Updated CheckAddressOfOperand

[chrisbazley]

Summary

The semantics of the unary & operator are modified
so that if its operand has type "type" then its
result has type "pointer to type", with the omission
of any _Optional qualifier of the pointed-to type.

Also added a new helper method,
ASTContext::getNonOptionalType.

Rationale:

A new idiom &* is proposed to allow removal of the
_Optional qualifier from a pointee whilst allowing
static analyzers to check the validity of such
conversions. This is merely the simplest expression
that incorporates a semantic dereference without
actually accessing the pointed-to object.

There is only one way to get the address of an object
(excepting arithmetic), whereas there are many ways
to dereference a pointer. This is why the semantics
of & are modified rather than modifying *, [] and ->.
The operand of & is already treated specially, being
exempt from implicit conversion of an array type into
a pointer, for example.

[chrisbazley]

Please refer to https://discourse.llvm.org/t/rfc-optional-a-type-qualifier-to-indicate-pointer-nullability/ and https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3089.pdf for the wider context of this commit.

clang/include/clang/AST/ASTContext.h

QualType getUnqualifiedObjCPointerType(QualType type) const {
     if (!type.getTypePtr()->isObjCObjectPointerType() ||
         !type.getQualifiers().hasObjCLifetime())
       return type;
     Qualifiers Qs = type.getQualifiers();
     Qs.removeObjCLifetime();
     return getQualifiedType(type.getUnqualifiedType(), Qs);
   }
 
+  /// Return a type without the optional qualifier.
+  QualType getNonOptionalType(QualType type) const {
+    if (type.isLocalOptionalQualified()) {
+      type.removeLocalOptional();
+    } else if (type.isOptionalQualified()) {
+      Qualifiers Qs = type.getQualifiers();
+      Qs.removeOptional();
+      type = getQualifiedType(type.getUnqualifiedType(), Qs);
+    }
+    return type;
+  }
+
   unsigned char getFixedPointScale(QualType Ty) const;
   unsigned char getFixedPointIBits(QualType Ty) const;
   llvm::FixedPointSemantics getFixedPointSemantics(QualType Ty) const;
   llvm::APFixedPoint getFixedPointMax(QualType Ty) const;
   llvm::APFixedPoint getFixedPointMin(QualType Ty) const;
 
   DeclarationNameInfo getNameForTemplate(TemplateName Name,
                                          SourceLocation NameLoc) const;

clang/lib/Sema/SemaExpr.cpp

if (VarRef && VarRef->refersToEnclosingVariableOrCapture()) {
       Diag(op->getExprLoc(), diag::err_opencl_taking_address_capture);
       return QualType();
     }
   }
 
   if (getLangOpts().C99) {
     // Implement C99-only parts of addressof rules.
     if (UnaryOperator* uOp = dyn_cast<UnaryOperator>(op)) {
-      if (uOp->getOpcode() == UO_Deref)
+      if (uOp->getOpcode() == UO_Deref) {
         // Per C99 6.5.3.2, the address of a deref always returns a valid result
         // (assuming the deref expression is valid).
-        return uOp->getSubExpr()->getType();
+        auto Result = uOp->getSubExpr()->getType();
+        if (const PointerType *PT = Result->getAs<PointerType>()) {
+          // A dereferenced pointer is not a null pointer (by definition).
+          auto PointeeType = PT->getPointeeType();
+          Result =
+              Context.getPointerType(Context.getNonOptionalType(PointeeType));
+        }
+        return Result;
+      }
     }
     // Technically, there should be a check for array subscript
     // expressions here, but the result of one is always an lvalue anyway.
   }
   ValueDecl *dcl = getPrimaryDecl(op);
 
   if (auto *FD = dyn_cast_or_null<FunctionDecl>(dcl))
     if (!checkAddressOfFunctionIsAvailable(FD, /*Complain=*/true,
                                            op->getBeginLoc()))
       return QualType();
 
