[clang-tidy] bugprone-unchecked-optional-access crash on clang/lib/Sema/SemaExpr.cpp

[nicovank]

As of my current main (788bbd2), bugprone-unchecked-optional-access crashes on clang/lib/Sema/SemaExpr.cpp.

> ./build/bin/clang-tidy -checks="-*,bugprone-unchecked-optional-access" clang/lib/Sema/SemaExpr.cpp
[...]
clang-tidy: clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp:933: void clang::dataflow::Environment::setValue(const Expr &, Value &): Assertion `CanonE.isPRValue()' failed.
[...]

[llvmbot]

@llvm/issue-subscribers-clang-tidy

Author: Nicolas van Kempen (nicovank)

As of my current main (788bbd2), `bugprone-unchecked-optional-access` crashes on `clang/lib/Sema/SemaExpr.cpp`.

> ./build/bin/clang-tidy -checks="-*,bugprone-unchecked-optional-access" clang/lib/Sema/SemaExpr.cpp
[...]
clang-tidy: clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp:933: void clang::dataflow::Environment::setValue(const Expr &, Value &): Assertion `CanonE.isPRValue()' failed.
[...]

[nicovank]

Reduced by C-Reduce:

namespace std {
template <typename a> struct b { typedef a &c; };
template <typename> class optional {
public:
  void d();
};
template <typename e> class h {
public:
  typename b<e>::c operator*() const;
};
} // namespace std
template <typename g> class k {
public:
  using i = g;
  using f = std::h<i>;
  f j();
};
class n {
public:
  std::optional<int> l(int);
};
using m = class {};
class F {
  int o();
  k<int *> r;
  m q();
};
m F::q() {
  n *p;
  std::optional s = p->l(o());
  s.d();
  for (auto t = r.j();;)
    *t;
}

[jvoung]

Are you able to repro in compiler explorer w/ trunk?
The C-Reduced snippet in compiler explorer https://godbolt.org/z/x4xdxfv7n doesn't trigger the crash

Otherwise, is there more to the crash stack? thanks!

[nicovank]

I believe this is because the Godbolt Clang-Tidy executable is not with assertions (even when selecting assertions trunk for Clang). If you enter --version in the Clang-Tidy argument it'll print "Optimized build." versus "Optimized build with assertions." for an assertions build. compiler-explorer/compiler-explorer#7335

This is the stack trace I get locally:

