[clang-tools-extra] Enforce SL.con.3: Add check to replace operator[] with at() [Cont.] (PR #95220)

[Paul Heidekrüger via cfe-commits]

https://github.com/paulhdk updated https://github.com/llvm/llvm-project/pull/95220

>From 960fbdaa4d6c099970d69773afc2114be8bcacc0 Mon Sep 17 00:00:00 2001
From: Sebastian Wolf <wolf.sebastian at in.tum.de>
Date: Wed, 17 Apr 2024 16:16:35 +0200
Subject: [PATCH 01/53] Enforce SL.con.3: Add check to replace operator[] with
 at() on std containers

---
 .../AvoidBoundsErrorsCheck.cpp                | 81 +++++++++++++++++++
 .../AvoidBoundsErrorsCheck.h                  | 32 ++++++++
 .../cppcoreguidelines/CMakeLists.txt          |  1 +
 .../CppCoreGuidelinesTidyModule.cpp           |  3 +
 clang-tools-extra/docs/ReleaseNotes.rst       |  6 ++
 .../cppcoreguidelines/avoid-bounds-errors.rst | 20 +++++
 .../docs/clang-tidy/checks/list.rst           |  1 +
 .../cppcoreguidelines/avoid-bounds-errors.cpp | 66 +++++++++++++++
 8 files changed, 210 insertions(+)
 create mode 100644 clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp
 create mode 100644 clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.h
 create mode 100644 clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors.rst
 create mode 100644 clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/avoid-bounds-errors.cpp

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp
new file mode 100644
index 000000000000000..524c21b5bdb8180
--- /dev/null
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp
@@ -0,0 +1,81 @@
+//===--- AvoidBoundsErrorsCheck.cpp - clang-tidy --------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "AvoidBoundsErrorsCheck.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+#include "clang/Lex/Lexer.h"
+
+#include <iostream>
+using namespace clang::ast_matchers;
+
+namespace clang::tidy::cppcoreguidelines {
+
+bool isApplicable(const QualType &Type) {
+  const auto TypeStr = Type.getAsString();
+  bool Result = false;
+  // Only check for containers in the std namespace
+  if (TypeStr.find("std::vector") != std::string::npos) {
+    Result = true;
+  }
+  if (TypeStr.find("std::array") != std::string::npos) {
+    Result = true;
+  }
+  if (TypeStr.find("std::deque") != std::string::npos) {
+    Result = true;
+  }
+  if (TypeStr.find("std::map") != std::string::npos) {
+    Result = true;
+  }
+  if (TypeStr.find("std::unordered_map") != std::string::npos) {
+    Result = true;
+  }
+  if (TypeStr.find("std::flat_map") != std::string::npos) {
+    Result = true;
+  }
+  // TODO Add std::span with C++26
+  return Result;
+}
+
+void AvoidBoundsErrorsCheck::registerMatchers(MatchFinder *Finder) {
+  Finder->addMatcher(
+      callExpr(callee(cxxMethodDecl(hasName("operator[]")).bind("f")))
+          .bind("x"),
+      this);
+}
+
+void AvoidBoundsErrorsCheck::check(const MatchFinder::MatchResult &Result) {
+  const ASTContext &Context = *Result.Context;
+  const SourceManager &Source = Context.getSourceManager();
+  const auto *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("x");
+  const auto *MatchedFunction = Result.Nodes.getNodeAs<CXXMethodDecl>("f");
+  const auto Type = MatchedFunction->getThisType();
+  if (!isApplicable(Type)) {
+    return;
+  }
+
+  // Get original code.
+  const SourceLocation b(MatchedExpr->getBeginLoc());
+  const SourceLocation e(MatchedExpr->getEndLoc());
+  const std::string OriginalCode =
+      Lexer::getSourceText(CharSourceRange::getTokenRange(b, e), Source,
+                           getLangOpts())
+          .str();
+  const auto Range = SourceRange(b, e);
+
+  // Build replacement.
+  std::string NewCode = OriginalCode;
+  const auto BeginOpen = NewCode.find("[");
+  NewCode.replace(BeginOpen, 1, ".at(");
+  const auto BeginClose = NewCode.find("]");
+  NewCode.replace(BeginClose, 1, ")");
+
+  diag(MatchedExpr->getBeginLoc(), "Do not use operator[], use at() instead.")
+      << FixItHint::CreateReplacement(Range, NewCode);
+}
+
+} // namespace clang::tidy::cppcoreguidelines
diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.h b/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.h
new file mode 100644
index 000000000000000..f915729cd7bbee3
--- /dev/null
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.h
@@ -0,0 +1,32 @@
+//===--- AvoidBoundsErrorsCheck.h - clang-tidy ------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_AVOIDBOUNDSERRORSCHECK_H
+#define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_AVOIDBOUNDSERRORSCHECK_H
+
+#include "../ClangTidyCheck.h"
+
+namespace clang::tidy::cppcoreguidelines {
+
+/// Enforce CPP core guidelines SL.con.3
+///
+/// See
+/// https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors
+/// For the user-facing documentation see:
+/// http://clang.llvm.org/extra/clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors.html
+class AvoidBoundsErrorsCheck : public ClangTidyCheck {
+public:
+  AvoidBoundsErrorsCheck(StringRef Name, ClangTidyContext *Context)
+      : ClangTidyCheck(Name, Context) {}
+  void registerMatchers(ast_matchers::MatchFinder *Finder) override;
+  void check(const ast_matchers::MatchFinder::MatchResult &Result) override;
+};
+
+} // namespace clang::tidy::cppcoreguidelines
+
+#endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_AVOIDBOUNDSERRORSCHECK_H
diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/CMakeLists.txt b/clang-tools-extra/clang-tidy/cppcoreguidelines/CMakeLists.txt
index b023f76a25432d9..991961e0babf4e3 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/CMakeLists.txt
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/CMakeLists.txt
@@ -4,6 +4,7 @@ set(LLVM_LINK_COMPONENTS
   )
 
 add_clang_library(clangTidyCppCoreGuidelinesModule STATIC
+  AvoidBoundsErrorsCheck.cpp
   AvoidCapturingLambdaCoroutinesCheck.cpp
   AvoidConstOrRefDataMembersCheck.cpp
   AvoidDoWhileCheck.cpp
diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/CppCoreGuidelinesTidyModule.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/CppCoreGuidelinesTidyModule.cpp
index 6adef04264347bf..fc5141aa7945172 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/CppCoreGuidelinesTidyModule.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/CppCoreGuidelinesTidyModule.cpp
@@ -20,6 +20,7 @@
 #include "../performance/NoexceptMoveConstructorCheck.h"
 #include "../performance/NoexceptSwapCheck.h"
 #include "../readability/MagicNumbersCheck.h"
+#include "AvoidBoundsErrorsCheck.h"
 #include "AvoidCapturingLambdaCoroutinesCheck.h"
 #include "AvoidConstOrRefDataMembersCheck.h"
 #include "AvoidDoWhileCheck.h"
@@ -57,6 +58,8 @@ namespace cppcoreguidelines {
 class CppCoreGuidelinesModule : public ClangTidyModule {
 public:
   void addCheckFactories(ClangTidyCheckFactories &CheckFactories) override {
+    CheckFactories.registerCheck<AvoidBoundsErrorsCheck>(
+        "cppcoreguidelines-avoid-bounds-errors");
     CheckFactories.registerCheck<AvoidCapturingLambdaCoroutinesCheck>(
         "cppcoreguidelines-avoid-capturing-lambda-coroutines");
     CheckFactories.registerCheck<modernize::AvoidCArraysCheck>(
diff --git a/clang-tools-extra/docs/ReleaseNotes.rst b/clang-tools-extra/docs/ReleaseNotes.rst
index 6b8fe22242417ac..94afd2bae438094 100644
--- a/clang-tools-extra/docs/ReleaseNotes.rst
+++ b/clang-tools-extra/docs/ReleaseNotes.rst
@@ -110,6 +110,12 @@ Changes in existing checks
   <clang-tidy/checks/misc/redundant-expression>` check by providing additional
   examples and fixing some macro related false positives.
 
+- New :doc:`cppcoreguidelines-avoid-bounds-errors
+  <clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors>` check.
+
+  Flags the unsafe `operator[]` and replaces it with `at()`.
+
+
 Removed checks
 ^^^^^^^^^^^^^^
 
diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors.rst
new file mode 100644
index 000000000000000..8fb2e3bfde09813
--- /dev/null
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors.rst
@@ -0,0 +1,20 @@
+.. title:: clang-tidy - cppcoreguidelines-avoid-bounds-errors
+
+cppcoreguidelines-avoid-bounds-errors
+=====================================
+
+This check enforces the `SL.con.3 <https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors>` guideline.
+It flags all uses of `operator[]` on `std::vector`, `std::array`, `std::deque`, `std::map`, `std::unordered_map`, and `std::flat_map` and suggests to replace it with `at()`.
+Note that `std::span` and `std::mdspan` do not support `at()` as of C++23, so the use of `operator[]` is not flagged.
+
+For example the code
+
+.. code-block:: c++
+  std::array<int, 3> a;
+  int b = a[4];
+
+will be replaced by 
+
+.. code-block:: c++
+  std::vector<int, 3> a;
+  int b = a.at(4);
diff --git a/clang-tools-extra/docs/clang-tidy/checks/list.rst b/clang-tools-extra/docs/clang-tidy/checks/list.rst
index 7b9b905ef76715e..5d656f1ea50aad6 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/list.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/list.rst
@@ -181,6 +181,7 @@ Clang-Tidy Checks
    :doc:`cert-oop58-cpp <cert/oop58-cpp>`,
    :doc:`concurrency-mt-unsafe <concurrency/mt-unsafe>`,
    :doc:`concurrency-thread-canceltype-asynchronous <concurrency/thread-canceltype-asynchronous>`,
+   :doc:`cppcoreguidelines-avoid-bounds-errors <cppcoreguidelines/avoid-bounds-errors>`, "Yes"
    :doc:`cppcoreguidelines-avoid-capturing-lambda-coroutines <cppcoreguidelines/avoid-capturing-lambda-coroutines>`,
    :doc:`cppcoreguidelines-avoid-const-or-ref-data-members <cppcoreguidelines/avoid-const-or-ref-data-members>`,
    :doc:`cppcoreguidelines-avoid-do-while <cppcoreguidelines/avoid-do-while>`,
diff --git a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/avoid-bounds-errors.cpp b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/avoid-bounds-errors.cpp
new file mode 100644
index 000000000000000..23453b1f2df218e
--- /dev/null
+++ b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/avoid-bounds-errors.cpp
@@ -0,0 +1,66 @@
+namespace std {
+  template<typename T, unsigned size>
+  struct array {
+    T operator[](unsigned i) {
+      return T{1};
+    }
+    T at(unsigned i) {
+      return T{1};
+    }
+  };
+
+  template<typename T>
+  struct unique_ptr {
+    T operator[](unsigned i) {
+      return T{1};
+    }
+  };
+
+  template<typename T>
+  struct span {
+    T operator[](unsigned i) {
+      return T{1};
+    }
+  };
+} // namespace std
+
+namespace json {
+  template<typename T>
+  struct node{
+    T operator[](unsigned i) {
+      return T{1};
+    }
+  };
+} // namespace json
+
+
+// RUN: %check_clang_tidy %s cppcoreguidelines-avoid-bounds-errors %t
+std::array<int, 3> a;
+
+auto b = a[0];
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: Do not use operator[], use at() instead. [cppcoreguidelines-avoid-bounds-errors]
+// CHECK-FIXES: auto b = a.at(0);
+auto c = a[1+1];
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: Do not use operator[], use at() instead. [cppcoreguidelines-avoid-bounds-errors]
+// CHECK-FIXES: auto c = a.at(1+1);
+constexpr int index = 1;
+auto d = a[index];
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: Do not use operator[], use at() instead. [cppcoreguidelines-avoid-bounds-errors]
+// CHECK-FIXES: auto d = a.at(index);
+
+int e(int index) {
+  return a[index];
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: Do not use operator[], use at() instead. [cppcoreguidelines-avoid-bounds-errors]
+// CHECK-FIXES: return a.at(index);
+}
+
+auto f = a.at(0);
+
+std::unique_ptr<int> p;
+auto q = p[0];
+
+std::span<int> s;
+auto t = s[0];
+
+json::node<int> n;
+auto m = n[0];

