struct is_union : public __libcpp_union<typename remove_cv<_Tp>::type> {};
+
+template <class T>
+struct is_reference : false_type {};
+template <class T>
+struct is_reference<T&> : true_type {};
+template <class T>
+struct is_reference<T&&> : true_type {};
+
+template <class T>
+inline constexpr bool is_reference_v = is_reference<T>::value;
+
+struct __two {
+  char __lx[2];
+};
+
+namespace __is_class_imp {
+template <class _Tp>
+char __test(int _Tp::*);
+template <class _Tp>
+__two __test(...);
+}  // namespace __is_class_imp
+template <class _Tp>
+struct is_class
+    : public integral_constant<bool,
+                               sizeof(__is_class_imp::__test<_Tp>(0)) == 1 &&
+                                   !is_union<_Tp>::value> {};
+
+template <class _Tp>
+struct __is_nullptr_t_impl : public false_type {};
+template <>
+struct __is_nullptr_t_impl<nullptr_t> : public true_type {};
+template <class _Tp>
+struct __is_nullptr_t
+    : public __is_nullptr_t_impl<typename remove_cv<_Tp>::type> {};
+template <class _Tp>
+struct is_null_pointer
+    : public __is_nullptr_t_impl<typename remove_cv<_Tp>::type> {};
+
+template <class _Tp>
+struct is_enum
+    : public integral_constant<
+          bool, !is_void<_Tp>::value && !is_integral<_Tp>::value &&
+                    !is_floating_point<_Tp>::value && !is_array<_Tp>::value &&
+                    !is_pointer<_Tp>::value && !is_reference<_Tp>::value &&
+                    !is_member_pointer<_Tp>::value && !is_union<_Tp>::value &&
+                    !is_class<_Tp>::value && !is_function<_Tp>::value> {};
+
+template <class _Tp>
+struct is_scalar
+    : public integral_constant<
+          bool, is_arithmetic<_Tp>::value || is_member_pointer<_Tp>::value ||
+                    is_pointer<_Tp>::value || __is_nullptr_t<_Tp>::value ||
+                    is_enum<_Tp>::value> {};
+template <>
+struct is_scalar<nullptr_t> : public true_type {};
+
 } // namespace std
 
 #endif // STD_TYPE_TRAITS_H
 )";
 
 static constexpr char AbslTypeTraitsHeader[] = R"(
 #ifndef ABSL_TYPE_TRAITS_H
 #define ABSL_TYPE_TRAITS_H
private:
   };
 
   template <class _Up, class _QualUp>
   using _CheckOptionalLikeCtor =
       _If<_And<_IsNotSame<_Up, _Tp>, is_constructible<_Tp, _QualUp>>::value,
           _CheckOptionalLikeConstructor<_QualUp>,
           __check_tuple_constructor_fail>;
 
+
+  template <class _Up, class _QualUp>
+  using _CheckOptionalLikeAssign = _If<
+      _And<
+          _IsNotSame<_Up, _Tp>,
+          is_constructible<_Tp, _QualUp>,
+          is_assignable<_Tp&, _QualUp>
+      >::value,
+      _CheckOptionalLikeConstructor<_QualUp>,
+      __check_tuple_constructor_fail
+    >;
+
  public:
   constexpr optional() noexcept {}
   constexpr optional(const optional&) = default;
   constexpr optional(optional&&) = default;
   constexpr optional(nullopt_t) noexcept {}
 
   template <
       class _InPlaceT, class... _Args,
template <class _Up, enable_if_t<_CheckOptionalLikeCtor<_Up, _Up&&>::
                                  int> = 0>
   constexpr optional(optional<_Up>&& __v);
 
   template <class _Up, enable_if_t<_CheckOptionalLikeCtor<_Up, _Up&&>::
                                      template __enable_explicit<_Up>(),
                                  int> = 0>
   constexpr explicit optional(optional<_Up>&& __v);
 