> ./build/bin/clang-tidy -checks="-*,bugprone-unchecked-optional-access" tmp.cpp -- -std=c++20
clang-tidy: llvm-project/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp:933: void clang::dataflow::Environment::setValue(const Expr &, Value &): Assertion `CanonE.isPRValue()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: ./build/bin/clang-tidy -checks=-*,bugprone-unchecked-optional-access tmp.cpp -- -std=c++20
1.      <eof> parser at end of file
2.      ASTMatcher: Processing 'bugprone-unchecked-optional-access' against:
        CXXMethodDecl F::q : <llvm-project/tmp.cpp:28:1, line:34:1>
--- Bound Nodes Begin ---
    fun - { CXXMethodDecl F::q : <llvm-project/tmp.cpp:28:1, line:34:1> }
--- Bound Nodes End ---
3.      runTypeErasedDataflowAnalysis
Decl:
CXXMethodDecl 0x566bfc8e5a50 parent 0x566bfc8e45b0 prev 0x566bfc8e5928 <llvm-project/tmp.cpp:28:1, line:34:1> line:28:6 q 'm ()'
`-CompoundStmt 0x566bfc8ea478 <col:10, line:34:1>
  |-DeclStmt 0x566bfc8e5c68 <line:29:3, col:7>
  | `-VarDecl 0x566bfc8e5c00 <col:3, col:6> col:6 used p 'n *'
  |-DeclStmt 0x566bfc8e91e8 <line:30:3, col:30>
  | `-VarDecl 0x566bfc8e5d60 <col:3, col:29> col:17 used s 'std::optional<int>' cinit
  |   `-CXXMemberCallExpr 0x566bfc8e6080 <col:21, col:29> 'std::optional<int>'
  |     |-MemberExpr 0x566bfc8e5e18 <col:21, col:24> '<bound member function type>' ->l 0x566bfc8e4298
  |     | `-ImplicitCastExpr 0x566bfc8e5e00 <col:21> 'n *' <LValueToRValue>
  |     |   `-DeclRefExpr 0x566bfc8e5dc8 <col:21> 'n *' lvalue Var 0x566bfc8e5c00 'p' 'n *'
  |     `-CXXMemberCallExpr 0x566bfc8e5e88 <col:26, col:28> 'int'
  |       `-MemberExpr 0x566bfc8e5e58 <col:26> '<bound member function type>' ->o 0x566bfc8e4830
  |         `-CXXThisExpr 0x566bfc8e5e48 <col:26> 'F *' implicit this
  |-CXXMemberCallExpr 0x566bfc8e9280 <line:31:3, col:7> 'void'
  | `-MemberExpr 0x566bfc8e9220 <col:3, col:5> '<bound member function type>' .d 0x566bfc8e85c8
  |   `-DeclRefExpr 0x566bfc8e9200 <col:3> 'std::optional<int>' lvalue Var 0x566bfc8e5d60 's' 'std::optional<int>'
  `-ForStmt 0x566bfc8ea440 <line:32:3, line:33:6>
    |-DeclStmt 0x566bfc8ea1e8 <line:32:8, col:22>
    | `-VarDecl 0x566bfc8e9420 <col:8, col:21> col:13 used t 'f':'std::h<int *>' cinit
    |   `-CXXMemberCallExpr 0x566bfc8e97c0 <col:17, col:21> 'f':'std::h<int *>'
    |     `-MemberExpr 0x566bfc8e9760 <col:17, col:19> '<bound member function type>' .j 0x566bfc8e56f8
    |       `-MemberExpr 0x566bfc8e9730 <col:17> 'k<int *>' lvalue ->r 0x566bfc8e57e8
    |         `-CXXThisExpr 0x566bfc8e9488 <col:17> 'F *' implicit this
    |-<<<NULL>>>
    |-<<<NULL>>>
    |-<<<NULL>>>
    `-CXXOperatorCallExpr 0x566bfc8ea308 <line:33:5, col:6> 'int *' lvalue '*'
      |-ImplicitCastExpr 0x566bfc8ea2f0 <col:5> 'typename b<int *>::c (*)() const' <FunctionToPointerDecay>
      | `-DeclRefExpr 0x566bfc8ea268 <col:5> 'typename b<int *>::c () const' lvalue CXXMethod 0x566bfc8e9e88 'operator*' 'typename b<int *>::c () const'
      `-ImplicitCastExpr 0x566bfc8ea250 <col:6> 'const std::h<int *>' lvalue <NoOp>
        `-DeclRefExpr 0x566bfc8ea200 <col:6> 'f':'std::h<int *>' lvalue Var 0x566bfc8e9420 't' 'f':'std::h<int *>'
CFG:

 [B6 (ENTRY)]
   Succs (1): B5

 [B1]
   1: [B5.17] (Lifetime ends)
   2: [B5.9] (Lifetime ends)
   3: [B5.1] (Lifetime ends)
   Succs (1): B0

 [B2]
   Preds (1): B3
   Succs (1): B4

 [B3]
   1: operator*
   2: [B3.1] (ImplicitCastExpr, FunctionToPointerDecay, typename b<int *>::c (*)(void) const)
   3: t
   4: [B3.3] (ImplicitCastExpr, NoOp, const class std::h<int *>)
   5: * [B3.4] (OperatorCall)
   Preds (1): B4
   Succs (1): B2

 [B4]
   T: for (...; ; )
   Preds (2): B2 B5
   Succs (2): B3 NULL

 [B5]
   1: n *p;
   2: p
   3: [B5.2] (ImplicitCastExpr, LValueToRValue, n *)
   4: [B5.3]->l
   5: this
   6: [B5.5]->o
   7: [B5.6]()
   8: [B5.4]([B5.7])
   9: std::std::optional s = p->l(this->o());
  10: s
  11: [B5.10].d
  12: [B5.11]()
  13: this
  14: [B5.13]->r
  15: [B5.14].j
  16: [B5.15]()
  17: auto t = this->r.j();
   Preds (1): B6
   Succs (1): B4

