From 05a2d88ec896e4b49dcf460053d7b7d48d9b76cf Mon Sep 17 00:00:00 2001
From: chrchr-github <78114321+chrchr-github@users.noreply.github.com>
Date: Tue, 22 Aug 2023 16:53:38 +0200
Subject: [PATCH] Fix #11888 FP knownPointerToBool with incorrect overload
 match / FP unreadVariable (#5356)

---
 lib/symboldatabase.cpp      |  9 +++++++--
 test/testsymboldatabase.cpp | 36 +++++++++++++++++++++++++++++++++++-
 2 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/lib/symboldatabase.cpp b/lib/symboldatabase.cpp
index f64caa82e..9b3fbd91b 100644
--- a/lib/symboldatabase.cpp
+++ b/lib/symboldatabase.cpp
@@ -6789,11 +6789,15 @@ static const Token* parsedecl(const Token* type,
             valuetype->constness = vt->constness;
             valuetype->originalTypeName = vt->originalTypeName;
             const bool hasConst = Token::simpleMatch(type->previous(), "const");
-            while (Token::Match(type, "%name%|*|&|::") && !type->variable()) {
+            while (Token::Match(type, "%name%|*|&|&&|::") && !type->variable()) {
                 if (type->str() == "*") {
                     valuetype->pointer = 1;
                     if (hasConst)
                         valuetype->constness = 1;
+                } else if (type->str() == "&") {
+                    valuetype->reference = Reference::LValue;
+                } else if (type->str() == "&&") {
+                    valuetype->reference = Reference::RValue;
                 }
                 if (type->str() == "const")
                     valuetype->constness |= (1 << valuetype->pointer);
@@ -7686,7 +7690,8 @@ ValueType::MatchResult ValueType::matchParameter(const ValueType *call, const Va
     }
 
     if (call->typeScope != nullptr || func->typeScope != nullptr) {
-        if (call->typeScope != func->typeScope)
+        if (call->typeScope != func->typeScope &&
+            !(call->typeScope && func->typeScope && call->typeScope->definedType && call->typeScope->definedType->isDerivedFrom(func->typeScope->className)))
             return ValueType::MatchResult::NOMATCH;
     }
 
diff --git a/test/testsymboldatabase.cpp b/test/testsymboldatabase.cpp
index e558e4d3a..13c784606 100644
--- a/test/testsymboldatabase.cpp
+++ b/test/testsymboldatabase.cpp
@@ -441,6 +441,7 @@ private:
         TEST_CASE(findFunction46);
         TEST_CASE(findFunction47);
         TEST_CASE(findFunction48);
+        TEST_CASE(findFunction49); // #11888
         TEST_CASE(findFunctionContainer);
         TEST_CASE(findFunctionExternC);
         TEST_CASE(findFunctionGlobalScope); // ::foo
@@ -511,6 +512,7 @@ private:
         TEST_CASE(auto19);
         TEST_CASE(auto20);
         TEST_CASE(auto21);
+        TEST_CASE(auto22);
 
         TEST_CASE(unionWithConstructor);
 
@@ -7286,6 +7288,22 @@ private:
         ASSERT_EQUALS(1, typeTok->type()->classDef->linenr());
     }
 
+    void findFunction49() {
+        GET_SYMBOL_DB("struct B {};\n"
+                      "struct D : B {};\n"
+                      "void f(bool = false, bool = true);\n"
+                      "void f(B*, bool, bool = true);\n"
+                      "void g() {\n"
+                      "    D d;\n"
+                      "    f(&d, true);\n"
+                      "}\n");
+        ASSERT_EQUALS("", errout.str());
+        const Token* ftok = Token::findsimplematch(tokenizer.tokens(), "f ( &");
+        ASSERT(ftok && ftok->function());
+        ASSERT(ftok->function()->name() == "f");
+        ASSERT_EQUALS(4, ftok->function()->tokenDef->linenr());
+    }
+
     void findFunctionContainer() {
         {
             GET_SYMBOL_DB("void dostuff(std::vector<int> v);\n"
@@ -8395,7 +8413,7 @@ private:
             const Token* tok = tokenizer.tokens();
             tok = Token::findsimplematch(tok, "s .");
             ASSERT(tok && tok->valueType());
-            ASSERT_EQUALS("container(std :: set|unordered_set <)", tok->valueType()->str());
+            ASSERT_EQUALS("container(std :: set|unordered_set <) &", tok->valueType()->str());
         }
         {
             GET_SYMBOL_DB("void f(std::vector<int> v) {\n"
@@ -9470,6 +9488,22 @@ private:
         ASSERT(v->variable() && v->variable()->isReference());
     }
 
+    void auto22() {
+        GET_SYMBOL_DB("void f(std::vector<std::string>& v, bool b) {\n"
+                      "    auto& s = b ? v[0] : v[1];\n"
+                      "    s += \"abc\";\n"
+                      "}\n");
+        ASSERT_EQUALS("", errout.str());
+        const Token* a = Token::findsimplematch(tokenizer.tokens(), "auto");
+        ASSERT(a && a->valueType());
+        ASSERT_EQUALS(a->valueType()->type, ValueType::CONTAINER);
+        const Token* s = Token::findsimplematch(a, "s +=");
+        ASSERT(s && s->valueType());
+        ASSERT_EQUALS(s->valueType()->type, ValueType::CONTAINER);
+        ASSERT(s->valueType()->reference == Reference::LValue);
+        ASSERT(s->variable() && s->variable()->isReference());
+    }
+
     void unionWithConstructor() {
         GET_SYMBOL_DB("union Fred {\n"
                       "    Fred(int x) : i(x) { }\n"