>From fcc485b222212e4e5cbe2811c0bef48f8ffb20f6 Mon Sep 17 00:00:00 2001
From: Sebastian Wolf <wolf.sebastian at in.tum.de>
Date: Fri, 26 Apr 2024 09:06:02 +0200
Subject: [PATCH 02/53] EugeneZelenko's comments

---
 .../cppcoreguidelines/AvoidBoundsErrorsCheck.cpp       | 10 +++++-----
 .../cppcoreguidelines/AvoidBoundsErrorsCheck.h         |  3 +++
 clang-tools-extra/docs/ReleaseNotes.rst                |  2 +-
 .../checks/cppcoreguidelines/avoid-bounds-errors.rst   |  7 ++++---
 4 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp
index 524c21b5bdb8180..2c0a12e21d726b1 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp
@@ -9,13 +9,13 @@
 #include "AvoidBoundsErrorsCheck.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/Lex/Lexer.h"
-
 #include <iostream>
+
 using namespace clang::ast_matchers;
 
 namespace clang::tidy::cppcoreguidelines {
 
-bool isApplicable(const QualType &Type) {
+static bool isApplicable(const QualType &Type) {
   const auto TypeStr = Type.getAsString();
   bool Result = false;
   // Only check for containers in the std namespace
@@ -51,9 +51,9 @@ void AvoidBoundsErrorsCheck::registerMatchers(MatchFinder *Finder) {
 void AvoidBoundsErrorsCheck::check(const MatchFinder::MatchResult &Result) {
   const ASTContext &Context = *Result.Context;
   const SourceManager &Source = Context.getSourceManager();
-  const auto *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("x");
-  const auto *MatchedFunction = Result.Nodes.getNodeAs<CXXMethodDecl>("f");
-  const auto Type = MatchedFunction->getThisType();
+  const CallExpr *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("x");
+  const CXXMethodDecl *MatchedFunction = Result.Nodes.getNodeAs<CXXMethodDecl>("f");
+  const QualType Type = MatchedFunction->getThisType();
   if (!isApplicable(Type)) {
     return;
   }
diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.h b/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.h
index f915729cd7bbee3..12c785287712343 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.h
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.h
@@ -23,6 +23,9 @@ class AvoidBoundsErrorsCheck : public ClangTidyCheck {
 public:
   AvoidBoundsErrorsCheck(StringRef Name, ClangTidyContext *Context)
       : ClangTidyCheck(Name, Context) {}
+  bool isLanguageVersionSupported(const LangOptions &LangOpts) const override {
+    return LangOpts.CPlusPlus;
+  }
   void registerMatchers(ast_matchers::MatchFinder *Finder) override;
   void check(const ast_matchers::MatchFinder::MatchResult &Result) override;
 };
diff --git a/clang-tools-extra/docs/ReleaseNotes.rst b/clang-tools-extra/docs/ReleaseNotes.rst
index 94afd2bae438094..32e43e89ec1115f 100644
--- a/clang-tools-extra/docs/ReleaseNotes.rst
+++ b/clang-tools-extra/docs/ReleaseNotes.rst
@@ -113,7 +113,7 @@ Changes in existing checks
 - New :doc:`cppcoreguidelines-avoid-bounds-errors
   <clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors>` check.
 
-  Flags the unsafe `operator[]` and replaces it with `at()`.
+  Flags the unsafe ``operator[]`` and replaces it with ``at()``.
 
 
 Removed checks
diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors.rst
index 8fb2e3bfde09813..13683ee9b5a4678 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors.rst
@@ -3,9 +3,8 @@
 cppcoreguidelines-avoid-bounds-errors
 =====================================
 
-This check enforces the `SL.con.3 <https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors>` guideline.
-It flags all uses of `operator[]` on `std::vector`, `std::array`, `std::deque`, `std::map`, `std::unordered_map`, and `std::flat_map` and suggests to replace it with `at()`.
-Note that `std::span` and `std::mdspan` do not support `at()` as of C++23, so the use of `operator[]` is not flagged.
+This check flags all uses of ``operator[]`` on ``std::vector``, ``std::array``, ``std::deque``, ``std::map``, ``std::unordered_map``, and ``std::flat_map`` and suggests to replace it with ``at()``.
+Note that ``std::span`` and ``std::mdspan`` do not support ``at()`` as of C++23, so the use of ``operator[]`` is not flagged.
 
 For example the code
 
@@ -18,3 +17,5 @@ will be replaced by
 .. code-block:: c++
   std::vector<int, 3> a;
   int b = a.at(4);
+
+This check enforces the `SL.con.3 <https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors>` guideline.

>From ef247cc96a5d97d7ba41cc087be1775dcaaba55a Mon Sep 17 00:00:00 2001
From: Sebastian Wolf <wolf.sebastian at in.tum.de>
Date: Fri, 24 May 2024 12:09:11 +0200
Subject: [PATCH 03/53] Refactoring, but not finished yet

---
 .../AvoidBoundsErrorsCheck.cpp                | 97 ++++++++++---------
 .../cppcoreguidelines/avoid-bounds-errors.cpp | 17 ++--
 2 files changed, 57 insertions(+), 57 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp
index 2c0a12e21d726b1..f10b97820f4c7d1 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp
@@ -9,73 +9,74 @@
 #include "AvoidBoundsErrorsCheck.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/Lex/Lexer.h"
-#include <iostream>
 
 using namespace clang::ast_matchers;
 
 namespace clang::tidy::cppcoreguidelines {
 
-static bool isApplicable(const QualType &Type) {
-  const auto TypeStr = Type.getAsString();
-  bool Result = false;
-  // Only check for containers in the std namespace
-  if (TypeStr.find("std::vector") != std::string::npos) {
-    Result = true;
-  }
-  if (TypeStr.find("std::array") != std::string::npos) {
-    Result = true;
-  }
-  if (TypeStr.find("std::deque") != std::string::npos) {
-    Result = true;
-  }
-  if (TypeStr.find("std::map") != std::string::npos) {
-    Result = true;
-  }
-  if (TypeStr.find("std::unordered_map") != std::string::npos) {
-    Result = true;
-  }
-  if (TypeStr.find("std::flat_map") != std::string::npos) {
-    Result = true;
+const CXXMethodDecl *findAlternative(const CXXRecordDecl *MatchedParent,
+                                     const CXXMethodDecl *MatchedOperator) {
+  for (const CXXMethodDecl *Method : MatchedParent->methods()) {
+    const bool CorrectName = Method->getNameInfo().getAsString() == "at";
+    if (!CorrectName)
+      continue;
+
+    const bool SameReturnType =
+        Method->getReturnType() == MatchedOperator->getReturnType();
+    if (!SameReturnType)
+      continue;
+
+    const bool SameNumberOfArguments =
+        Method->getNumParams() == MatchedOperator->getNumParams();
+    if (!SameNumberOfArguments)
+      continue;
+
+    for (unsigned a = 0; a < Method->getNumParams(); a++) {
+      const bool SameArgType =
+          Method->parameters()[a]->getOriginalType() ==
+          MatchedOperator->parameters()[a]->getOriginalType();
+      if (!SameArgType)
+        continue;
+    }
+
+    return Method;
   }
-  // TODO Add std::span with C++26
-  return Result;
+  return static_cast<CXXMethodDecl *>(nullptr);
 }
 
 void AvoidBoundsErrorsCheck::registerMatchers(MatchFinder *Finder) {
+  // Need a callExpr here to match CXXOperatorCallExpr ``(&a)->operator[](0)``
+  // and CXXMemberCallExpr ``a[0]``.
   Finder->addMatcher(
-      callExpr(callee(cxxMethodDecl(hasName("operator[]")).bind("f")))
-          .bind("x"),
+      callExpr(
+          callee(
+              cxxMethodDecl(hasOverloadedOperatorName("[]")).bind("operator")),
+          callee(cxxMethodDecl(hasParent(
+              cxxRecordDecl(hasMethod(hasName("at"))).bind("parent")))))
+          .bind("caller"),
       this);
 }
 
 void AvoidBoundsErrorsCheck::check(const MatchFinder::MatchResult &Result) {
   const ASTContext &Context = *Result.Context;
   const SourceManager &Source = Context.getSourceManager();
-  const CallExpr *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("x");
-  const CXXMethodDecl *MatchedFunction = Result.Nodes.getNodeAs<CXXMethodDecl>("f");
-  const QualType Type = MatchedFunction->getThisType();
-  if (!isApplicable(Type)) {
-    return;
-  }
+  const CallExpr *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("caller");
+  const CXXMethodDecl *MatchedOperator =
+      Result.Nodes.getNodeAs<CXXMethodDecl>("operator");
+  const CXXRecordDecl *MatchedParent =
+      Result.Nodes.getNodeAs<CXXRecordDecl>("parent");
 
-  // Get original code.
-  const SourceLocation b(MatchedExpr->getBeginLoc());
-  const SourceLocation e(MatchedExpr->getEndLoc());
-  const std::string OriginalCode =
-      Lexer::getSourceText(CharSourceRange::getTokenRange(b, e), Source,
-                           getLangOpts())
-          .str();
-  const auto Range = SourceRange(b, e);
+  const CXXMethodDecl *Alternative =
+      findAlternative(MatchedParent, MatchedOperator);
+  if (!Alternative)
+    return;
 
-  // Build replacement.
-  std::string NewCode = OriginalCode;
-  const auto BeginOpen = NewCode.find("[");
-  NewCode.replace(BeginOpen, 1, ".at(");
-  const auto BeginClose = NewCode.find("]");
-  NewCode.replace(BeginClose, 1, ")");
+  const SourceLocation AlternativeSource(Alternative->getBeginLoc());
 
-  diag(MatchedExpr->getBeginLoc(), "Do not use operator[], use at() instead.")
-      << FixItHint::CreateReplacement(Range, NewCode);
+  diag(MatchedExpr->getBeginLoc(),
+       "found possibly unsafe operator[], consider using at() instead");
+  diag(Alternative->getBeginLoc(), "alternative at() defined here",
+       DiagnosticIDs::Note);
 }
 
 } // namespace clang::tidy::cppcoreguidelines
diff --git a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/avoid-bounds-errors.cpp b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/avoid-bounds-errors.cpp
index 23453b1f2df218e..5e12e7d71790d08 100644
--- a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/avoid-bounds-errors.cpp
+++ b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/avoid-bounds-errors.cpp
@@ -38,23 +38,22 @@ namespace json {
 std::array<int, 3> a;
 
 auto b = a[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: Do not use operator[], use at() instead. [cppcoreguidelines-avoid-bounds-errors]
-// CHECK-FIXES: auto b = a.at(0);
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-avoid-bounds-errors]
 auto c = a[1+1];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: Do not use operator[], use at() instead. [cppcoreguidelines-avoid-bounds-errors]
-// CHECK-FIXES: auto c = a.at(1+1);
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-avoid-bounds-errors]
 constexpr int index = 1;
 auto d = a[index];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: Do not use operator[], use at() instead. [cppcoreguidelines-avoid-bounds-errors]
-// CHECK-FIXES: auto d = a.at(index);
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-avoid-bounds-errors]
 
 int e(int index) {
   return a[index];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: Do not use operator[], use at() instead. [cppcoreguidelines-avoid-bounds-errors]
-// CHECK-FIXES: return a.at(index);
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-avoid-bounds-errors]
 }
 
-auto f = a.at(0);
+auto f = (&a)->operator[](1);
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-avoid-bounds-errors]
+
+auto g = a.at(0);
 
 std::unique_ptr<int> p;
 auto q = p[0];

>From 40eb30b5c7d45fed1254e2de8f05d7c645040779 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 10 Jun 2024 20:56:39 +0200
Subject: [PATCH 04/53] Rename AvoidBoundsErrorsCheck to
 PreferAtOverSubscriptOperatorCheck