   Expr::LValueClassification lval = op->ClassifyLValue(Context);
   unsigned AddressOfError = AO_No_Error;
+  QualType Ty = Context.getNonOptionalType(op->getType());
 
   if (lval == Expr::LV_ClassTemporary || lval == Expr::LV_ArrayTemporary) {
     bool sfinae = (bool)isSFINAEContext();
     Diag(OpLoc, isSFINAEContext() ? diag::err_typecheck_addrof_temporary
                                   : diag::ext_typecheck_addrof_temporary)
       << op->getType() << op->getSourceRange();
     if (sfinae)
       return QualType();
     // Materialize the temporary as an lvalue so that we can take its address.
-    OrigOp = op =
-        CreateMaterializeTemporaryExpr(op->getType(), OrigOp.get(), true);
+    OrigOp = op = CreateMaterializeTemporaryExpr(Ty, OrigOp.get(), true);
   } else if (isa<ObjCSelectorExpr>(op)) {
-    return Context.getPointerType(op->getType());
+    return Context.getPointerType(Ty);
   } else if (lval == Expr::LV_MemberFunction) {
     // If it's an instance method, make a member pointer.
     // The expression must have exactly the form &A::foo.
 
     // If the underlying expression isn't a decl ref, give up.
     if (!isa<DeclRefExpr>(op)) {
       Diag(OpLoc, diag::err_invalid_form_pointer_member_function)
         << OrigOp.get()->getSourceRange();
// The method was named without a qualifier.
       }
     }
 
     // Taking the address of a dtor is illegal per C++ [class.dtor]p2.
     if (isa<CXXDestructorDecl>(MD))
       Diag(OpLoc, diag::err_typecheck_addrof_dtor) << op->getSourceRange();
 
     QualType MPTy = Context.getMemberPointerType(
-        op->getType(), Context.getTypeDeclType(MD->getParent()).getTypePtr());
+        Ty, Context.getTypeDeclType(MD->getParent()).getTypePtr());
     // Under the MS ABI, lock down the inheritance model now.
     if (Context.getTargetInfo().getCXXABI().isMicrosoft())
       (void)isCompleteType(OpLoc, MPTy);
     return MPTy;
   } else if (lval != Expr::LV_Valid && lval != Expr::LV_IncompleteVoidType) {
     // C99 6.5.3.2p1
     // The operand must be either an l-value or a function designator
-    if (!op->getType()->isFunctionType()) {
+    if (!Ty->isFunctionType()) {
       // Use a special diagnostic for loads from property references.
       if (isa<PseudoObjectExpr>(op)) {
         AddressOfError = AO_Property_Expansion;
       } else {
         Diag(OpLoc, diag::err_typecheck_invalid_lvalue_addrof)
           << op->getType() << op->getSourceRange();
         return QualType();
       }
if (const VarDecl *vd = dyn_cast<VarDecl>(dcl)) {
               << dcl->getDeclName() << dcl->getType();
             return QualType();
           }
 
           while (cast<RecordDecl>(Ctx)->isAnonymousStructOrUnion())
             Ctx = Ctx->getParent();
 
           QualType MPTy = Context.getMemberPointerType(
-              op->getType(),
-              Context.getTypeDeclType(cast<RecordDecl>(Ctx)).getTypePtr());
+              Ty, Context.getTypeDeclType(cast<RecordDecl>(Ctx)).getTypePtr());
           // Under the MS ABI, lock down the inheritance model now.
           if (Context.getTargetInfo().getCXXABI().isMicrosoft())
             (void)isCompleteType(OpLoc, MPTy);
           return MPTy;
         }
       }
     } else if (!isa<FunctionDecl, NonTypeTemplateParmDecl, BindingDecl,
                     MSGuidDecl, UnnamedGlobalConstantDecl>(dcl))
       llvm_unreachable("Unknown/unexpected decl type");
   }
 
   if (AddressOfError != AO_No_Error) {
     diagnoseAddressOfInvalidType(*this, OpLoc, op, AddressOfError);
     return QualType();
   }
 
   if (lval == Expr::LV_IncompleteVoidType) {
     // Taking the address of a void variable is technically illegal, but we
     // allow it in cases which are otherwise valid.
     // Example: "extern void x; void* y = &x;".
     Diag(OpLoc, diag::ext_typecheck_addrof_void) << op->getSourceRange();
   }
 
   // If the operand has type "type", the result has type "pointer to type".
-  if (op->getType()->isObjCObjectType())
-    return Context.getObjCObjectPointerType(op->getType());
+  if (Ty->isObjCObjectType())
+    return Context.getObjCObjectPointerType(Ty);
 
   CheckAddressOfPackedMember(op);
 
-  return Context.getPointerType(op->getType());
+  return Context.getPointerType(Ty);
 }
 
 static void RecordModifiableNonNullParam(Sema &S, const Expr *Exp) {
   const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Exp);
   if (!DRE)
     return;
   const Decl *D = DRE->getDecl();
   if (!D)