 [B0 (EXIT)]
   Preds (1): B1

4.      transferCFGBlock: Element [B3.5]
Stmt:
CXXOperatorCallExpr 0x566bfc8ea308 'int *' lvalue '*'
|-ImplicitCastExpr 0x566bfc8ea2f0 'typename b<int *>::c (*)(void) const' <FunctionToPointerDecay>
| `-DeclRefExpr 0x566bfc8ea268 'typename b<int *>::c (void) const' lvalue CXXMethod 0x566bfc8e9e88 'operator*' 'typename b<int *>::c (void) const'
`-ImplicitCastExpr 0x566bfc8ea250 'const class std::h<int *>' lvalue <NoOp>
  `-DeclRefExpr 0x566bfc8ea200 'f':'class std::h<int *>' lvalue Var 0x566bfc8e9420 't' 'f':'class std::h<int *>'
 #0 0x0000566bf861a4a8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) llvm-project/llvm/lib/Support/Unix/Signals.inc:799:13
 #1 0x0000566bf8618590 llvm::sys::RunSignalHandlers() llvm-project/llvm/lib/Support/Signals.cpp:106:18
 #2 0x0000566bf861ac88 SignalHandler(int) llvm-project/llvm/lib/Support/Unix/Signals.inc:415:1
 #3 0x00007d1531a42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007d1531a969fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x00007d1531a969fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x00007d1531a969fc pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x00007d1531a42476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x00007d1531a287f3 abort ./stdlib/abort.c:81:7
 #9 0x00007d1531a2871b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x00007d1531a39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x0000566bf5de7769 llvm::isa_impl_cl<clang::RecordType, clang::Type const*>::doit(clang::Type const*) /llvm-project/llvm/include/llvm/Support/Casting.h:109:5
#12 0x0000566bf5de7769 llvm::isa_impl_wrap<clang::RecordType, clang::Type const*, clang::Type const*>::doit(clang::Type const* const&) llvm-project/llvm/include/llvm/Support/Casting.h:137:12
#13 0x0000566bf5de7769 llvm::isa_impl_wrap<clang::RecordType, clang::Type const* const, clang::Type const*>::doit(clang::Type const* const&) llvm-project/llvm/include/llvm/Support/Casting.h:127:12
#14 0x0000566bf5de7769 llvm::CastIsPossible<clang::RecordType, clang::Type const*, void>::isPossible(clang::Type const* const&) llvm-project/llvm/include/llvm/Support/Casting.h:255:12
#15 0x0000566bf5de7769 llvm::CastInfo<clang::RecordType, clang::QualType const, void>::isPossible(clang::QualType const&) llvm-project/llvm/include/llvm/Support/Casting.h:509:12
#16 0x0000566bf5de7769 bool llvm::isa<clang::RecordType, clang::QualType>(clang::QualType const&) llvm-project/llvm/include/llvm/Support/Casting.h:549:10
#17 0x0000566bf5de7769 clang::Type::isRecordType() const llvm-project/clang/include/clang/AST/Type.h:8293:10
#18 0x0000566bf5de7769 clang::dataflow::Environment::setValue(clang::Expr const&, clang::dataflow::Value&) llvm-project/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp:935:3
#19 0x0000566bf5dcb73c std::_Function_handler<void (clang::Stmt const*, clang::ast_matchers::MatchFinder::MatchResult const&, clang::dataflow::TransferState<clang::dataflow::CachedConstAccessorsLattice<clang::dataflow::NoopLattice>>&), clang::dataflow::ASTMatchSwitchBuilder<clang::Stmt, clang::dataflow::TransferState<clang::dataflow::CachedConstAccessorsLattice<clang::dataflow::NoopLattice>>, void>&& clang::dataflow::ASTMatchSwitchBuilder<clang::Stmt, clang::dataflow::TransferState<clang::dataflow::CachedConstAccessorsLattice<clang::dataflow::NoopLattice>>, void>::CaseOf<clang::CXXOperatorCallExpr>(clang::ast_matchers::internal::Matcher<clang::Stmt>, std::function<void (clang::CXXOperatorCallExpr const*, clang::ast_matchers::MatchFinder::MatchResult const&, clang::dataflow::TransferState<clang::dataflow::CachedConstAccessorsLattice<clang::dataflow::NoopLattice>>&)>) &&::'lambda'(clang::Stmt const*, clang::ast_matchers::MatchFinder::MatchResult const&, clang::dataflow::TransferState<clang::dataflow::CachedConstAccessorsLattice<clang::dataflow::NoopLattice>>&)>::_M_invoke(std::_Any_data const&, clang::Stmt const*&&, clang::ast_matchers::MatchFinder::MatchResult const&, clang::dataflow::TransferState<clang::dataflow::CachedConstAccessorsLattice<clang::dataflow::NoopLattice>>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_function.h:290:2
