[analyzer] Make getDerefExpr() skip cleanups.

[NoQ]

Summary

ExprWithCleanups that cleans up function arguments (or any other stuff) at the end of the full-expression may break AST pattern-matching for figuring out that a null pointer was produced by the inlined function during trackNullOrUndefValue(). Because this expression doesn't do anything, skip it during getDerefExpr().

[NoQ]

This is supposed to suppress a few Inlined-Defensive-Checks-related false positives that accidentally spiked up during my testing of copy elision.

[george.karpenkov]

test/Analysis/inlining/inline-defensive-checks.cpp

93

what is the argument doing?

[NoQ]

test/Analysis/inlining/inline-defensive-checks.cpp

93

Causing cleanups (:

lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

while (true) {
     else if (const auto *ME = dyn_cast<MemberExpr>(E)) {
       E = ME->getBase();
     } else if (const auto *IvarRef = dyn_cast<ObjCIvarRefExpr>(E)) {
       E = IvarRef->getBase();
     } else if (const auto *AE = dyn_cast<ArraySubscriptExpr>(E)) {
       E = AE->getBase();
     } else if (const auto *PE = dyn_cast<ParenExpr>(E)) {
       E = PE->getSubExpr();
+    } else if (const auto *EWC = dyn_cast<ExprWithCleanups>(E)) {
+      E = EWC->getSubExpr();
     } else {
       // Other arbitrary stuff.
       break;
     }
   }
 
   // Special case: remove the final lvalue-to-rvalue cast, but do not recurse
   // deeper into the sub-expression. This way we return the lvalue from which

test/Analysis/inlining/inline-defensive-checks.cpp

void idcBar(Bar *b) {
   if (b)
     ;
 }
 void testRefToField(Bar *b) {
   idcBar(b);
   int &x = b->x; // no-warning
   x = 5;
 }
+
+namespace get_deref_expr_with_cleanups {
+struct S {
+~S();
+};
+S *conjure();
+// The argument won't be used, but it'll cause cleanups
+// to appear around the call site.
+S *get_conjured(S _) {
+  S *s = conjure();
+  if (s) {}
+  return s;
+}
+void test_conjured() {
+  S &s = *get_conjured(S()); // no-warning
+}
+} // namespace get_deref_expr_with_cleanups