[clang][dataflow] Don't crash if copy constructor arg doesn't have a storage location.

[mboehme]

Summary

I accidentally used cast instead of cast_or_null.

[mboehme]

Pre-merge failures look unrelated

clang/lib/Analysis/FlowSensitive/Transfer.cpp

void VisitCXXConstructExpr(const CXXConstructExpr *S) {
     if (ConstructorDecl->isCopyOrMoveConstructor()) {
       // It is permissible for a copy/move constructor to have additional
       // parameters as long as they have default arguments defined for them.
       assert(S->getNumArgs() != 0);
 
       const Expr *Arg = S->getArg(0);
       assert(Arg != nullptr);
 
-      auto *ArgLoc = cast<AggregateStorageLocation>(
+      auto *ArgLoc = cast_or_null<AggregateStorageLocation>(
           Env.getStorageLocation(*Arg, SkipPast::Reference));
       if (ArgLoc == nullptr)
         return;
 
       if (S->isElidable()) {
         Env.setStorageLocation(*S, *ArgLoc);
       } else {
         auto &Loc =

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

runDataflow(
         const auto *FooBazVal =
             cast<IntegerValue>(Env.getValue(FooLoc->getChild(*BazDecl)));
         const auto *BarBazVal =
             cast<IntegerValue>(Env.getValue(BarLoc->getChild(*BazDecl)));
         EXPECT_EQ(FooBazVal, BarBazVal);
       });
 }
 
+TEST(TransferTest, CopyConstructorArgIsRefReturnedByFunction) {
+  // This is a crash repro.
+  std::string Code = R"(
+    struct S {};
+    const S &returnsSRef();
+    void target() {
+      S s(returnsSRef());
+    }
+  )";
+  runDataflow(
+      Code,
+      [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,
+         ASTContext &ASTCtx) {});
+}
+
 TEST(TransferTest, MoveConstructor) {
   std::string Code = R"(
     namespace std {
 
     template <typename T> struct remove_reference      { using type = T; };
     template <typename T> struct remove_reference<T&>  { using type = T; };
     template <typename T> struct remove_reference<T&&> { using type = T; };