[analyzer] Treat values passed as parameter as escaped

[t-8ch]

This is an accidental repost of #D131067

clang/lib/StaticAnalyzer/Checkers/DeadStoresChecker.cpp

 namespace {
 class FindEscaped {
 public:
   llvm::SmallPtrSet<const VarDecl*, 20> Escaped;
 
   void operator()(const Stmt *S) {
     // Check for '&'. Any VarDecl whose address has been taken we treat as
     // escaped.
-    // FIXME: What about references?
     if (auto *LE = dyn_cast<LambdaExpr>(S)) {
       findLambdaReferenceCaptures(LE);
       return;
     }
 
+    if (auto *CE = dyn_cast<CallExpr>(S)) {
+      findCallReferenceParameters(CE);
+      return;
+    }
+
+    if (auto *CE = dyn_cast<CXXConstructExpr>(S)) {
+      findConstructorReferenceParameters(CE);
+      return;
+    }
+
     const UnaryOperator *U = dyn_cast<UnaryOperator>(S);
     if (!U)
       return;
     if (U->getOpcode() != UO_AddrOf)
       return;
 
     const Expr *E = U->getSubExpr()->IgnoreParenCasts();
     if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(E))
for (const LambdaCapture &C : LE->captures()) {
       if (!FD)
         continue;
 
       // If the capture field is a reference type, it is capture-by-reference.
       if (FD->getType()->isReferenceType())
         Escaped.insert(VD);
     }
   }
+
+  void findReferenceParameter(const FunctionDecl *FD, const Expr *const *Args) {
+    unsigned numParams = FD->getNumParams();
+    for (unsigned i = 0; i < numParams; ++i) {
+      if (FD->getParamDecl(i)->getType()->isReferenceType()) {
+        if (auto *DRE = dyn_cast<DeclRefExpr>(Args[i])) {
+          if (auto *VD = dyn_cast<VarDecl>(DRE->getDecl())) {
+            Escaped.insert(VD);
+          }
+        }
+      }
+    }
+  }
+
+  void findCallReferenceParameters(const CallExpr *CE) {
+    if (auto *FD = dyn_cast<FunctionDecl>(CE->getCalleeDecl())) {
+      findReferenceParameter(FD, CE->getArgs());
+    }
+  }
+
+  void findConstructorReferenceParameters(const CXXConstructExpr *CE) {
+    findReferenceParameter(CE->getConstructor(), CE->getArgs());
+  }
 };
 } // end anonymous namespace
 
 
 //===----------------------------------------------------------------------===//
 // DeadStoresChecker
 //===----------------------------------------------------------------------===//
 

clang/test/Analysis/dead-stores.cpp

int basicLambda(int i, int j) {
   j = 6; // no warning
   [i] { (void)i; }();
   [&j] { (void)j; }();
   i = 2;
   j = 3;
   return i + j;
 }
 
+//===----------------------------------------------------------------------===//
+// Dead store checking involving references.
+//===----------------------------------------------------------------------===//
+
+void functionReferenceParameter(int &i) {
+  i = 5; // no warning
+}
+
+struct constructorReferenceParameter {
+  constructorReferenceParameter(int &i) {
+    i = 5; // no warning
+  }
+};
+
+void referenceParameters() {
+  int i = 5;
+  functionReferenceParameter(i);
+  i = 6;
+
+  int j = 7;
+  constructorReferenceParameter k(j);
+  j = 8;
+}