#20 0x0000566bf5dd28fa std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>, std::less<void>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>>::_M_mbegin() const /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_tree.h:737:64
#21 0x0000566bf5dd28fa std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>, std::less<void>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>>::_M_begin() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_tree.h:741:16
#22 0x0000566bf5dd28fa std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>, std::less<void>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>>::~_Rb_tree() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_tree.h:986:18
#23 0x0000566bf5dd28fa std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, clang::DynTypedNode, std::less<void>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>>::~map() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_map.h:312:22
#24 0x0000566bf5dd28fa clang::ast_matchers::internal::BoundNodesMap::~BoundNodesMap() llvm-project/clang/include/clang/ASTMatchers/ASTMatchersInternal.h:214:7
#25 0x0000566bf5dd28fa clang::ast_matchers::BoundNodes::~BoundNodes() llvm-project/clang/include/clang/ASTMatchers/ASTMatchers.h:109:7
#26 0x0000566bf5dd28fa clang::ast_matchers::MatchFinder::MatchResult::~MatchResult() llvm-project/clang/include/clang/ASTMatchers/ASTMatchFinder.h:75:10
#27 0x0000566bf5dd28fa clang::dataflow::ASTMatchSwitchBuilder<clang::Stmt, clang::dataflow::TransferState<clang::dataflow::CachedConstAccessorsLattice<clang::dataflow::NoopLattice>>, void>::Build() &&::'lambda'(clang::Stmt const&, clang::ASTContext&, clang::dataflow::TransferState<clang::dataflow::CachedConstAccessorsLattice<clang::dataflow::NoopLattice>>&)::operator()(clang::Stmt const&, clang::ASTContext&, clang::dataflow::TransferState<clang::dataflow::CachedConstAccessorsLattice<clang::dataflow::NoopLattice>>&) const llvm-project/clang/include/clang/Analysis/FlowSensitive/MatchSwitch.h:131:11
#28 0x0000566bf5dc6df8 clang::dataflow::UncheckedOptionalAccessModel::transfer(clang::CFGElement const&, clang::dataflow::CachedConstAccessorsLattice<clang::dataflow::NoopLattice>&, clang::dataflow::Environment&) llvm-project/clang/lib/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.cpp:1169:1
#29 0x0000566bf5dff76a clang::dataflow::transferCFGBlock(clang::CFGBlock const&, clang::dataflow::(anonymous namespace)::AnalysisContext&, clang::dataflow::CFGEltCallbacksTypeErased const&) llvm-project/clang/lib/Analysis/FlowSensitive/TypeErasedDataflowAnalysis.cpp:0:17
#30 0x0000566bf5dfdf6b std::_Function_base::~_Function_base() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_function.h:243:11
#31 0x0000566bf5dfdf6b clang::dataflow::CFGEltCallbacksTypeErased::~CFGEltCallbacksTypeErased() llvm-project/clang/include/clang/Analysis/FlowSensitive/TypeErasedDataflowAnalysis.h:143:8
#32 0x0000566bf5dfdf6b clang::dataflow::runTypeErasedDataflowAnalysis(clang::dataflow::AdornedCFG const&, clang::dataflow::TypeErasedDataflowAnalysis&, clang::dataflow::Environment const&, clang::dataflow::CFGEltCallbacksTypeErased const&, int) llvm-project/clang/lib/Analysis/FlowSensitive/TypeErasedDataflowAnalysis.cpp:530:9
#33 0x0000566bf551f53a llvm::Expected<std::vector<std::optional<clang::dataflow::TypeErasedDataflowAnalysisState>, std::allocator<std::optional<clang::dataflow::TypeErasedDataflowAnalysisState>>>>::takeError() llvm-project/llvm/include/llvm/Support/Error.h:610:15
#34 0x0000566bf551f53a llvm::Expected<llvm::SmallVector<clang::SourceLocation, CalculateSmallVectorDefaultInlinedElements<clang::SourceLocation>::value>> clang::dataflow::diagnoseFunction<clang::dataflow::UncheckedOptionalAccessModel, clang::SourceLocation>(clang::FunctionDecl const&, clang::ASTContext&, clang::dataflow::DiagnosisCallbacks<clang::dataflow::UncheckedOptionalAccessModel, clang::SourceLocation>, long, int) llvm-project/clang/include/clang/Analysis/FlowSensitive/DataflowAnalysis.h:367:16
