<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/139647>139647</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [Clang] Static analyzer (with assertions) crashes when dealing with `std::call_once`
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang:static analyzer
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          ziqingluo-90
      </td>
    </tr>
</table>

<pre>
    A minimal example (https://godbolt.org/z/o99n7db3e):
```
#include <mutex>

class T {
 public: 
    T () {}
};

bool check() {
  static std::once_flag flag;
 auto fun = [](T S)->void{};
  std::call_once(flag, fun, T());

}
```

I think the issue is in fact in BodyFarm instead of CSA, so please help me to CC more appropriate community members and add proper tags if possible.

CSA uses `BodyFarm` to create the definition of `std::call_once`.  
```
/// Create a fake body for std::call_once.
/// Emulates the following function body:
///
/// \code
/// typedef struct once_flag_s {
///   unsigned long __state = 0;
/// } once_flag;
/// template<class Callable>
/// void call_once(once_flag& o, Callable func) {
///   if (!o.__state) {
/// func();
///   }
///   o.__state = 1;
/// }
/// \endcode
```

When `BodyFarm` crafts the definition, it needs to create an lvalue-to-rvalue conversion on the parameter of type C++ class `T`.
```
   Expr *ParamExpr = M.makeDeclRefExpr(PDecl);
    if (!CallbackFunctionType->getParamType(ParamIdx - 2)->isReferenceType()) {
 QualType PTy = PDecl->getType().getNonReferenceType();
      ParamExpr = M.makeLvalueToRvalue(ParamExpr, PTy);
    }
```
However,  in `ImplicitCastExpr::Create`:
```
  // Per C++ [conv.lval]p3, lvalue-to-rvalue conversions on class and
  // std::nullptr_t have special semantics not captured by CK_LValueToRValue.
  assert((Kind != CK_LValueToRValue ||
          !(T->isNullPtrType() || T->getAsCXXRecordDecl())) &&
         "invalid type for lvalue-to-rvalue conversion");
```

</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJx8Vstu4zoS_Rp6U4ghU35ECy8cOcY0uqeRSYyZ3gUUWbI5oUhdknLi_vqLouRHHrcBwbKkqsPDU4dFihD0ziIu2eyOzdYj0cW988vf-i9td6ZzN0U2qpw6LlfQaKsbYQDfRNMaBMZv9zG2geUrxjeMb3ZOVc7EsfM7xje_Gd-4orALVeXIeEFh2YrNs-HKVozn2krTKQSWl00X8Y3l9_QhW0kjQoAtsMUdy1bQdpXRkuUroCcA-sJvGS9SwGJNSYs1y-_67Mo5A3KP8uUqihJDFFFLCFERnXzlrMTn2ogd0E-fD6KLDurOAsvX0OvC-O0Wnhgvblh-f3BaDcPmJ9gBTwpjngmU8duEyEtCotu2p5KUGGgOxK8lyVbfIO61fYG4R9AhdPQL2kItZKT7nVPHjfANaBsiCgWuhvJpRUMEB61BERD2aFpoEKKDsoTGeQTRtt61XouIIF3TdFbHIzTYVOgDCKtAKAUUgx6i2AXQNbQuBF0ZHPfcyqcVdAEDsHl24sHmGQ0jPRIysVZYa6ujdpa4sXn2hTzzbAzwyQ-b_oKyBxNQixcE8h_Uzn8h8_hd2n3TGRExJBa1M8a9arujAsjEhoAGG55y3uWzWSmdwnfv4rFFhTWE6DsZ4WyY5zCY6hIK0Nm0mhQYZ3fw_Ex2w2SjbCj6ZazF-gL28WPEpqWZsLzsF0IpjBGVwWF9nAPJinBtugskn4MjU5xSkwyXtXBNW9f9apq48cD5q7g-__Zi4CuEwclXb85QafqTL6b_UXq06qT--xXxvz3aj46TXtQxfLAbTVdHsIgqXHlSWDAHYTq8ie7Gp38gnT2gD8mjNsG0wosGI3oyLVUdSsbvGL-DvgRsnm3Jth_4AcD9W-uB8dUDIfQP-Rr-PW7EC65Rmkes6S3jtw_0eBYQrqWnMlVCvmwGs26PLVKz2WFMuPRMCPT_m3qDG-BDO9LhEWv0aCUOQX2bOTW9_3TC0Ad42B4Ts8RiwL5kjHcYfzr7FdaZLcBXc_yRJN26x3Q_keynXNKo7zA-N71_uVc8YAqmBsfm2bemNVrqWIoQE05a9X1XoJxPWwnA4KMH9Oe6sdkdlXlMxWezdZvTCH9wQiAr9MUWVl2jnhuP7Yxpo3-OsBcHhNCi1MJAwEbYqGUA6yJI0cbOo4LqCOX35x__HeRJ93HCFSGgj0ne2-_aKmB8QoJ-Cge2KOk66Z8U5BPaj_ra_-yMeYj-Uq0hA7ZDhVeh_PXrEaXzqnffaReiUD6n6wqcca7tQRit-jVAbfcPkjHOL_3gqh4jtcxVkRdihMvJYrrIiul8MRntl_lEqnqykIWoRF0U1XRRyGlV8KzieaWm05Fe8ozPstkkz7Jsmk_GnKt8NpnPxGJazfKpYtMMG6HN2JhDQ2eNUdoll5O8mE8XIyMqNCEdZziXRtgdy1fDti-sMMff5DROZx2_JIibqtsFNs2MDjFcQKOOJp2KyoQxW8PTexBat6867odakn9IUulF2GOAV2paCoWhHSjF_dNGOOq8WX44Sem476qxdA3jG6I03G5a7_6PMjK-SZMOjG-GeR-W_O8AAAD__2OS644">