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../cppcoreguidelines/CMakeLists.txt          |  2 +-
 .../CppCoreGuidelinesTidyModule.cpp           |  6 +--
 ...=> PreferAtOverSubscriptOperatorCheck.cpp} |  9 +++--
 ...h => PreferAtOverSubscriptOperatorCheck.h} | 16 ++++----
 clang-tools-extra/docs/ReleaseNotes.rst       | 38 +++++++++++++++++--
 ... => prefer-at-over-subscript-operator.rst} |  4 +-
 .../docs/clang-tidy/checks/list.rst           |  2 +-
 ... => prefer-at-over-subscript-operator.cpp} | 12 +++---
 8 files changed, 61 insertions(+), 28 deletions(-)
 rename clang-tools-extra/clang-tidy/cppcoreguidelines/{AvoidBoundsErrorsCheck.cpp => PreferAtOverSubscriptOperatorCheck.cpp} (90%)
 rename clang-tools-extra/clang-tidy/cppcoreguidelines/{AvoidBoundsErrorsCheck.h => PreferAtOverSubscriptOperatorCheck.h} (60%)
 rename clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/{avoid-bounds-errors.rst => prefer-at-over-subscript-operator.rst} (83%)
 rename clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/{avoid-bounds-errors.cpp => prefer-at-over-subscript-operator.cpp} (67%)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/CMakeLists.txt b/clang-tools-extra/clang-tidy/cppcoreguidelines/CMakeLists.txt
index 991961e0babf4e3..c08d09951347eb1 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/CMakeLists.txt
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/CMakeLists.txt
@@ -4,7 +4,6 @@ set(LLVM_LINK_COMPONENTS
   )
 
 add_clang_library(clangTidyCppCoreGuidelinesModule STATIC
-  AvoidBoundsErrorsCheck.cpp
   AvoidCapturingLambdaCoroutinesCheck.cpp
   AvoidConstOrRefDataMembersCheck.cpp
   AvoidDoWhileCheck.cpp
@@ -20,6 +19,7 @@ add_clang_library(clangTidyCppCoreGuidelinesModule STATIC
   NoMallocCheck.cpp
   NoSuspendWithLockCheck.cpp
   OwningMemoryCheck.cpp
+  PreferAtOverSubscriptOperatorCheck.cpp
   PreferMemberInitializerCheck.cpp
   ProBoundsArrayToPointerDecayCheck.cpp
   ProBoundsConstantArrayIndexCheck.cpp
diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/CppCoreGuidelinesTidyModule.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/CppCoreGuidelinesTidyModule.cpp
index fc5141aa7945172..f42049e8539401a 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/CppCoreGuidelinesTidyModule.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/CppCoreGuidelinesTidyModule.cpp
@@ -20,7 +20,6 @@
 #include "../performance/NoexceptMoveConstructorCheck.h"
 #include "../performance/NoexceptSwapCheck.h"
 #include "../readability/MagicNumbersCheck.h"
-#include "AvoidBoundsErrorsCheck.h"
 #include "AvoidCapturingLambdaCoroutinesCheck.h"
 #include "AvoidConstOrRefDataMembersCheck.h"
 #include "AvoidDoWhileCheck.h"
@@ -35,6 +34,7 @@
 #include "NoMallocCheck.h"
 #include "NoSuspendWithLockCheck.h"
 #include "OwningMemoryCheck.h"
+#include "PreferAtOverSubscriptOperatorCheck.h"
 #include "PreferMemberInitializerCheck.h"
 #include "ProBoundsArrayToPointerDecayCheck.h"
 #include "ProBoundsConstantArrayIndexCheck.h"
@@ -58,8 +58,6 @@ namespace cppcoreguidelines {
 class CppCoreGuidelinesModule : public ClangTidyModule {
 public:
   void addCheckFactories(ClangTidyCheckFactories &CheckFactories) override {
-    CheckFactories.registerCheck<AvoidBoundsErrorsCheck>(
-        "cppcoreguidelines-avoid-bounds-errors");
     CheckFactories.registerCheck<AvoidCapturingLambdaCoroutinesCheck>(
         "cppcoreguidelines-avoid-capturing-lambda-coroutines");
     CheckFactories.registerCheck<modernize::AvoidCArraysCheck>(
@@ -105,6 +103,8 @@ class CppCoreGuidelinesModule : public ClangTidyModule {
         "cppcoreguidelines-non-private-member-variables-in-classes");
     CheckFactories.registerCheck<OwningMemoryCheck>(
         "cppcoreguidelines-owning-memory");
+    CheckFactories.registerCheck<PreferAtOverSubscriptOperatorCheck>(
+        "cppcoreguidelines-prefer-at-over-subscript-operator");
     CheckFactories.registerCheck<PreferMemberInitializerCheck>(
         "cppcoreguidelines-prefer-member-initializer");
     CheckFactories.registerCheck<ProBoundsArrayToPointerDecayCheck>(
diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
similarity index 90%
rename from clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp
rename to clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
index f10b97820f4c7d1..64eaf8a1d4ebd5c 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
@@ -1,4 +1,4 @@
-//===--- AvoidBoundsErrorsCheck.cpp - clang-tidy --------------------------===//
+//===--- PreferAtOverSubscriptOperatorCheck.cpp - clang-tidy --------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
@@ -6,7 +6,7 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "AvoidBoundsErrorsCheck.h"
+#include "PreferAtOverSubscriptOperatorCheck.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/Lex/Lexer.h"
 
@@ -44,7 +44,7 @@ const CXXMethodDecl *findAlternative(const CXXRecordDecl *MatchedParent,
   return static_cast<CXXMethodDecl *>(nullptr);
 }
 
-void AvoidBoundsErrorsCheck::registerMatchers(MatchFinder *Finder) {
+void PreferAtOverSubscriptOperatorCheck::registerMatchers(MatchFinder *Finder) {
   // Need a callExpr here to match CXXOperatorCallExpr ``(&a)->operator[](0)``
   // and CXXMemberCallExpr ``a[0]``.
   Finder->addMatcher(
@@ -57,7 +57,8 @@ void AvoidBoundsErrorsCheck::registerMatchers(MatchFinder *Finder) {
       this);
 }
 
-void AvoidBoundsErrorsCheck::check(const MatchFinder::MatchResult &Result) {
+void PreferAtOverSubscriptOperatorCheck::check(
+    const MatchFinder::MatchResult &Result) {
   const ASTContext &Context = *Result.Context;
   const SourceManager &Source = Context.getSourceManager();
   const CallExpr *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("caller");
diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.h b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.h
similarity index 60%
rename from clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.h
rename to clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.h
index 12c785287712343..eb6e3a021e1b6ce 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/AvoidBoundsErrorsCheck.h
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.h
@@ -1,4 +1,5 @@
-//===--- AvoidBoundsErrorsCheck.h - clang-tidy ------------------*- C++ -*-===//
+//===--- PreferAtOverSubscriptOperatorCheck.h - clang-tidy ------*- C++ -*-===//
+//===--- PreferMemberInitializerCheck.h - clang-tidy ------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
@@ -6,8 +7,8 @@
 //
 //===----------------------------------------------------------------------===//
 
-#ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_AVOIDBOUNDSERRORSCHECK_H
-#define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_AVOIDBOUNDSERRORSCHECK_H
+#ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_PREFERATOVERSUBSCRIPTOPERATORCHECK_H
+#define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_PREFERATOVERSUBSCRIPTOPERATORCHECK_H
 
 #include "../ClangTidyCheck.h"
 
@@ -18,11 +19,10 @@ namespace clang::tidy::cppcoreguidelines {
 /// See
 /// https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors
 /// For the user-facing documentation see:
-/// http://clang.llvm.org/extra/clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors.html
-class AvoidBoundsErrorsCheck : public ClangTidyCheck {
+/// http://clang.llvm.org/extra/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.html
+class PreferAtOverSubscriptOperatorCheck : public ClangTidyCheck {
 public:
-  AvoidBoundsErrorsCheck(StringRef Name, ClangTidyContext *Context)
-      : ClangTidyCheck(Name, Context) {}
+  PreferAtOverSubscriptOperatorCheck(StringRef Name, ClangTidyContext *Context);
   bool isLanguageVersionSupported(const LangOptions &LangOpts) const override {
     return LangOpts.CPlusPlus;
   }
@@ -32,4 +32,4 @@ class AvoidBoundsErrorsCheck : public ClangTidyCheck {
 
 } // namespace clang::tidy::cppcoreguidelines
 
-#endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_AVOIDBOUNDSERRORSCHECK_H
+#endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_PREFERATOVERSUBSCRIPTOPERATORCHECK_H
diff --git a/clang-tools-extra/docs/ReleaseNotes.rst b/clang-tools-extra/docs/ReleaseNotes.rst
index 32e43e89ec1115f..d4e3a5276d917fe 100644
--- a/clang-tools-extra/docs/ReleaseNotes.rst
+++ b/clang-tools-extra/docs/ReleaseNotes.rst
@@ -110,10 +110,42 @@ Changes in existing checks
   <clang-tidy/checks/misc/redundant-expression>` check by providing additional
   examples and fixing some macro related false positives.
 
-- New :doc:`cppcoreguidelines-avoid-bounds-errors
-  <clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors>` check.
+- New :doc:`bugprone-crtp-constructor-accessibility
+  <clang-tidy/checks/bugprone/crtp-constructor-accessibility>` check.
 
-  Flags the unsafe ``operator[]`` and replaces it with ``at()``.
+  Detects error-prone Curiously Recurring Template Pattern usage, when the CRTP
+  can be constructed outside itself and the derived class.
+
+- New :doc:`bugprone-return-const-ref-from-parameter
+  <clang-tidy/checks/bugprone/return-const-ref-from-parameter>` check.
+
+  Detects return statements that return a constant reference parameter as constant
+  reference. This may cause use-after-free errors if the caller uses xvalues as
+  arguments.
+
+- New :doc:`bugprone-suspicious-stringview-data-usage
+  <clang-tidy/checks/bugprone/suspicious-stringview-data-usage>` check.
+
+  Identifies suspicious usages of ``std::string_view::data()`` that could lead
+  to reading out-of-bounds data due to inadequate or incorrect string null
+  termination.
+
+- New :doc:`misc-use-internal-linkage
+  <clang-tidy/checks/misc/use-internal-linkage>` check.
+
+  Detects variables and functions that can be marked as static or moved into
+  an anonymous namespace to enforce internal linkage.
+
+- New :doc:`modernize-min-max-use-initializer-list
+  <clang-tidy/checks/modernize/min-max-use-initializer-list>` check.
+
+  Replaces nested ``std::min`` and ``std::max`` calls with an initializer list
+  where applicable.
+
+- New :doc:`cppcoreguidelines-prefer-at-over-subscript-operator
+  <clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator>` check.
+
+  Flags the unsafe ``operator[]`` and suggests replacing it with ``at()``.
 
