[clang-tools-extra] [clang-tidy] Unsafe CRTP check (PR #82403)

[via cfe-commits]

================
@@ -0,0 +1,232 @@
+// RUN: %check_clang_tidy %s bugprone-unsafe-crtp %t
+
+namespace class_implicit_ctor {
+template <typename T>
+class CRTP {};
+// CHECK-MESSAGES: :[[@LINE-1]]:7: warning: the implicit default constructor of the CRTP is publicly accessible [bugprone-unsafe-crtp]
+// CHECK-MESSAGES: :[[@LINE-2]]:7: note: consider making it private
+// CHECK-FIXES: CRTP() = default;
+
+class A : CRTP<A> {};
+} // namespace class_implicit_ctor
+
+namespace class_uncostructible {
+template <typename T>
+class CRTP {
+// CHECK-MESSAGES: :[[@LINE-1]]:7: warning: the CRTP cannot be constructed from the derived class [bugprone-unsafe-crtp]
+// CHECK-MESSAGES: :[[@LINE-2]]:7: note: consider declaring the derived class as friend
+// CHECK-FIXES: friend T;
----------------
whisperity wrote:

> If the only constructor is for a static factory function, which is unaccessible by the derived class, then the derived class cannot be constructed either, right?

@isuckatcs I think you are right, at least I tried to give this some thought (actually by trying to construct a counter-example).

```cpp
template <class T>
class Base
{
    Base(int I) {}

protected:
    static Base factory(int I) { return Base{I}; }
};

class Derived : public Base<Derived>
{
    // Derived() : Base(0) {} // Does not work.
    Derived() : Base(Base::factory(1)) {}
};

void test()
{
    Derived D;
}
```

```
<source>:18:13: error: calling a private constructor of class 'Derived'
   18 |     Derived D;
      |             ^
<source>:13:5: note: implicitly declared private here
   13 |     Derived() : Base(Base::factory(1)) {}
      |     ^
```

https://github.com/llvm/llvm-project/pull/82403