[LifetimeAnalysis] Support std::stack::top() and std::optional::value()

[mgehre]

Summary

Diagnose dangling pointers that come from std::stack::top() and std::optional::value().

[xazax.hun]

LG! But let's wait for Dmitri :)

clang/test/Sema/warn-lifetime-analysis-nocfg.cpp

172

I actually was a bit lazy when I added these tests. Both value and operator* is overloaded on &&. But if you do not feel like adjusting the tests this is fine, I can do it myself later :)

[xazax.hun]

clang/lib/Sema/SemaInit.cpp

6583

Oh, this one needs to be updated, as value returns a reference not a pointer.

[mgehre]

clang/test/Sema/warn-lifetime-analysis-nocfg.cpp

172

I'll change it to use the & variant in the test - the && cannot dangle as far as I understand.

[xazax.hun]

clang/test/Sema/warn-lifetime-analysis-nocfg.cpp

172

It can!

Consider the following code:

int &&r = *std::optional(5);
// r dangles here.

[mgehre]

Fix commit

[mgehre]

clang/lib/Sema/SemaInit.cpp

6583

Yes, I noticed the same.

clang/test/Sema/warn-lifetime-analysis-nocfg.cpp

172

Oh, sure!

[mgehre]

Add tests for rvalue-ref overloads

clang/lib/Sema/SemaInit.cpp

if (!isRecordWithAttr<PointerAttr>(Callee->getThisObjectType()) &&
     return false;
   if (Callee->getReturnType()->isPointerType() ||
       isRecordWithAttr<PointerAttr>(Callee->getReturnType())) {
     if (!Callee->getIdentifier())
       return false;
     return llvm::StringSwitch<bool>(Callee->getName())
         .Cases("begin", "rbegin", "cbegin", "crbegin", true)
         .Cases("end", "rend", "cend", "crend", true)
         .Cases("c_str", "data", "get", true)
         // Map and set types.
         .Cases("find", "equal_range", "lower_bound", "upper_bound", true)
         .Default(false);
   } else if (Callee->getReturnType()->isReferenceType()) {
     if (!Callee->getIdentifier()) {
       auto OO = Callee->getOverloadedOperator();
       return OO == OverloadedOperatorKind::OO_Subscript ||
              OO == OverloadedOperatorKind::OO_Star;
     }
     return llvm::StringSwitch<bool>(Callee->getName())
-        .Cases("front", "back", "at", true)
+        .Cases("front", "back", "at", "top", "value", true)
         .Default(false);
   }
   return false;
 }
 
 static void handleGslAnnotatedTypes(IndirectLocalPath &Path, Expr *Call,
                                     LocalVisitor Visit) {
   auto VisitPointerArg = [&](const Decl *D, Expr *Arg) {

clang/test/Sema/warn-lifetime-analysis-nocfg.cpp

struct unique_ptr {
   T &operator*();
   T *get() const;
 };
 
 template<typename T>
 struct optional {
   optional();
   optional(const T&);
-  T &operator*();
+  T &operator*() &;
+  T &&operator*() &&;
+  T &value() &;
+  T &&value() &&;
+};
+
+template<typename T>
+struct stack {
+  T &top();
 };
 }
 
 void modelIterators() {
   std::vector<int>::iterator it = std::vector<int>().begin(); // expected-warning {{object backing the pointer will be destroyed at the end of the full-expression}}
   (void)it;
 }
 
 std::vector<int>::iterator modelIteratorReturn() {
   return std::vector<int>().begin(); // expected-warning {{returning address of local temporary object}}
 }
 
 const char *danglingRawPtrFromLocal() {
   std::basic_string<char> s;
   return s.c_str(); // expected-warning {{address of stack memory associated with local variable 's' returned}}
 }
 
+int &danglingRawPtrFromLocal2() {
+  std::optional<int> o;
+  return o.value(); // expected-warning {{reference to stack memory associated with local variable 'o' returned}}
+}
+
+int &danglingRawPtrFromLocal3() {
+  std::optional<int> o;
+  return *o; // expected-warning {{reference to stack memory associated with local variable 'o' returned}}
+}
+
 const char *danglingRawPtrFromTemp() {
   return std::basic_string<char>().c_str(); // expected-warning {{returning address of local temporary object}}
 }
 
 std::unique_ptr<int> getUniquePtr();
 
 int *danglingUniquePtrFromTemp() {
   return getUniquePtr().get(); // expected-warning {{returning address of local temporary object}}
 }
 
 int *danglingUniquePtrFromTemp2() {
   return std::unique_ptr<int>().get(); // expected-warning {{returning address of local temporary object}}
 }
 
 void danglingReferenceFromTempOwner() {
-  int &r = *std::optional<int>(); // expected-warning {{object backing the pointer will be destroyed at the end of the full-expression}}
-  int &r2 = *std::optional<int>(5); // expected-warning {{object backing the pointer will be destroyed at the end of the full-expression}}
-  int &r3 = std::vector<int>().at(3); // expected-warning {{object backing the pointer will be destroyed at the end of the full-expression}}
+  int &&r = *std::optional<int>();          // expected-warning {{object backing the pointer will be destroyed at the end of the full-expression}}
+  int &&r2 = *std::optional<int>(5);        // expected-warning {{object backing the pointer will be destroyed at the end of the full-expression}}
+  int &&r3 = std::optional<int>(5).value(); // expected-warning {{object backing the pointer will be destroyed at the end of the full-expression}}
+  int &r4 = std::vector<int>().at(3);       // expected-warning {{object backing the pointer will be destroyed at the end of the full-expression}}
 }
 
 std::vector<int> getTempVec();
 std::optional<std::vector<int>> getTempOptVec();
 
 void testLoops() {
   for (auto i : getTempVec()) // ok
     ;