 
 Removed checks
diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
similarity index 83%
rename from clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors.rst
rename to clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
index 13683ee9b5a4678..183175b5966682c 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/avoid-bounds-errors.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
@@ -1,6 +1,6 @@
-.. title:: clang-tidy - cppcoreguidelines-avoid-bounds-errors
+.. title:: clang-tidy - cppcoreguidelines-prefer-at-over-subscript-operator
 
-cppcoreguidelines-avoid-bounds-errors
+cppcoreguidelines-prefer-at-over-subscript-operator
 =====================================
 
 This check flags all uses of ``operator[]`` on ``std::vector``, ``std::array``, ``std::deque``, ``std::map``, ``std::unordered_map``, and ``std::flat_map`` and suggests to replace it with ``at()``.
diff --git a/clang-tools-extra/docs/clang-tidy/checks/list.rst b/clang-tools-extra/docs/clang-tidy/checks/list.rst
index 5d656f1ea50aad6..c7b883a33933d3f 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/list.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/list.rst
@@ -181,7 +181,6 @@ Clang-Tidy Checks
    :doc:`cert-oop58-cpp <cert/oop58-cpp>`,
    :doc:`concurrency-mt-unsafe <concurrency/mt-unsafe>`,
    :doc:`concurrency-thread-canceltype-asynchronous <concurrency/thread-canceltype-asynchronous>`,
-   :doc:`cppcoreguidelines-avoid-bounds-errors <cppcoreguidelines/avoid-bounds-errors>`, "Yes"
    :doc:`cppcoreguidelines-avoid-capturing-lambda-coroutines <cppcoreguidelines/avoid-capturing-lambda-coroutines>`,
    :doc:`cppcoreguidelines-avoid-const-or-ref-data-members <cppcoreguidelines/avoid-const-or-ref-data-members>`,
    :doc:`cppcoreguidelines-avoid-do-while <cppcoreguidelines/avoid-do-while>`,
@@ -196,6 +195,7 @@ Clang-Tidy Checks
    :doc:`cppcoreguidelines-no-malloc <cppcoreguidelines/no-malloc>`,
    :doc:`cppcoreguidelines-no-suspend-with-lock <cppcoreguidelines/no-suspend-with-lock>`,
    :doc:`cppcoreguidelines-owning-memory <cppcoreguidelines/owning-memory>`,
+   :doc:`cppcoreguidelines-prefer-at-over-subscript-operator <cppcoreguidelines/prefer-at-over-subscript-operator>`,
    :doc:`cppcoreguidelines-prefer-member-initializer <cppcoreguidelines/prefer-member-initializer>`, "Yes"
    :doc:`cppcoreguidelines-pro-bounds-array-to-pointer-decay <cppcoreguidelines/pro-bounds-array-to-pointer-decay>`,
    :doc:`cppcoreguidelines-pro-bounds-constant-array-index <cppcoreguidelines/pro-bounds-constant-array-index>`, "Yes"
diff --git a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/avoid-bounds-errors.cpp b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
similarity index 67%
rename from clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/avoid-bounds-errors.cpp
rename to clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
index 5e12e7d71790d08..45071f8f9f2078f 100644
--- a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/avoid-bounds-errors.cpp
+++ b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
@@ -34,24 +34,24 @@ namespace json {
 } // namespace json
 
 
-// RUN: %check_clang_tidy %s cppcoreguidelines-avoid-bounds-errors %t
+// RUN: %check_clang_tidy %s cppcoreguidelines-prefer-at-over-subscript-operator %t
 std::array<int, 3> a;
 
 auto b = a[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-avoid-bounds-errors]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
 auto c = a[1+1];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-avoid-bounds-errors]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
 constexpr int index = 1;
 auto d = a[index];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-avoid-bounds-errors]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
 
 int e(int index) {
   return a[index];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-avoid-bounds-errors]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
 }
 
 auto f = (&a)->operator[](1);
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-avoid-bounds-errors]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
 
 auto g = a.at(0);
 

>From ca864b1996c100a1c50cb29f64ddb6b369448b79 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 10 Jun 2024 22:14:54 +0200
Subject: [PATCH 05/53] Add a user-customizable mechanism for excluding classes
 from the analysis

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../PreferAtOverSubscriptOperatorCheck.cpp    | 49 +++++++++++++++++--
 .../PreferAtOverSubscriptOperatorCheck.h      |  5 ++
 .../prefer-at-over-subscript-operator.cpp     | 36 +++++++++++++-
 3 files changed, 86 insertions(+), 4 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
index 64eaf8a1d4ebd5c..d7cdbc59d394101 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
@@ -7,13 +7,52 @@
 //===----------------------------------------------------------------------===//
 
 #include "PreferAtOverSubscriptOperatorCheck.h"
+#include "../utils/OptionsUtils.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
-#include "clang/Lex/Lexer.h"
+#include "llvm/ADT/StringRef.h"
+#include <algorithm>
+#include <numeric>
 
 using namespace clang::ast_matchers;
 
 namespace clang::tidy::cppcoreguidelines {
 
+static constexpr std::array<llvm::StringRef, 3> DefaultExclusions = {
+    llvm::StringRef("std::map"), llvm::StringRef("std::unordered_map"),
+    llvm::StringRef("std::flat_map")};
+
+PreferAtOverSubscriptOperatorCheck::PreferAtOverSubscriptOperatorCheck(
+    StringRef Name, ClangTidyContext *Context)
+    : ClangTidyCheck(Name, Context) {
+
+  ExcludedClasses = clang::tidy::utils::options::parseStringList(
+      Options.get("ExcludeClasses", ""));
+  ExcludedClasses.insert(ExcludedClasses.end(), DefaultExclusions.begin(),
+                         DefaultExclusions.end());
+}
+
+void PreferAtOverSubscriptOperatorCheck::storeOptions(
+    ClangTidyOptions::OptionMap &Opts) {
+
+  if (ExcludedClasses.size() == DefaultExclusions.size()) {
+    Options.store(Opts, "ExcludeClasses", "");
+    return;
+  }
+
+  // Sum up the sizes of the defaults ( + semicolons), so we can remove them
+  // from the saved options
+  size_t DefaultsStringLength =
+      std::transform_reduce(DefaultExclusions.begin(), DefaultExclusions.end(),
+                            DefaultExclusions.size(), std::plus<>(),
+                            [](llvm::StringRef Name) { return Name.size(); });
+
+  std::string Serialized =
+      clang::tidy::utils::options::serializeStringList(ExcludedClasses);
+
+  Options.store(Opts, "ExcludeClasses",
+                Serialized.substr(0, Serialized.size() - DefaultsStringLength));
+}
+
 const CXXMethodDecl *findAlternative(const CXXRecordDecl *MatchedParent,
                                      const CXXMethodDecl *MatchedOperator) {
   for (const CXXMethodDecl *Method : MatchedParent->methods()) {
@@ -67,13 +106,17 @@ void PreferAtOverSubscriptOperatorCheck::check(
   const CXXRecordDecl *MatchedParent =
       Result.Nodes.getNodeAs<CXXRecordDecl>("parent");
 
+  std::string ClassIdentifier = MatchedParent->getQualifiedNameAsString();
+
+  if (std::find(ExcludedClasses.begin(), ExcludedClasses.end(),
+                ClassIdentifier) != ExcludedClasses.end())
+    return;
+
   const CXXMethodDecl *Alternative =
       findAlternative(MatchedParent, MatchedOperator);
   if (!Alternative)
     return;
 
-  const SourceLocation AlternativeSource(Alternative->getBeginLoc());
-
   diag(MatchedExpr->getBeginLoc(),
        "found possibly unsafe operator[], consider using at() instead");
   diag(Alternative->getBeginLoc(), "alternative at() defined here",
diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.h b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.h
index eb6e3a021e1b6ce..f2450a7ab347086 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.h
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.h
@@ -28,6 +28,11 @@ class PreferAtOverSubscriptOperatorCheck : public ClangTidyCheck {
   }
   void registerMatchers(ast_matchers::MatchFinder *Finder) override;
   void check(const ast_matchers::MatchFinder::MatchResult &Result) override;
+  void storeOptions(ClangTidyOptions::OptionMap &Opts) override;
+
+private:
+  // A list of class names that are excluded from the warning
+  std::vector<llvm::StringRef> ExcludedClasses;
 };
 
 } // namespace clang::tidy::cppcoreguidelines
diff --git a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
index 45071f8f9f2078f..7da6c3155696994 100644
--- a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
+++ b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
@@ -34,7 +34,30 @@ namespace json {
 } // namespace json
 
 
-// RUN: %check_clang_tidy %s cppcoreguidelines-prefer-at-over-subscript-operator %t
+class ExcludedClass1 {
+  public:
+    int operator[](unsigned i) {
+      return 1;
+    }
+    int at(unsigned i) {
+      return 1;
+    }
+};
+
+class ExcludedClass2 {
+  public:
+    int operator[](unsigned i) {
+      return 1;
+    }
+    int at(unsigned i) {
+      return 1;
+    }
+};
+
+
+// RUN: %check_clang_tidy %s \
+// RUN: cppcoreguidelines-prefer-at-over-subscript-operator %t -- \
+// RUN: -config='{CheckOptions: {cppcoreguidelines-prefer-at-over-subscript-operator.ExcludeClasses: "ExcludedClass1;ExcludedClass2"}}'
 std::array<int, 3> a;
 
 auto b = a[0];
@@ -63,3 +86,14 @@ auto t = s[0];
 
 json::node<int> n;
 auto m = n[0];
+
+//explicitely excluded classes / struct / template
+ExcludedClass1 E1;
+auto x1 = E1[0];
+
+ExcludedClass2 E2;
+auto x2 = E1[0];
+
+std::map<int,int> TestMap;
+auto y = TestMap[0];
+

>From f93c3d6a27d1c09232cbc55354b92344fbca84d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 10 Jun 2024 22:16:49 +0200
Subject: [PATCH 06/53] Update the documentation

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../prefer-at-over-subscript-operator.rst     | 22 ++++++++++++++-----
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
index 183175b5966682c..42a2100f32582ca 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
@@ -3,8 +3,7 @@
 cppcoreguidelines-prefer-at-over-subscript-operator
 =====================================
 
-This check flags all uses of ``operator[]`` on ``std::vector``, ``std::array``, ``std::deque``, ``std::map``, ``std::unordered_map``, and ``std::flat_map`` and suggests to replace it with ``at()``.
-Note that ``std::span`` and ``std::mdspan`` do not support ``at()`` as of C++23, so the use of ``operator[]`` is not flagged.
+This check flags all uses of ``operator[]`` where an equivalent (same parameter and return types) ``at()`` method exists and suggest using that instead.
 
 For example the code
 
@@ -12,10 +11,21 @@ For example the code
   std::array<int, 3> a;
   int b = a[4];
 
-will be replaced by 
+will generate a warning but 
 
 .. code-block:: c++
-  std::vector<int, 3> a;
-  int b = a.at(4);
+  std::unique_ptr<int> a;
+  int b = a[0];
 
-This check enforces the `SL.con.3 <https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors>` guideline.
+will not.
+
+The classes ``std::map``, ``std::unordered_map`` and ``std::flat_map`` are excluded from this check, because for them the subscript operator has a defined behaviour when a key does not exist (inserting a new element).
+
+Options
+-------
+
+.. option:: ExcludeClasses
+
+    Semicolon-delimited list of class names that should additionally be excluded from this check. By default empty. 
+
+This check enforces part of the `SL.con.3 <https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors>` guideline.

>From 081440f5f9d2aa0d84bc4912b5bfe9963e1c79eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 10 Jun 2024 21:43:23 +0200
Subject: [PATCH 07/53] Add remaining tests requested by @PiotrZSL

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../prefer-at-over-subscript-operator.cpp     | 53 +++++++++++++++++--
 1 file changed, 48 insertions(+), 5 deletions(-)

diff --git a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
index 7da6c3155696994..cc7088bffeda96c 100644
--- a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
+++ b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
@@ -9,6 +9,16 @@ namespace std {
     }
   };
 
+  template<typename T, typename V>
+  struct map {
+    T operator[](unsigned i) {
+      return T{1};
+    }
+    T at(unsigned i) {
+      return T{1};
+    }
+  };
+
   template<typename T>
   struct unique_ptr {
     T operator[](unsigned i) {
@@ -33,6 +43,7 @@ namespace json {
   };
 } // namespace json
 
+struct SubClass : std::array<int, 3> {};
 
 class ExcludedClass1 {
   public:
@@ -62,15 +73,17 @@ std::array<int, 3> a;
 
 auto b = a[0];
 // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+
 auto c = a[1+1];
 // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
-constexpr int index = 1;
-auto d = a[index];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
 
-int e(int index) {
-  return a[index];
+constexpr int Index = 1;
+auto d = a[Index];
 // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+
+int e(int Ind) {
+  return a[Ind];
+  // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
 }
 
 auto f = (&a)->operator[](1);
@@ -87,6 +100,24 @@ auto t = s[0];
 json::node<int> n;
 auto m = n[0];
 
+SubClass Sub;
+auto r = Sub[0];
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+
+typedef std::array<int, 3> ar;
+ar BehindDef;
+auto u = BehindDef[0];
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+
+template<typename T> int TestTemplate(T t){
+  return t[0];
+  // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+
+}
+
+auto v = TestTemplate<>(a);
+auto w = TestTemplate<>(p);
+
 //explicitely excluded classes / struct / template
 ExcludedClass1 E1;
 auto x1 = E1[0];
@@ -97,3 +128,15 @@ auto x2 = E1[0];
 std::map<int,int> TestMap;
 auto y = TestMap[0];
 
+#define SUBSCRIPT_BEHIND_MARCO(x) a[x]
+#define ARG_BEHIND_MACRO 0
+#define OBJECT_BEHIND_MACRO a
+
+auto m1 = SUBSCRIPT_BEHIND_MARCO(0);
+// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+
+auto m2 = a[ARG_BEHIND_MACRO];
+// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+
+auto m3 = OBJECT_BEHIND_MACRO[0];
+// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]