#35 0x0000566bf551e1cf llvm::Expected<llvm::SmallVector<clang::SourceLocation, 12u>>::operator bool() llvm-project/llvm/include/llvm/Support/Error.h:572:17
#36 0x0000566bf551e1cf clang::tidy::bugprone::UncheckedOptionalAccessCheck::check(clang::ast_matchers::MatchFinder::MatchResult const&) llvm-project/clang-tools-extra/clang-tidy/bugprone/UncheckedOptionalAccessCheck.cpp:55:57
#37 0x0000566bf72e6b7d std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>, std::less<void>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>>::_M_mbegin() const /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_tree.h:737:64
#38 0x0000566bf72e6b7d std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>, std::less<void>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>>::_M_begin() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_tree.h:741:16
#39 0x0000566bf72e6b7d std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>, std::less<void>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>>::~_Rb_tree() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_tree.h:986:18
#40 0x0000566bf72e6b7d std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, clang::DynTypedNode, std::less<void>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>>::~map() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_map.h:312:22
#41 0x0000566bf72e6b7d clang::ast_matchers::internal::BoundNodesMap::~BoundNodesMap() llvm-project/clang/include/clang/ASTMatchers/ASTMatchersInternal.h:214:7
#42 0x0000566bf72e6b7d clang::ast_matchers::BoundNodes::~BoundNodes() llvm-project/clang/include/clang/ASTMatchers/ASTMatchers.h:109:7
#43 0x0000566bf72e6b7d clang::ast_matchers::MatchFinder::MatchResult::~MatchResult() llvm-project/clang/include/clang/ASTMatchers/ASTMatchFinder.h:75:10
#44 0x0000566bf72e6b7d clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::MatchVisitor::visitMatch(clang::ast_matchers::BoundNodes const&) llvm-project/clang/lib/ASTMatchers/ASTMatchFinder.cpp:1272:7
#45 0x0000566bf731d38c std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>, std::less<void>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>>::_M_mbegin() const /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_tree.h:737:64
#46 0x0000566bf731d38c std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>, std::less<void>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>>::_M_begin() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_tree.h:741:16
#47 0x0000566bf731d38c std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>, std::less<void>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>>::~_Rb_tree() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_tree.h:986:18
#48 0x0000566bf731d38c std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, clang::DynTypedNode, std::less<void>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, clang::DynTypedNode>>>::~map() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_map.h:312:22
#49 0x0000566bf731d38c clang::ast_matchers::internal::BoundNodesMap::~BoundNodesMap() llvm-project/clang/include/clang/ASTMatchers/ASTMatchersInternal.h:214:7
#50 0x0000566bf731d38c clang::ast_matchers::BoundNodes::~BoundNodes() llvm-project/clang/include/clang/ASTMatchers/ASTMatchers.h:109:7
#51 0x0000566bf731d38c clang::ast_matchers::internal::BoundNodesTreeBuilder::visitMatches(clang::ast_matchers::internal::BoundNodesTreeBuilder::Visitor*) llvm-project/clang/lib/ASTMatchers/ASTMatchersInternal.cpp:106:5
#52 0x0000566bf72e6209 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::CurMatchData::assertHoldsState() const llvm-project/clang/lib/ASTMatchers/ASTMatchFinder.cpp:842:7
#53 0x0000566bf72e6209 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::CurMatchData::reset() llvm-project/clang/lib/ASTMatchers/ASTMatchFinder.cpp:835:7