+  constexpr optional& operator=(nullopt_t) noexcept;
+
+  optional& operator=(const optional&);
+
+  optional& operator=(optional&&);
+
+  template <class _Up = value_type,
+            class = enable_if_t<_And<_IsNotSame<__uncvref_t<_Up>, optional>,
+                                   _Or<_IsNotSame<__uncvref_t<_Up>, value_type>,
+                                       _Not<is_scalar<value_type>>>,
+                                   is_constructible<value_type, _Up>,
+                                   is_assignable<value_type&, _Up>>::value>>
+  constexpr optional& operator=(_Up&& __v);
+
+  template <class _Up, enable_if_t<_CheckOptionalLikeAssign<_Up, _Up const&>::
+                                     template __enable_assign<_Up>(),
+                                 int> = 0>
+  constexpr optional& operator=(const optional<_Up>& __v);
+
+  template <class _Up, enable_if_t<_CheckOptionalLikeCtor<_Up, _Up&&>::
+                                     template __enable_assign<_Up>(),
+                                 int> = 0>
+  constexpr optional& operator=(optional<_Up>&& __v);
+
   const _Tp& operator*() const&;
   _Tp& operator*() &;
   const _Tp&& operator*() const&&;
   _Tp&& operator*() &&;
 
   const _Tp* operator->() const;
   _Tp* operator->();
 

 struct in_place_t {};
 constexpr in_place_t in_place;
 
 template <typename T>
 class optional;
 
 namespace optional_internal {
 
-// Whether T is constructible or convertible from optional<U>.
 template <typename T, typename U>
 struct is_constructible_convertible_from_optional
     : std::integral_constant<
           bool, std::is_constructible<T, optional<U>&>::value ||
                     std::is_constructible<T, optional<U>&&>::value ||
                     std::is_constructible<T, const optional<U>&>::value ||
                     std::is_constructible<T, const optional<U>&&>::value ||
                     std::is_convertible<optional<U>&, T>::value ||
                     std::is_convertible<optional<U>&&, T>::value ||
                     std::is_convertible<const optional<U>&, T>::value ||
                     std::is_convertible<const optional<U>&&, T>::value> {};
 
+template <typename T, typename U>
+struct is_constructible_convertible_assignable_from_optional
+    : std::integral_constant<
+          bool, is_constructible_convertible_from_optional<T, U>::value ||
+                    std::is_assignable<T&, optional<U>&>::value ||
+                    std::is_assignable<T&, optional<U>&&>::value ||
+                    std::is_assignable<T&, const optional<U>&>::value ||
+                    std::is_assignable<T&, const optional<U>&&>::value> {};
+
 }  // namespace optional_internal
 
 template <typename T>
 class optional {
  public:
   constexpr optional() noexcept;
 
   constexpr optional(nullopt_t) noexcept;
template <
               absl::negation<std::is_same<T, U>>, std::is_constructible<T, U&&>,
               absl::negation<
                   optional_internal::is_constructible_convertible_from_optional<
                       T, U>>,
               absl::negation<std::is_convertible<U&&, T>>>::value,
           bool>::type = false>
   explicit optional(optional<U>&& rhs);
 
+  optional& operator=(nullopt_t) noexcept;
+
+  optional& operator=(const optional& src);
+
+  optional& operator=(optional&& src);
+
+  template <
+      typename U = T,
+      typename = typename std::enable_if<absl::conjunction<
+          absl::negation<
+              std::is_same<optional<T>, typename std::decay<U>::type>>,
+          absl::negation<
+              absl::conjunction<std::is_scalar<T>,
+                                std::is_same<T, typename std::decay<U>::type>>>,
+          std::is_constructible<T, U>, std::is_assignable<T&, U>>::value>::type>
+  optional& operator=(U&& v);
+
+  template <
+      typename U,
+      typename = typename std::enable_if<absl::conjunction<
+          absl::negation<std::is_same<T, U>>,
+          std::is_constructible<T, const U&>, std::is_assignable<T&, const U&>,
+          absl::negation<
+              optional_internal::
+                  is_constructible_convertible_assignable_from_optional<
+                      T, U>>>::value>::type>
+  optional& operator=(const optional<U>& rhs);
+
+  template <typename U,
+            typename = typename std::enable_if<absl::conjunction<
+                absl::negation<std::is_same<T, U>>, std::is_constructible<T, U>,
+                std::is_assignable<T&, U>,
+                absl::negation<
+                    optional_internal::
+                        is_constructible_convertible_assignable_from_optional<
+                            T, U>>>::value>::type>
+  optional& operator=(optional<U>&& rhs);
+
   const T& operator*() const&;
   T& operator*() &;
   const T&& operator*() const&&;
   T&& operator*() &&;
 
   const T* operator->() const;
   T* operator->();
 