>From 9bc599923def7d397522d4a4b52204cca649b12b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 10 Jun 2024 22:22:21 +0200
Subject: [PATCH 08/53] Remove unused and rename variables

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../PreferAtOverSubscriptOperatorCheck.cpp                | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
index d7cdbc59d394101..dc036e23e2af154 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
@@ -70,10 +70,10 @@ const CXXMethodDecl *findAlternative(const CXXRecordDecl *MatchedParent,
     if (!SameNumberOfArguments)
       continue;
 
-    for (unsigned a = 0; a < Method->getNumParams(); a++) {
+    for (unsigned ArgInd = 0; ArgInd < Method->getNumParams(); ArgInd++) {
       const bool SameArgType =
-          Method->parameters()[a]->getOriginalType() ==
-          MatchedOperator->parameters()[a]->getOriginalType();
+          Method->parameters()[ArgInd]->getOriginalType() ==
+          MatchedOperator->parameters()[ArgInd]->getOriginalType();
       if (!SameArgType)
         continue;
     }
@@ -98,8 +98,6 @@ void PreferAtOverSubscriptOperatorCheck::registerMatchers(MatchFinder *Finder) {
 
 void PreferAtOverSubscriptOperatorCheck::check(
     const MatchFinder::MatchResult &Result) {
-  const ASTContext &Context = *Result.Context;
-  const SourceManager &Source = Context.getSourceManager();
   const CallExpr *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("caller");
   const CXXMethodDecl *MatchedOperator =
       Result.Nodes.getNodeAs<CXXMethodDecl>("operator");

>From 3db4afb5a2b60c5101b22b287038b208e31d6e82 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Wed, 12 Jun 2024 16:56:40 +0200
Subject: [PATCH 09/53] Update types in
 PreferAtOverSubscriptOperatorCheck::check()

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../PreferAtOverSubscriptOperatorCheck.cpp                 | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
index dc036e23e2af154..0924fda164b4ad7 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
@@ -98,11 +98,10 @@ void PreferAtOverSubscriptOperatorCheck::registerMatchers(MatchFinder *Finder) {
 
 void PreferAtOverSubscriptOperatorCheck::check(
     const MatchFinder::MatchResult &Result) {
-  const CallExpr *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("caller");
-  const CXXMethodDecl *MatchedOperator =
+  const auto *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("caller");
+  const auto *MatchedOperator =
       Result.Nodes.getNodeAs<CXXMethodDecl>("operator");
-  const CXXRecordDecl *MatchedParent =
-      Result.Nodes.getNodeAs<CXXRecordDecl>("parent");
+  const auto *MatchedParent = Result.Nodes.getNodeAs<CXXRecordDecl>("parent");
 
   std::string ClassIdentifier = MatchedParent->getQualifiedNameAsString();
 

>From 048a49ae97707d3fa4e5cc34f8f5246da8648e5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Wed, 12 Jun 2024 17:00:00 +0200
Subject: [PATCH 10/53] Fix length of underline in
 prefer-at-over-subscript-operator.rst

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../cppcoreguidelines/prefer-at-over-subscript-operator.rst     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
index 42a2100f32582ca..96c71931ff2a31d 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
@@ -1,7 +1,7 @@
 .. title:: clang-tidy - cppcoreguidelines-prefer-at-over-subscript-operator
 
 cppcoreguidelines-prefer-at-over-subscript-operator
-=====================================
+===================================================
 
 This check flags all uses of ``operator[]`` where an equivalent (same parameter and return types) ``at()`` method exists and suggest using that instead.
 

>From c3f811c2103fc6719fcea97b07699f2ca8658ae7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Wed, 12 Jun 2024 17:02:33 +0200
Subject: [PATCH 11/53] Enforce 80 char column width in
 prefer-at-over-subscript-operator.rst

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../prefer-at-over-subscript-operator.rst          | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
index 96c71931ff2a31d..873564d12dd6b87 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
@@ -3,7 +3,8 @@
 cppcoreguidelines-prefer-at-over-subscript-operator
 ===================================================
 
-This check flags all uses of ``operator[]`` where an equivalent (same parameter and return types) ``at()`` method exists and suggest using that instead.
+This check flags all uses of ``operator[]`` where an equivalent (same parameter
+and return types) ``at()`` method exists and suggest using that instead.
 
 For example the code
 
@@ -19,13 +20,18 @@ will generate a warning but
 
 will not.
 
-The classes ``std::map``, ``std::unordered_map`` and ``std::flat_map`` are excluded from this check, because for them the subscript operator has a defined behaviour when a key does not exist (inserting a new element).
+The classes ``std::map``, ``std::unordered_map`` and ``std::flat_map`` are
+excluded from this check, because for them the subscript operator has a defined
+behaviour when a key does not exist (inserting a new element).
 
 Options
 -------
 
 .. option:: ExcludeClasses
 
-    Semicolon-delimited list of class names that should additionally be excluded from this check. By default empty. 
+    Semicolon-delimited list of class names that should additionally be
+    excluded from this check. By default empty.
 
-This check enforces part of the `SL.con.3 <https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors>` guideline.
+This check enforces part of the `SL.con.3
+<https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors>`
+guideline.

>From d9cb19cc75348d0c25e57abb13fefed232bfabcd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Thu, 13 Jun 2024 10:18:58 +0200
Subject: [PATCH 12/53] Synchronise prefer-at-over-subscript-operator.rst with
 ReleaseNotes.rst

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../cppcoreguidelines/prefer-at-over-subscript-operator.rst    | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
index 873564d12dd6b87..7999cd4baeb7c16 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
@@ -3,8 +3,7 @@
 cppcoreguidelines-prefer-at-over-subscript-operator
 ===================================================
 
-This check flags all uses of ``operator[]`` where an equivalent (same parameter
-and return types) ``at()`` method exists and suggest using that instead.
+Flags the unsafe ``operator[]`` and suggests replacing it with ``at()``.
 
 For example the code
 

>From 120a0f2556cf29a5d94f1d53298044439ec0619e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 17 Jun 2024 12:03:57 +0200
Subject: [PATCH 13/53] Move RUN lines to the top of
 prefer-at-over-subscript-operator.cpp

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../prefer-at-over-subscript-operator.cpp                 | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
index cc7088bffeda96c..76b84bf860cb612 100644
--- a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
+++ b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
@@ -1,3 +1,7 @@
+// RUN: %check_clang_tidy %s \
+// RUN: cppcoreguidelines-prefer-at-over-subscript-operator %t -- \
+// RUN: -config='{CheckOptions: {cppcoreguidelines-prefer-at-over-subscript-operator.ExcludeClasses: "ExcludedClass1;ExcludedClass2"}}'
+
 namespace std {
   template<typename T, unsigned size>
   struct array {
@@ -65,10 +69,6 @@ class ExcludedClass2 {
     }
 };
 
-
-// RUN: %check_clang_tidy %s \
-// RUN: cppcoreguidelines-prefer-at-over-subscript-operator %t -- \
-// RUN: -config='{CheckOptions: {cppcoreguidelines-prefer-at-over-subscript-operator.ExcludeClasses: "ExcludedClass1;ExcludedClass2"}}'
 std::array<int, 3> a;
 
 auto b = a[0];

>From dcd7c09cece6fb4249ff29b8eaa8b5359c8d42c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 17 Jun 2024 12:05:10 +0200
Subject: [PATCH 14/53] Add an empty lien after each `code-block` in
 prefer-at-over-subscript-operator.rst

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../cppcoreguidelines/prefer-at-over-subscript-operator.rst     | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
index 7999cd4baeb7c16..f3577cb5b15f09b 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
@@ -8,12 +8,14 @@ Flags the unsafe ``operator[]`` and suggests replacing it with ``at()``.
 For example the code
 
 .. code-block:: c++
+
   std::array<int, 3> a;
   int b = a[4];
 
 will generate a warning but 
 
 .. code-block:: c++
+
   std::unique_ptr<int> a;
   int b = a[0];
 

>From 9e109e12214aeceb76fa977de3ba0df024fddd73 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 17 Jun 2024 12:08:56 +0200
Subject: [PATCH 15/53] Use ofClass() instead of hasParent() in
 PreferAtOverSubscriptOperatorCheck.cpp

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
index 0924fda164b4ad7..d047c0b2332d111 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
@@ -90,8 +90,8 @@ void PreferAtOverSubscriptOperatorCheck::registerMatchers(MatchFinder *Finder) {
       callExpr(
           callee(
               cxxMethodDecl(hasOverloadedOperatorName("[]")).bind("operator")),
-          callee(cxxMethodDecl(hasParent(
-              cxxRecordDecl(hasMethod(hasName("at"))).bind("parent")))))
+          callee(cxxMethodDecl(
+              ofClass(cxxRecordDecl(hasMethod(hasName("at"))).bind("parent")))))
           .bind("caller"),
       this);
 }

>From ed74c81618ef8fff253eb895a1aa3630326bffa0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 17 Jun 2024 12:42:33 +0200
Subject: [PATCH 16/53] Use matchesAnyListedName() in matcher instead of
 explicit std::find() check

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../PreferAtOverSubscriptOperatorCheck.cpp        | 15 +++++----------
 .../prefer-at-over-subscript-operator.cpp         |  2 +-
 2 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
index d047c0b2332d111..82a957241042a13 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
@@ -7,10 +7,10 @@
 //===----------------------------------------------------------------------===//
 
 #include "PreferAtOverSubscriptOperatorCheck.h"
+#include "../utils/Matchers.h"
 #include "../utils/OptionsUtils.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "llvm/ADT/StringRef.h"
-#include <algorithm>
 #include <numeric>
 
 using namespace clang::ast_matchers;
@@ -18,8 +18,8 @@ using namespace clang::ast_matchers;
 namespace clang::tidy::cppcoreguidelines {
 
 static constexpr std::array<llvm::StringRef, 3> DefaultExclusions = {
-    llvm::StringRef("std::map"), llvm::StringRef("std::unordered_map"),
-    llvm::StringRef("std::flat_map")};
+    llvm::StringRef("::std::map"), llvm::StringRef("::std::unordered_map"),
+    llvm::StringRef("::std::flat_map")};
 
 PreferAtOverSubscriptOperatorCheck::PreferAtOverSubscriptOperatorCheck(
     StringRef Name, ClangTidyContext *Context)
@@ -91,7 +91,8 @@ void PreferAtOverSubscriptOperatorCheck::registerMatchers(MatchFinder *Finder) {
           callee(
               cxxMethodDecl(hasOverloadedOperatorName("[]")).bind("operator")),
           callee(cxxMethodDecl(
-              ofClass(cxxRecordDecl(hasMethod(hasName("at"))).bind("parent")))))
+              ofClass(cxxRecordDecl(hasMethod(hasName("at"))).bind("parent")),
+              unless(matchers::matchesAnyListedName(ExcludedClasses)))))
           .bind("caller"),
       this);
 }
@@ -103,12 +104,6 @@ void PreferAtOverSubscriptOperatorCheck::check(
       Result.Nodes.getNodeAs<CXXMethodDecl>("operator");
   const auto *MatchedParent = Result.Nodes.getNodeAs<CXXRecordDecl>("parent");
 
-  std::string ClassIdentifier = MatchedParent->getQualifiedNameAsString();
-
-  if (std::find(ExcludedClasses.begin(), ExcludedClasses.end(),
-                ClassIdentifier) != ExcludedClasses.end())
-    return;
-
   const CXXMethodDecl *Alternative =
       findAlternative(MatchedParent, MatchedOperator);
   if (!Alternative)
diff --git a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
index 76b84bf860cb612..4ae17688cb9e29f 100644
--- a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
+++ b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
@@ -1,6 +1,6 @@
 // RUN: %check_clang_tidy %s \
 // RUN: cppcoreguidelines-prefer-at-over-subscript-operator %t -- \
-// RUN: -config='{CheckOptions: {cppcoreguidelines-prefer-at-over-subscript-operator.ExcludeClasses: "ExcludedClass1;ExcludedClass2"}}'
+// RUN: -config='{CheckOptions: {cppcoreguidelines-prefer-at-over-subscript-operator.ExcludeClasses: "::ExcludedClass1;::ExcludedClass2"}}'
 
 namespace std {
   template<typename T, unsigned size>

>From 668087ba7c8ce56e9f0e152cd157e3917483ef68 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 17 Jun 2024 14:23:35 +0200
Subject: [PATCH 17/53] Match source range of expression in warnings emitted by
 PreferAtOverSubscriptOperatorCheck