#54 0x0000566bf72e6209 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::CurMatchRAII::~CurMatchRAII() llvm-project/clang/lib/ASTMatchers/ASTMatchFinder.cpp:870:40
#55 0x0000566bf72e6209 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::matchWithFilter(clang::DynTypedNode const&) llvm-project/clang/lib/ASTMatchers/ASTMatchFinder.cpp:1069:5
#56 0x0000566bf72e9260 clang::Decl::getKind() const llvm-project/clang/include/clang/AST/DeclBase.h:445:51
#57 0x0000566bf72e9260 clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseDecl(clang::Decl*) llvm-project/clang/include/clang/AST/RecursiveASTVisitor.h:767:14
#58 0x0000566bf72e9260 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::TraverseDecl(clang::Decl*) llvm-project/clang/lib/ASTMatchers/ASTMatchFinder.cpp:1472:48
#59 0x0000566bf72e9c4b clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseDeclContextHelper(clang::DeclContext*) llvm-project/clang/include/clang/AST/RecursiveASTVisitor.h:1544:7
#60 0x0000566bf72e9c4b clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseTranslationUnitDecl(clang::TranslationUnitDecl*) llvm-project/clang/include/clang/AST/RecursiveASTVisitor.h:1649:1
#61 0x0000566bf72e9287 clang::RecursiveASTVisitor<clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor>::TraverseDecl(clang::Decl*) llvm-project/build/tools/clang/include/clang/AST/DeclNodes.inc:24:1
#62 0x0000566bf72e9287 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::TraverseDecl(clang::Decl*) llvm-project/clang/lib/ASTMatchers/ASTMatchFinder.cpp:1472:48
#63 0x0000566bf72b7f75 clang::ast_matchers::internal::(anonymous namespace)::MatchASTVisitor::onEndOfTranslationUnit() llvm-project/clang/lib/ASTMatchers/ASTMatchFinder.cpp:447:30
#64 0x0000566bf72b7f75 clang::ast_matchers::MatchFinder::matchAST(clang::ASTContext&) llvm-project/clang/lib/ASTMatchers/ASTMatchFinder.cpp:1701:11
#65 0x0000566bf63f724c __gnu_cxx::__normal_iterator<std::unique_ptr<clang::ASTConsumer, std::default_delete<clang::ASTConsumer>>*, std::vector<std::unique_ptr<clang::ASTConsumer, std::default_delete<clang::ASTConsumer>>, std::allocator<std::unique_ptr<clang::ASTConsumer, std::default_delete<clang::ASTConsumer>>>>>::operator++() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_iterator.h:1107:2
#66 0x0000566bf63f724c clang::MultiplexConsumer::HandleTranslationUnit(clang::ASTContext&) llvm-project/clang/lib/Frontend/MultiplexConsumer.cpp:338:23
#67 0x0000566bf6614ee9 __gnu_cxx::__normal_iterator<std::unique_ptr<clang::TemplateInstantiationCallback, std::default_delete<clang::TemplateInstantiationCallback>>*, std::vector<std::unique_ptr<clang::TemplateInstantiationCallback, std::default_delete<clang::TemplateInstantiationCallback>>, std::allocator<std::unique_ptr<clang::TemplateInstantiationCallback, std::default_delete<clang::TemplateInstantiationCallback>>>>>::__normal_iterator(std::unique_ptr<clang::TemplateInstantiationCallback, std::default_delete<clang::TemplateInstantiationCallback>>* const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_iterator.h:1073:20
#68 0x0000566bf6614ee9 std::vector<std::unique_ptr<clang::TemplateInstantiationCallback, std::default_delete<clang::TemplateInstantiationCallback>>, std::allocator<std::unique_ptr<clang::TemplateInstantiationCallback, std::default_delete<clang::TemplateInstantiationCallback>>>>::begin() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/stl_vector.h:869:16
#69 0x0000566bf6614ee9 void clang::finalize<std::vector<std::unique_ptr<clang::TemplateInstantiationCallback, std::default_delete<clang::TemplateInstantiationCallback>>, std::allocator<std::unique_ptr<clang::TemplateInstantiationCallback, std::default_delete<clang::TemplateInstantiationCallback>>>>>(std::vector<std::unique_ptr<clang::TemplateInstantiationCallback, std::default_delete<clang::TemplateInstantiationCallback>>, std::allocator<std::unique_ptr<clang::TemplateInstantiationCallback, std::default_delete<clang::TemplateInstantiationCallback>>>>&, clang::Sema const&) llvm-project/clang/include/clang/Sema/TemplateInstCallback.h:54:16