: std::integral_constant<
                     std::is_constructible<T, const Optional<U>&>::value ||
                     std::is_constructible<T, Optional<U>&&>::value ||
                     std::is_constructible<T, const Optional<U>&&>::value ||
                     std::is_convertible<Optional<U>&, T>::value ||
                     std::is_convertible<const Optional<U>&, T>::value ||
                     std::is_convertible<Optional<U>&&, T>::value ||
                     std::is_convertible<const Optional<U>&&, T>::value> {};
 
+template <typename T, typename U>
+struct IsAssignableFromOptional
+    : std::integral_constant<
+          bool, IsConvertibleFromOptional<T, U>::value ||
+                    std::is_assignable<T&, Optional<U>&>::value ||
+                    std::is_assignable<T&, const Optional<U>&>::value ||
+                    std::is_assignable<T&, Optional<U>&&>::value ||
+                    std::is_assignable<T&, const Optional<U>&&>::value> {};
+
 }  // namespace internal
 
 template <typename T>
 class Optional {
  public:
   using value_type = T;
 
   constexpr Optional() = default;
template <
       typename std::enable_if<
           std::is_constructible<T, U&&>::value &&
               !std::is_same<internal::RemoveCvRefT<U>, in_place_t>::value &&
               !std::is_same<internal::RemoveCvRefT<U>, Optional<T>>::value &&
               !std::is_convertible<U&&, T>::value,
           bool>::type = false>
   constexpr explicit Optional(U&& value);
 
+  Optional& operator=(const Optional& other) noexcept;
+
+  Optional& operator=(Optional&& other) noexcept;
+
+  Optional& operator=(nullopt_t);
+
+  template <typename U>
+  typename std::enable_if<
+      !std::is_same<internal::RemoveCvRefT<U>, Optional<T>>::value &&
+          std::is_constructible<T, U>::value &&
+          std::is_assignable<T&, U>::value &&
+          (!std::is_scalar<T>::value ||
+           !std::is_same<typename std::decay<U>::type, T>::value),
+      Optional&>::type
+  operator=(U&& value) noexcept;
+
+  template <typename U>
+  typename std::enable_if<!internal::IsAssignableFromOptional<T, U>::value &&
+                              std::is_constructible<T, const U&>::value &&
+                              std::is_assignable<T&, const U&>::value,
+                          Optional&>::type
+  operator=(const Optional<U>& other) noexcept;
+
+  template <typename U>
+  typename std::enable_if<!internal::IsAssignableFromOptional<T, U>::value &&
+                              std::is_constructible<T, U>::value &&
+                              std::is_assignable<T&, U>::value,
+                          Optional&>::type
+  operator=(Optional<U>&& other) noexcept;
+
   const T& operator*() const&;
   T& operator*() &;
   const T&& operator*() const&&;
   T&& operator*() &&;
 
   const T* operator->() const;
   T* operator->();
 
private:
   template <typename FuncDeclMatcher, typename LatticeChecksMatcher>
   void ExpectLatticeChecksFor(std::string SourceCode,
                               FuncDeclMatcher FuncMatcher,
                               LatticeChecksMatcher MatchesLatticeChecks) {
     ReplaceAllOccurrences(SourceCode, "$ns", GetParam().NamespaceName);
     ReplaceAllOccurrences(SourceCode, "$optional", GetParam().TypeName);
 
     std::vector<std::pair<std::string, std::string>> Headers;
+    Headers.emplace_back("cstddef.h", CSDtdDefHeader);
     Headers.emplace_back("std_initializer_list.h", StdInitializerListHeader);
     Headers.emplace_back("std_type_traits.h", StdTypeTraitsHeader);
     Headers.emplace_back("std_utility.h", StdUtilityHeader);
     Headers.emplace_back("std_optional.h", StdOptionalHeader);
     Headers.emplace_back("absl_type_traits.h", AbslTypeTraitsHeader);
     Headers.emplace_back("absl_optional.h", AbslOptionalHeader);
     Headers.emplace_back("base_optional.h", BaseOptionalHeader);
     Headers.emplace_back("unchecked_optional_access_test.h", R"(
void target($ns::$optional<int> &opt) {
       }
     }
   )",
       UnorderedElementsAre(Pair("check", "unsafe: input.cc:7:9")));
 