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../PreferAtOverSubscriptOperatorCheck.cpp                  | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
index 82a957241042a13..5a5704deae14f22 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
@@ -110,9 +110,11 @@ void PreferAtOverSubscriptOperatorCheck::check(
     return;
 
   diag(MatchedExpr->getBeginLoc(),
-       "found possibly unsafe operator[], consider using at() instead");
+       "found possibly unsafe operator[], consider using at() instead")
+      << MatchedExpr->getSourceRange();
   diag(Alternative->getBeginLoc(), "alternative at() defined here",
-       DiagnosticIDs::Note);
+       DiagnosticIDs::Note)
+      << Alternative->getSourceRange();
 }
 
 } // namespace clang::tidy::cppcoreguidelines

>From ee299abd99e1585c6d247db707c5bbc982fda00c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Fri, 21 Jun 2024 10:42:45 +0200
Subject: [PATCH 18/53] PreferAtOverSubscriptOpterator ->
 ProBoundsAvoidUncheckedContainerAccesses

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../cppcoreguidelines/CMakeLists.txt          |  2 +-
 .../CppCoreGuidelinesTidyModule.cpp           |  6 ++---
 ...BoundsAvoidUncheckedContainerAccesses.cpp} | 16 +++++++-----
 ...roBoundsAvoidUncheckedContainerAccesses.h} | 15 ++++++-----
 clang-tools-extra/docs/ReleaseNotes.rst       |  4 +--
 ...ds-avoid-unchecked-container-accesses.rst} |  4 +--
 .../docs/clang-tidy/checks/list.rst           |  2 +-
 ...ds-avoid-unchecked-container-accesses.cpp} | 26 +++++++++----------
 8 files changed, 39 insertions(+), 36 deletions(-)
 rename clang-tools-extra/clang-tidy/cppcoreguidelines/{PreferAtOverSubscriptOperatorCheck.cpp => ProBoundsAvoidUncheckedContainerAccesses.cpp} (88%)
 rename clang-tools-extra/clang-tidy/cppcoreguidelines/{PreferAtOverSubscriptOperatorCheck.h => ProBoundsAvoidUncheckedContainerAccesses.h} (67%)
 rename clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/{prefer-at-over-subscript-operator.rst => pro-bounds-avoid-unchecked-container-accesses.rst} (84%)
 rename clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/{prefer-at-over-subscript-operator.cpp => pro-bounds-avoid-unchecked-container-accesses.cpp} (82%)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/CMakeLists.txt b/clang-tools-extra/clang-tidy/cppcoreguidelines/CMakeLists.txt
index c08d09951347eb1..7ee0837f006cce2 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/CMakeLists.txt
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/CMakeLists.txt
@@ -19,9 +19,9 @@ add_clang_library(clangTidyCppCoreGuidelinesModule STATIC
   NoMallocCheck.cpp
   NoSuspendWithLockCheck.cpp
   OwningMemoryCheck.cpp
-  PreferAtOverSubscriptOperatorCheck.cpp
   PreferMemberInitializerCheck.cpp
   ProBoundsArrayToPointerDecayCheck.cpp
+  ProBoundsAvoidUncheckedContainerAccesses.cpp
   ProBoundsConstantArrayIndexCheck.cpp
   ProBoundsPointerArithmeticCheck.cpp
   ProTypeConstCastCheck.cpp
diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/CppCoreGuidelinesTidyModule.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/CppCoreGuidelinesTidyModule.cpp
index f42049e8539401a..23823cbc0387a78 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/CppCoreGuidelinesTidyModule.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/CppCoreGuidelinesTidyModule.cpp
@@ -34,9 +34,9 @@
 #include "NoMallocCheck.h"
 #include "NoSuspendWithLockCheck.h"
 #include "OwningMemoryCheck.h"
-#include "PreferAtOverSubscriptOperatorCheck.h"
 #include "PreferMemberInitializerCheck.h"
 #include "ProBoundsArrayToPointerDecayCheck.h"
+#include "ProBoundsAvoidUncheckedContainerAccesses.h"
 #include "ProBoundsConstantArrayIndexCheck.h"
 #include "ProBoundsPointerArithmeticCheck.h"
 #include "ProTypeConstCastCheck.h"
@@ -103,12 +103,12 @@ class CppCoreGuidelinesModule : public ClangTidyModule {
         "cppcoreguidelines-non-private-member-variables-in-classes");
     CheckFactories.registerCheck<OwningMemoryCheck>(
         "cppcoreguidelines-owning-memory");
-    CheckFactories.registerCheck<PreferAtOverSubscriptOperatorCheck>(
-        "cppcoreguidelines-prefer-at-over-subscript-operator");
     CheckFactories.registerCheck<PreferMemberInitializerCheck>(
         "cppcoreguidelines-prefer-member-initializer");
     CheckFactories.registerCheck<ProBoundsArrayToPointerDecayCheck>(
         "cppcoreguidelines-pro-bounds-array-to-pointer-decay");
+    CheckFactories.registerCheck<ProBoundsAvoidUncheckedContainerAccesses>(
+        "cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses");
     CheckFactories.registerCheck<ProBoundsConstantArrayIndexCheck>(
         "cppcoreguidelines-pro-bounds-constant-array-index");
     CheckFactories.registerCheck<ProBoundsPointerArithmeticCheck>(
diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
similarity index 88%
rename from clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
rename to clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index 5a5704deae14f22..19a52d0e565fa44 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -1,4 +1,4 @@
-//===--- PreferAtOverSubscriptOperatorCheck.cpp - clang-tidy --------------===//
+//===--- ProBoundsAvoidUncheckedContainerAccesses.cpp - clang-tidy --------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
@@ -6,7 +6,7 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "PreferAtOverSubscriptOperatorCheck.h"
+#include "ProBoundsAvoidUncheckedContainerAccesses.h"
 #include "../utils/Matchers.h"
 #include "../utils/OptionsUtils.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
@@ -21,8 +21,9 @@ static constexpr std::array<llvm::StringRef, 3> DefaultExclusions = {
     llvm::StringRef("::std::map"), llvm::StringRef("::std::unordered_map"),
     llvm::StringRef("::std::flat_map")};
 
-PreferAtOverSubscriptOperatorCheck::PreferAtOverSubscriptOperatorCheck(
-    StringRef Name, ClangTidyContext *Context)
+ProBoundsAvoidUncheckedContainerAccesses::
+    ProBoundsAvoidUncheckedContainerAccesses(StringRef Name,
+                                             ClangTidyContext *Context)
     : ClangTidyCheck(Name, Context) {
 
   ExcludedClasses = clang::tidy::utils::options::parseStringList(
@@ -31,7 +32,7 @@ PreferAtOverSubscriptOperatorCheck::PreferAtOverSubscriptOperatorCheck(
                          DefaultExclusions.end());
 }
 
-void PreferAtOverSubscriptOperatorCheck::storeOptions(
+void ProBoundsAvoidUncheckedContainerAccesses::storeOptions(
     ClangTidyOptions::OptionMap &Opts) {
 
   if (ExcludedClasses.size() == DefaultExclusions.size()) {
@@ -83,7 +84,8 @@ const CXXMethodDecl *findAlternative(const CXXRecordDecl *MatchedParent,
   return static_cast<CXXMethodDecl *>(nullptr);
 }
 
-void PreferAtOverSubscriptOperatorCheck::registerMatchers(MatchFinder *Finder) {
+void ProBoundsAvoidUncheckedContainerAccesses::registerMatchers(
+    MatchFinder *Finder) {
   // Need a callExpr here to match CXXOperatorCallExpr ``(&a)->operator[](0)``
   // and CXXMemberCallExpr ``a[0]``.
   Finder->addMatcher(
@@ -97,7 +99,7 @@ void PreferAtOverSubscriptOperatorCheck::registerMatchers(MatchFinder *Finder) {
       this);
 }
 
-void PreferAtOverSubscriptOperatorCheck::check(
+void ProBoundsAvoidUncheckedContainerAccesses::check(
     const MatchFinder::MatchResult &Result) {
   const auto *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("caller");
   const auto *MatchedOperator =
diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.h b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
similarity index 67%
rename from clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.h
rename to clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
index f2450a7ab347086..33abbef5e824375 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/PreferAtOverSubscriptOperatorCheck.h
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
@@ -1,4 +1,4 @@
-//===--- PreferAtOverSubscriptOperatorCheck.h - clang-tidy ------*- C++ -*-===//
+//===--- ProBoundsAvoidUncheckedContainerAccesses.h - clang-tidy *- C++ -*-===//
 //===--- PreferMemberInitializerCheck.h - clang-tidy ------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
@@ -7,8 +7,8 @@
 //
 //===----------------------------------------------------------------------===//
 
-#ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_PREFERATOVERSUBSCRIPTOPERATORCHECK_H
-#define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_PREFERATOVERSUBSCRIPTOPERATORCHECK_H
+#ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_PRO_BOUNDS_AVOID_UNCHECKED_CONTAINER_ACCESSES_H
+#define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_PRO_BOUNDS_AVOID_UNCHECKED_CONTAINER_ACCESSES_H
 
 #include "../ClangTidyCheck.h"
 
@@ -19,10 +19,11 @@ namespace clang::tidy::cppcoreguidelines {
 /// See
 /// https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors
 /// For the user-facing documentation see:
-/// http://clang.llvm.org/extra/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.html
-class PreferAtOverSubscriptOperatorCheck : public ClangTidyCheck {
+/// http://clang.llvm.org/extra/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.html
+class ProBoundsAvoidUncheckedContainerAccesses : public ClangTidyCheck {
 public:
-  PreferAtOverSubscriptOperatorCheck(StringRef Name, ClangTidyContext *Context);
+  ProBoundsAvoidUncheckedContainerAccesses(StringRef Name,
+                                           ClangTidyContext *Context);
   bool isLanguageVersionSupported(const LangOptions &LangOpts) const override {
     return LangOpts.CPlusPlus;
   }
@@ -37,4 +38,4 @@ class PreferAtOverSubscriptOperatorCheck : public ClangTidyCheck {
 
 } // namespace clang::tidy::cppcoreguidelines
 
-#endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_PREFERATOVERSUBSCRIPTOPERATORCHECK_H
+#endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_PRO_BOUNDS_AVOID_UNCHECKED_CONTAINER_ACCESSES_H
diff --git a/clang-tools-extra/docs/ReleaseNotes.rst b/clang-tools-extra/docs/ReleaseNotes.rst
index d4e3a5276d917fe..570660b96acf515 100644
--- a/clang-tools-extra/docs/ReleaseNotes.rst
+++ b/clang-tools-extra/docs/ReleaseNotes.rst
@@ -142,8 +142,8 @@ Changes in existing checks
   Replaces nested ``std::min`` and ``std::max`` calls with an initializer list
   where applicable.
 
-- New :doc:`cppcoreguidelines-prefer-at-over-subscript-operator
-  <clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator>` check.
+- New :doc:`cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses
+  <clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses>` check.
 