#70 0x0000566bf6614ee9 clang::ParseAST(clang::Sema&, bool, bool) llvm-project/clang/lib/Parse/ParseAST.cpp:191:3
#71 0x0000566bf63afda6 clang::FrontendAction::Execute() llvm-project/clang/lib/Frontend/FrontendAction.cpp:1076:10
#72 0x0000566bf632859d llvm::Error::getPtr() const llvm-project/llvm/include/llvm/Support/Error.h:279:42
#73 0x0000566bf632859d llvm::Error::operator bool() llvm-project/llvm/include/llvm/Support/Error.h:242:16
#74 0x0000566bf632859d clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) llvm-project/clang/lib/Frontend/CompilerInstance.cpp:1056:23
#75 0x0000566bf5ee37ec clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr<clang::CompilerInvocation>, clang::FileManager*, std::shared_ptr<clang::PCHContainerOperations>, clang::DiagnosticConsumer*) llvm-project/clang/lib/Tooling/Tooling.cpp:467:33
#76 0x0000566bf5eaa989 std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/shared_ptr_base.h:1070:6
#77 0x0000566bf5eaa989 std::__shared_ptr<clang::PCHContainerOperations, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/shared_ptr_base.h:1524:31
#78 0x0000566bf5eaa989 clang::tidy::runClangTidy(clang::tidy::ClangTidyContext&, clang::tooling::CompilationDatabase const&, llvm::ArrayRef<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, llvm::IntrusiveRefCntPtr<llvm::vfs::OverlayFileSystem>, bool, bool, llvm::StringRef)::ActionFactory::runInvocation(std::shared_ptr<clang::CompilerInvocation>, clang::FileManager*, std::shared_ptr<clang::PCHContainerOperations>, clang::DiagnosticConsumer*) llvm-project/clang-tools-extra/clang-tidy/ClangTidy.cpp:581:7
#79 0x0000566bf5ee356c std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/shared_ptr_base.h:1070:6
#80 0x0000566bf5ee356c std::__shared_ptr<clang::PCHContainerOperations, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/shared_ptr_base.h:1524:31
#81 0x0000566bf5ee356c clang::tooling::ToolInvocation::runInvocation(char const*, clang::driver::Compilation*, std::shared_ptr<clang::CompilerInvocation>, std::shared_ptr<clang::PCHContainerOperations>) llvm-project/clang/lib/Tooling/Tooling.cpp:441:3
#82 0x0000566bf5ee22d2 clang::tooling::ToolInvocation::run() llvm-project/clang/lib/Tooling/Tooling.cpp:426:10
#83 0x0000566bf5ee551a clang::tooling::ClangTool::run(clang::tooling::ToolAction*) llvm-project/clang/lib/Tooling/Tooling.cpp:625:11
#84 0x0000566bf5ea5e74 clang::tidy::runClangTidy(clang::tidy::ClangTidyContext&, clang::tooling::CompilationDatabase const&, llvm::ArrayRef<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, llvm::IntrusiveRefCntPtr<llvm::vfs::OverlayFileSystem>, bool, bool, llvm::StringRef) llvm-project/clang-tools-extra/clang-tidy/ClangTidy.cpp:0:8
#85 0x0000566bf538736c clang::tidy::clangTidyMain(int, char const**) llvm-project/clang-tools-extra/clang-tidy/tool/ClangTidyMain.cpp:714:7
#86 0x00007d1531a29d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#87 0x00007d1531a29e40 call_init ./csu/../csu/libc-start.c:128:20
#88 0x00007d1531a29e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#89 0x0000566bf5384b65 _start (./build/bin/clang-tidy+0x1278b65)
[1]    3030817 IOT instruction (core dumped)  ./build/bin/clang-tidy -checks="-*,bugprone-unchecked-optional-access" tmp.cp

[jvoung]

Ah thanks!

I think the issue is around here

llvm-project/clang/lib/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.cpp

Line 586 in 870b376

(CE->getType()->isBooleanType() || CE->getType()->isPointerType())) {

. We are using the CE->getType() to check isPointerType(), but CE->getType() doesn't track references vs not. So in your example, the operator call for *t has return type b<int *>::c which is a reference to int * instead of just int *.

So we should either check the callee return type instead (which has the reference information), or refine the check w.r.t., CE->isPRValue().

[jvoung]

The crash is actually incidentally fixed by #128437 but added a test to prevent regression. Thanks for the report!