   // FIXME: Add tests that call `reset` in conditional branches.
 }
 
+TEST_P(UncheckedOptionalAccessTest, ValueAssignment) {
+  ExpectLatticeChecksFor(R"(
+    #include "unchecked_optional_access_test.h"
+
+    struct Foo {};
+
+    void target() {
+      $ns::$optional<Foo> opt;
+      opt = Foo();
+      opt.value();
+      /*[[check]]*/
+    }
+  )",
+                         UnorderedElementsAre(Pair("check", "safe")));
+
+  ExpectLatticeChecksFor(R"(
+    #include "unchecked_optional_access_test.h"
+
+    struct Foo {};
+
+    void target() {
+      $ns::$optional<Foo> opt;
+      (opt = Foo()).value();
+      (void)0;
+      /*[[check]]*/
+    }
+  )",
+                         UnorderedElementsAre(Pair("check", "safe")));
+
+  ExpectLatticeChecksFor(R"(
+    #include "unchecked_optional_access_test.h"
+
+    struct MyString {
+      MyString(const char*);
+    };
+
+    void target() {
+      $ns::$optional<MyString> opt;
+      opt = "foo";
+      opt.value();
+      /*[[check]]*/
+    }
+  )",
+                         UnorderedElementsAre(Pair("check", "safe")));
+
+  ExpectLatticeChecksFor(R"(
+    #include "unchecked_optional_access_test.h"
+
+    struct MyString {
+      MyString(const char*);
+    };
+
+    void target() {
+      $ns::$optional<MyString> opt;
+      (opt = "foo").value();
+      /*[[check]]*/
+    }
+  )",
+                         UnorderedElementsAre(Pair("check", "safe")));
+}
+
+TEST_P(UncheckedOptionalAccessTest, OptionalConversionAssignment) {
+  ExpectLatticeChecksFor(
+      R"(
+    #include "unchecked_optional_access_test.h"
+
+    struct Foo {};
+
+    struct Bar {
+      Bar(const Foo&);
+    };
+
+    void target() {
+      $ns::$optional<Foo> opt1 = Foo();
+      $ns::$optional<Bar> opt2;
+      opt2 = opt1;
+      opt2.value();
+      /*[[check]]*/
+    }
+  )",
+      UnorderedElementsAre(Pair("check", "safe")));
+
+  ExpectLatticeChecksFor(
+      R"(
+    #include "unchecked_optional_access_test.h"
+
+    struct Foo {};
+
+    struct Bar {
+      Bar(const Foo&);
+    };
+
+    void target() {
+      $ns::$optional<Foo> opt1;
+      $ns::$optional<Bar> opt2;
+      if (opt2.has_value()) {
+        opt2 = opt1;
+        opt2.value();
+        /*[[check]]*/
+      }
+    }
+  )",
+      UnorderedElementsAre(Pair("check", "unsafe: input.cc:15:9")));
+
+  ExpectLatticeChecksFor(
+      R"(
+    #include "unchecked_optional_access_test.h"
+
+    struct Foo {};
+
+    struct Bar {
+      Bar(const Foo&);
+    };
+
+    void target() {
+      $ns::$optional<Foo> opt1 = Foo();
+      $ns::$optional<Bar> opt2;
+      (opt2 = opt1).value();
+      (void)0;
+      /*[[check]]*/
+    }
+  )",
+      UnorderedElementsAre(Pair("check", "safe")));
+}
+
+TEST_P(UncheckedOptionalAccessTest, NulloptAssignment) {
+  ExpectLatticeChecksFor(
+      R"(
+    #include "unchecked_optional_access_test.h"
+
+    void target() {
+      $ns::$optional<int> opt = 3;
+      opt = $ns::nullopt;
+      opt.value();
+      /*[[check]]*/
+    }
+  )",
+      UnorderedElementsAre(Pair("check", "unsafe: input.cc:7:7")));
+
+  ExpectLatticeChecksFor(
+      R"(
+    #include "unchecked_optional_access_test.h"
+
+    void target() {
+      $ns::$optional<int> opt = 3;
+      (opt = $ns::nullopt).value();
+      /*[[check]]*/
+    }
+  )",
+      UnorderedElementsAre(Pair("check", "unsafe: input.cc:6:7")));
+}
+
 // FIXME: Add support for:
 // - constructors (copy, move)
-// - assignment operators (default, copy, move, non-standard)
+// - assignment operators (default, copy, move)
 // - swap
 // - invalidation (passing optional by non-const reference/pointer)
 // - `value_or(nullptr) != nullptr`, `value_or(0) != 0`, `value_or("").empty()`
 // - nested `optional` values