[clang-tools-extra] [tidy] add new check bugprone-return-const-ref-from-parameter (PR #89497)

[Julian Schmidt via cfe-commits]

================
@@ -0,0 +1,34 @@
+//===--- ReturnConstRefFromParameterCheck.cpp - clang-tidy ----------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "ReturnConstRefFromParameterCheck.h"
+#include "../utils/Matchers.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+#include "clang/ASTMatchers/ASTMatchers.h"
+
+using namespace clang::ast_matchers;
+
+namespace clang::tidy::bugprone {
+
+void ReturnConstRefFromParameterCheck::registerMatchers(MatchFinder *Finder) {
+  Finder->addMatcher(
+      returnStmt(hasReturnValue(declRefExpr(to(parmVarDecl(hasType(
+                     hasCanonicalType(matchers::isReferenceToConst())))))))
+          .bind("ret"),
+      this);
+}
+
+void ReturnConstRefFromParameterCheck::check(
+    const MatchFinder::MatchResult &Result) {
+  const auto *R = Result.Nodes.getNodeAs<ReturnStmt>("ret");
+  diag(R->getRetValue()->getBeginLoc(),
+       "return const reference parameter cause potential use-after-free "
+       "when function accepts immediately constructed value.");
----------------
5chmidti wrote:

What do you think about `returning a const reference parameter may cause a use-after-free when the parameter is constructed from a temporary` (`const` vs `constant` argument in the other thread aside)

I'm not sure if it should be `may` or `will`, because it is only a use-after-free if the returned value is actually used (FWICT).

https://github.com/llvm/llvm-project/pull/89497