   Flags the unsafe ``operator[]`` and suggests replacing it with ``at()``.
 
diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
similarity index 84%
rename from clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
rename to clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
index f3577cb5b15f09b..616882738653d0f 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/prefer-at-over-subscript-operator.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
@@ -1,6 +1,6 @@
-.. title:: clang-tidy - cppcoreguidelines-prefer-at-over-subscript-operator
+.. title:: clang-tidy - cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses
 
-cppcoreguidelines-prefer-at-over-subscript-operator
+cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses
 ===================================================
 
 Flags the unsafe ``operator[]`` and suggests replacing it with ``at()``.
diff --git a/clang-tools-extra/docs/clang-tidy/checks/list.rst b/clang-tools-extra/docs/clang-tidy/checks/list.rst
index c7b883a33933d3f..27f4b5730bc4d44 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/list.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/list.rst
@@ -195,9 +195,9 @@ Clang-Tidy Checks
    :doc:`cppcoreguidelines-no-malloc <cppcoreguidelines/no-malloc>`,
    :doc:`cppcoreguidelines-no-suspend-with-lock <cppcoreguidelines/no-suspend-with-lock>`,
    :doc:`cppcoreguidelines-owning-memory <cppcoreguidelines/owning-memory>`,
-   :doc:`cppcoreguidelines-prefer-at-over-subscript-operator <cppcoreguidelines/prefer-at-over-subscript-operator>`,
    :doc:`cppcoreguidelines-prefer-member-initializer <cppcoreguidelines/prefer-member-initializer>`, "Yes"
    :doc:`cppcoreguidelines-pro-bounds-array-to-pointer-decay <cppcoreguidelines/pro-bounds-array-to-pointer-decay>`,
+   :doc:`cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses <cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses>`,
    :doc:`cppcoreguidelines-pro-bounds-constant-array-index <cppcoreguidelines/pro-bounds-constant-array-index>`, "Yes"
    :doc:`cppcoreguidelines-pro-bounds-pointer-arithmetic <cppcoreguidelines/pro-bounds-pointer-arithmetic>`,
    :doc:`cppcoreguidelines-pro-type-const-cast <cppcoreguidelines/pro-type-const-cast>`,
diff --git a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
similarity index 82%
rename from clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
rename to clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
index 4ae17688cb9e29f..1a7a7fba7d8a274 100644
--- a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/prefer-at-over-subscript-operator.cpp
+++ b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
@@ -1,6 +1,6 @@
 // RUN: %check_clang_tidy %s \
-// RUN: cppcoreguidelines-prefer-at-over-subscript-operator %t -- \
-// RUN: -config='{CheckOptions: {cppcoreguidelines-prefer-at-over-subscript-operator.ExcludeClasses: "::ExcludedClass1;::ExcludedClass2"}}'
+// RUN: cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses %t -- \
+// RUN: -config='{CheckOptions: {cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses.ExcludeClasses: "::ExcludedClass1;::ExcludedClass2"}}'
 
 namespace std {
   template<typename T, unsigned size>
@@ -72,22 +72,22 @@ class ExcludedClass2 {
 std::array<int, 3> a;
 
 auto b = a[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 auto c = a[1+1];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 constexpr int Index = 1;
 auto d = a[Index];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 int e(int Ind) {
   return a[Ind];
-  // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+  // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 }
 
 auto f = (&a)->operator[](1);
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 auto g = a.at(0);
 
@@ -102,16 +102,16 @@ auto m = n[0];
 
 SubClass Sub;
 auto r = Sub[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 typedef std::array<int, 3> ar;
 ar BehindDef;
 auto u = BehindDef[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 template<typename T> int TestTemplate(T t){
   return t[0];
-  // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+  // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 }
 
@@ -133,10 +133,10 @@ auto y = TestMap[0];
 #define OBJECT_BEHIND_MACRO a
 
 auto m1 = SUBSCRIPT_BEHIND_MARCO(0);
-// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 auto m2 = a[ARG_BEHIND_MACRO];
-// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 auto m3 = OBJECT_BEHIND_MACRO[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-prefer-at-over-subscript-operator]
+// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]

>From aa130b5a0ae180dc24546acbaccd7544a2f9653c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Fri, 21 Jun 2024 10:44:39 +0200
Subject: [PATCH 19/53] Remove extra comment

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
index 33abbef5e824375..8fdfd5e9eb518ec 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
@@ -1,5 +1,4 @@
 //===--- ProBoundsAvoidUncheckedContainerAccesses.h - clang-tidy *- C++ -*-===//
-//===--- PreferMemberInitializerCheck.h - clang-tidy ------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.

>From c7a49f1cd8daf690b35dda229f95b36ab99c4a83 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Fri, 21 Jun 2024 10:52:42 +0200
Subject: [PATCH 20/53] Mention bounds safety profile explicitly

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../pro-bounds-avoid-unchecked-container-accesses.rst         | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
index 616882738653d0f..f39c5171110a01e 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
@@ -35,4 +35,6 @@ Options
 
 This check enforces part of the `SL.con.3
 <https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors>`
-guideline.
+guideline and is part of the `Bounds Safety (Bounds 4)
+<https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#Pro-bounds-arrayindex>` profile 
+profile from the C++ Core Guidelines.

>From 9621b505664085efe353cedbd3e1b540c0968143 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Fri, 21 Jun 2024 10:55:53 +0200
Subject: [PATCH 21/53] Move paragraph about which rule/profile is being
 implemented above "Options"

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 ...pro-bounds-avoid-unchecked-container-accesses.rst | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
index f39c5171110a01e..b62ec4fc7b6b5d9 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
@@ -25,6 +25,12 @@ The classes ``std::map``, ``std::unordered_map`` and ``std::flat_map`` are
 excluded from this check, because for them the subscript operator has a defined
 behaviour when a key does not exist (inserting a new element).
 
+This check enforces part of the `SL.con.3
+<https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors>`
+guideline and is part of the `Bounds Safety (Bounds 4)
+<https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#Pro-bounds-arrayindex>` profile 
+profile from the C++ Core Guidelines.
+
 Options
 -------
 
@@ -32,9 +38,3 @@ Options
 
     Semicolon-delimited list of class names that should additionally be
     excluded from this check. By default empty.
-
-This check enforces part of the `SL.con.3
-<https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors>`
-guideline and is part of the `Bounds Safety (Bounds 4)
-<https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#Pro-bounds-arrayindex>` profile 
-profile from the C++ Core Guidelines.

>From a6526b640e2985b883050473a157ef2a07e94674 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Fri, 21 Jun 2024 11:09:05 +0200
Subject: [PATCH 22/53] Rename variables related to class exclusion mechanism

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 ...oBoundsAvoidUncheckedContainerAccesses.cpp | 26 ++++++++++---------
 ...ProBoundsAvoidUncheckedContainerAccesses.h |  2 +-
 2 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index 19a52d0e565fa44..b68583a77ac7f67 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -17,7 +17,7 @@ using namespace clang::ast_matchers;
 
 namespace clang::tidy::cppcoreguidelines {
 
-static constexpr std::array<llvm::StringRef, 3> DefaultExclusions = {
+static constexpr std::array<llvm::StringRef, 3> SubscriptDefaultExclusions = {
     llvm::StringRef("::std::map"), llvm::StringRef("::std::unordered_map"),
     llvm::StringRef("::std::flat_map")};
 
@@ -26,29 +26,30 @@ ProBoundsAvoidUncheckedContainerAccesses::
                                              ClangTidyContext *Context)
     : ClangTidyCheck(Name, Context) {
 
-  ExcludedClasses = clang::tidy::utils::options::parseStringList(
+  SubscriptExcludedClasses = clang::tidy::utils::options::parseStringList(
       Options.get("ExcludeClasses", ""));
-  ExcludedClasses.insert(ExcludedClasses.end(), DefaultExclusions.begin(),
-                         DefaultExclusions.end());
+  SubscriptExcludedClasses.insert(SubscriptExcludedClasses.end(),
+                                  SubscriptDefaultExclusions.begin(),
+                                  SubscriptDefaultExclusions.end());
 }
 
 void ProBoundsAvoidUncheckedContainerAccesses::storeOptions(
     ClangTidyOptions::OptionMap &Opts) {
 
-  if (ExcludedClasses.size() == DefaultExclusions.size()) {
+  if (SubscriptExcludedClasses.size() == SubscriptDefaultExclusions.size()) {
     Options.store(Opts, "ExcludeClasses", "");
     return;
   }
 
   // Sum up the sizes of the defaults ( + semicolons), so we can remove them
   // from the saved options
-  size_t DefaultsStringLength =
-      std::transform_reduce(DefaultExclusions.begin(), DefaultExclusions.end(),
-                            DefaultExclusions.size(), std::plus<>(),
-                            [](llvm::StringRef Name) { return Name.size(); });
+  size_t DefaultsStringLength = std::transform_reduce(
+      SubscriptDefaultExclusions.begin(), SubscriptDefaultExclusions.end(),
+      SubscriptDefaultExclusions.size(), std::plus<>(),
+      [](llvm::StringRef Name) { return Name.size(); });
 
-  std::string Serialized =
-      clang::tidy::utils::options::serializeStringList(ExcludedClasses);
+  std::string Serialized = clang::tidy::utils::options::serializeStringList(
+      SubscriptExcludedClasses);
 
   Options.store(Opts, "ExcludeClasses",
                 Serialized.substr(0, Serialized.size() - DefaultsStringLength));
@@ -94,7 +95,8 @@ void ProBoundsAvoidUncheckedContainerAccesses::registerMatchers(
               cxxMethodDecl(hasOverloadedOperatorName("[]")).bind("operator")),
           callee(cxxMethodDecl(
               ofClass(cxxRecordDecl(hasMethod(hasName("at"))).bind("parent")),
-              unless(matchers::matchesAnyListedName(ExcludedClasses)))))
+              unless(
+                  matchers::matchesAnyListedName(SubscriptExcludedClasses)))))
           .bind("caller"),
       this);
 }
diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
index 8fdfd5e9eb518ec..3776869e6d42a21 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
@@ -32,7 +32,7 @@ class ProBoundsAvoidUncheckedContainerAccesses : public ClangTidyCheck {
 
 private:
   // A list of class names that are excluded from the warning
-  std::vector<llvm::StringRef> ExcludedClasses;
+  std::vector<llvm::StringRef> SubscriptExcludedClasses;
 };
 
 } // namespace clang::tidy::cppcoreguidelines

>From 575c1769ce3c65db7a05d9294b649a17d67cbe64 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Sun, 30 Jun 2024 14:57:07 +0200
Subject: [PATCH 23/53] Remove redundant nullptr cast

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../ProBoundsAvoidUncheckedContainerAccesses.cpp                | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index b68583a77ac7f67..560ccf3c7ca8674 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -82,7 +82,7 @@ const CXXMethodDecl *findAlternative(const CXXRecordDecl *MatchedParent,
 
     return Method;
   }
-  return static_cast<CXXMethodDecl *>(nullptr);
+  return nullptr;
 }
 
 void ProBoundsAvoidUncheckedContainerAccesses::registerMatchers(

>From 82d4e57943ef5579ed06e0c7e8aa7b080c3dba36 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Sun, 30 Jun 2024 15:04:00 +0200
Subject: [PATCH 24/53] Refactor the check's matcher as per 5chmidti's
 suggestion

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 ...oBoundsAvoidUncheckedContainerAccesses.cpp | 24 +++++++++----------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index 560ccf3c7ca8674..054aa852ca6645d 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -55,9 +55,9 @@ void ProBoundsAvoidUncheckedContainerAccesses::storeOptions(
                 Serialized.substr(0, Serialized.size() - DefaultsStringLength));
 }
 
-const CXXMethodDecl *findAlternative(const CXXRecordDecl *MatchedParent,
-                                     const CXXMethodDecl *MatchedOperator) {
-  for (const CXXMethodDecl *Method : MatchedParent->methods()) {
+const CXXMethodDecl *findAlternative(const CXXMethodDecl *MatchedOperator) {
+  const CXXRecordDecl *Parent = MatchedOperator->getParent();
+  for (const CXXMethodDecl *Method : Parent->methods()) {
     const bool CorrectName = Method->getNameInfo().getAsString() == "at";
     if (!CorrectName)
       continue;
@@ -90,13 +90,13 @@ void ProBoundsAvoidUncheckedContainerAccesses::registerMatchers(
   // Need a callExpr here to match CXXOperatorCallExpr ``(&a)->operator[](0)``
   // and CXXMemberCallExpr ``a[0]``.
   Finder->addMatcher(
-      callExpr(
-          callee(
-              cxxMethodDecl(hasOverloadedOperatorName("[]")).bind("operator")),
-          callee(cxxMethodDecl(
-              ofClass(cxxRecordDecl(hasMethod(hasName("at"))).bind("parent")),
-              unless(
-                  matchers::matchesAnyListedName(SubscriptExcludedClasses)))))
+      mapAnyOf(cxxOperatorCallExpr, cxxMemberCallExpr)
+          .with(callee(cxxMethodDecl(hasOverloadedOperatorName("[]"),
+                                     ofClass(cxxRecordDecl(hasMethod(
+                                         cxxMethodDecl(hasName("at"))))),
+                                     unless(matchers::matchesAnyListedName(
+                                         SubscriptExcludedClasses)))
+                           .bind("operator")))
           .bind("caller"),
       this);
 }
@@ -106,10 +106,8 @@ void ProBoundsAvoidUncheckedContainerAccesses::check(
   const auto *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("caller");
   const auto *MatchedOperator =
       Result.Nodes.getNodeAs<CXXMethodDecl>("operator");
-  const auto *MatchedParent = Result.Nodes.getNodeAs<CXXRecordDecl>("parent");
 
-  const CXXMethodDecl *Alternative =
-      findAlternative(MatchedParent, MatchedOperator);
+  const CXXMethodDecl *Alternative = findAlternative(MatchedOperator);
   if (!Alternative)
     return;
 

>From 3362b33ea5289b801c34f45ca7ec4f0f0abc127c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Sun, 30 Jun 2024 15:15:10 +0200
Subject: [PATCH 25/53] Check that alternative is accessible in
 findAlternative() as per @5chmidti's and @PiotrZSL's suggestions

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../ProBoundsAvoidUncheckedContainerAccesses.cpp  | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index 054aa852ca6645d..d48b19bb36711e7 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -57,7 +57,22 @@ void ProBoundsAvoidUncheckedContainerAccesses::storeOptions(
 
 const CXXMethodDecl *findAlternative(const CXXMethodDecl *MatchedOperator) {
   const CXXRecordDecl *Parent = MatchedOperator->getParent();
+  const QualType SubscriptThisObjType =
+      MatchedOperator->getFunctionObjectParameterReferenceType();
+
   for (const CXXMethodDecl *Method : Parent->methods()) {
+    // Require 'Method' to be as accessible as 'MatchedOperator' or more
+    if (MatchedOperator->getAccess() < Method->getAccess())
+      continue;
+
+    if (MatchedOperator->isConst() != Method->isConst())
+      continue;
+
+    const QualType AtThisObjType =
+        Method->getFunctionObjectParameterReferenceType();
+    if (SubscriptThisObjType != AtThisObjType)
+      continue;
+
     const bool CorrectName = Method->getNameInfo().getAsString() == "at";
     if (!CorrectName)
       continue;

>From 2486185f9b77215f4bf88c7704f7a96a4c162c84 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Sun, 30 Jun 2024 15:28:10 +0200
Subject: [PATCH 26/53] Use upticks when diagnostic messages refer to code

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 ...oBoundsAvoidUncheckedContainerAccesses.cpp |  4 ++--
 ...nds-avoid-unchecked-container-accesses.cpp | 22 +++++++++----------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index d48b19bb36711e7..8998cbfc1aeb2e1 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -127,9 +127,9 @@ void ProBoundsAvoidUncheckedContainerAccesses::check(
     return;
 
   diag(MatchedExpr->getBeginLoc(),
-       "found possibly unsafe operator[], consider using at() instead")
+       "found possibly unsafe 'operator[]', consider using 'at()' instead")
       << MatchedExpr->getSourceRange();
-  diag(Alternative->getBeginLoc(), "alternative at() defined here",
+  diag(Alternative->getBeginLoc(), "alternative 'at()' defined here",
        DiagnosticIDs::Note)
       << Alternative->getSourceRange();
 }
diff --git a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
index 1a7a7fba7d8a274..9801dbb94ae2749 100644
--- a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
+++ b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
@@ -72,22 +72,22 @@ class ExcludedClass2 {
 std::array<int, 3> a;
 
 auto b = a[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 auto c = a[1+1];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 constexpr int Index = 1;
 auto d = a[Index];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 int e(int Ind) {
   return a[Ind];
-  // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+  // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 }
 
 auto f = (&a)->operator[](1);
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 auto g = a.at(0);
 
@@ -102,16 +102,16 @@ auto m = n[0];
 
 SubClass Sub;
 auto r = Sub[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 typedef std::array<int, 3> ar;
 ar BehindDef;
 auto u = BehindDef[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 template<typename T> int TestTemplate(T t){
   return t[0];
-  // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+  // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 }
 
@@ -133,10 +133,10 @@ auto y = TestMap[0];
 #define OBJECT_BEHIND_MACRO a
 
 auto m1 = SUBSCRIPT_BEHIND_MARCO(0);
-// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 auto m2 = a[ARG_BEHIND_MACRO];
-// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 auto m3 = OBJECT_BEHIND_MACRO[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe operator[], consider using at() instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]

>From 7136af7f82d06b138f5d55ba290e9e7b6b902161 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Sun, 30 Jun 2024 15:31:24 +0200
Subject: [PATCH 27/53] Make findAlternative() static

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../ProBoundsAvoidUncheckedContainerAccesses.cpp               | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index 8998cbfc1aeb2e1..324a36296aa7785 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -55,7 +55,8 @@ void ProBoundsAvoidUncheckedContainerAccesses::storeOptions(
                 Serialized.substr(0, Serialized.size() - DefaultsStringLength));
 }
 
-const CXXMethodDecl *findAlternative(const CXXMethodDecl *MatchedOperator) {
+static const CXXMethodDecl *
+findAlternative(const CXXMethodDecl *MatchedOperator) {
   const CXXRecordDecl *Parent = MatchedOperator->getParent();
   const QualType SubscriptThisObjType =
       MatchedOperator->getFunctionObjectParameterReferenceType();

>From cb14ed884db224ba30ea6c82995119f7bb3d905b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Sun, 30 Jun 2024 15:33:49 +0200
Subject: [PATCH 28/53] Move MatchedExpr definition closer to where it's first
 used in ProBoundsAvoidUncheckedContainerAccesses::check()

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../ProBoundsAvoidUncheckedContainerAccesses.cpp             | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index 324a36296aa7785..f3dff0769e994ec 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -119,14 +119,15 @@ void ProBoundsAvoidUncheckedContainerAccesses::registerMatchers(
 
 void ProBoundsAvoidUncheckedContainerAccesses::check(
     const MatchFinder::MatchResult &Result) {
-  const auto *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("caller");
   const auto *MatchedOperator =
       Result.Nodes.getNodeAs<CXXMethodDecl>("operator");
-
   const CXXMethodDecl *Alternative = findAlternative(MatchedOperator);
+
   if (!Alternative)
     return;
 
+  const auto *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("caller");
+
   diag(MatchedExpr->getBeginLoc(),
        "found possibly unsafe 'operator[]', consider using 'at()' instead")
       << MatchedExpr->getSourceRange();

>From c911b4667d3968b2b403aa7667b119f09d82557c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Sun, 30 Jun 2024 15:37:57 +0200
Subject: [PATCH 29/53] Synchronise comment in header file with ReleaseNotes
 and check description

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../ProBoundsAvoidUncheckedContainerAccesses.h                  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
index 3776869e6d42a21..a4770384db0ab20 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
@@ -13,7 +13,7 @@
 
 namespace clang::tidy::cppcoreguidelines {
 
-/// Enforce CPP core guidelines SL.con.3
+/// Flags the unsafe ``operator[]`` and suggests replacing it with ``at()``.
 ///
 /// See
 /// https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors

>From e5654906fcdfbe249e56a4fd9e139ae09d2ed14e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 8 Jul 2024 11:05:49 +0200
Subject: [PATCH 30/53] Reword reasoning re: class exclusion in
 pro-bounds-avoid-unchecked-container-accesses.rst

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../pro-bounds-avoid-unchecked-container-accesses.rst           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
index b62ec4fc7b6b5d9..a2ba12100cbf776 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
@@ -22,7 +22,7 @@ will generate a warning but
 will not.
 
 The classes ``std::map``, ``std::unordered_map`` and ``std::flat_map`` are
-excluded from this check, because for them the subscript operator has a defined
+excluded from this check, because their subscript operator has a defined
 behaviour when a key does not exist (inserting a new element).
 
 This check enforces part of the `SL.con.3

>From 9e7ecda6cd6bef6d01398838b75f0d3cc5006586 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 8 Jul 2024 11:15:32 +0200
Subject: [PATCH 31/53] Replace array with container
 inpro-bounds-avoid-unchecked-container-accesses.rst

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../pro-bounds-avoid-unchecked-container-accesses.rst           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
index a2ba12100cbf776..1221c38f238838f 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
@@ -9,7 +9,7 @@ For example the code
 
 .. code-block:: c++
 
-  std::array<int, 3> a;
+  std::vector<int> a;
   int b = a[4];
 
 will generate a warning but 

>From de95c8412f6f1a0ece03bccab3e41a0bc05cbe92 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 8 Jul 2024 11:17:39 +0200
Subject: [PATCH 32/53] Update unique_ptr example in
 pro-bounds-avoid-unchecked-container-accesses.rst

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../pro-bounds-avoid-unchecked-container-accesses.rst           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
index 1221c38f238838f..4bc91adb2ee62a6 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
@@ -16,7 +16,7 @@ will generate a warning but
 
 .. code-block:: c++
 
-  std::unique_ptr<int> a;
+  std::unique_ptr<vector> a;
   int b = a[0];
 
 will not.

>From 7317fe1adf81580b4384817e2fde7b21121b0749 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 8 Jul 2024 12:15:00 +0200
Subject: [PATCH 33/53] Remove outdated comment in
 ProBoundsAvoidUncheckedContainerAccess.cpp

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../ProBoundsAvoidUncheckedContainerAccesses.cpp                | 2 --
 1 file changed, 2 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index f3dff0769e994ec..81cb943082a6877 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -103,8 +103,6 @@ findAlternative(const CXXMethodDecl *MatchedOperator) {
 
 void ProBoundsAvoidUncheckedContainerAccesses::registerMatchers(
     MatchFinder *Finder) {
-  // Need a callExpr here to match CXXOperatorCallExpr ``(&a)->operator[](0)``
-  // and CXXMemberCallExpr ``a[0]``.
   Finder->addMatcher(
       mapAnyOf(cxxOperatorCallExpr, cxxMemberCallExpr)
           .with(callee(cxxMethodDecl(hasOverloadedOperatorName("[]"),

>From b23e923980681e7802f2e70b90ad67be37490f0d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 8 Jul 2024 12:21:27 +0200
Subject: [PATCH 34/53] Use TK_IgnoreUnlessSpelledInSource as traversal kind

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../cppcoreguidelines/ProBoundsConstantArrayIndexCheck.h      | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsConstantArrayIndexCheck.h b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsConstantArrayIndexCheck.h
index a583cc78b2c547f..6034b1542108e14 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsConstantArrayIndexCheck.h
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsConstantArrayIndexCheck.h
@@ -32,6 +32,10 @@ class ProBoundsConstantArrayIndexCheck : public ClangTidyCheck {
                            Preprocessor *ModuleExpanderPP) override;
   void registerMatchers(ast_matchers::MatchFinder *Finder) override;
   void storeOptions(ClangTidyOptions::OptionMap &Opts) override;
+  std::optional<TraversalKind> getCheckTraversalKind() const override {
+    return TK_IgnoreUnlessSpelledInSource;
+  }
+
   void check(const ast_matchers::MatchFinder::MatchResult &Result) override;
 };
 

>From 7fc754cfc1e0026cebb3bd49d7b21d82c15a28f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Thu, 25 Jul 2024 13:30:42 +0200
Subject: [PATCH 35/53] Revert "Use TK_IgnoreUnlessSpelledInSource as traversal
 kind"

This reverts commit ed2076750349881a2613816746fadd792212bb01.

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../cppcoreguidelines/ProBoundsConstantArrayIndexCheck.h      | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsConstantArrayIndexCheck.h b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsConstantArrayIndexCheck.h
index 6034b1542108e14..a583cc78b2c547f 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsConstantArrayIndexCheck.h
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsConstantArrayIndexCheck.h
@@ -32,10 +32,6 @@ class ProBoundsConstantArrayIndexCheck : public ClangTidyCheck {
                            Preprocessor *ModuleExpanderPP) override;
   void registerMatchers(ast_matchers::MatchFinder *Finder) override;
   void storeOptions(ClangTidyOptions::OptionMap &Opts) override;
-  std::optional<TraversalKind> getCheckTraversalKind() const override {
-    return TK_IgnoreUnlessSpelledInSource;
-  }
-
   void check(const ast_matchers::MatchFinder::MatchResult &Result) override;
 };
 

>From 257364ff6be1ad9355d1b280c5f94dcb388b6e34 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Fri, 2 Aug 2024 16:44:02 +0200
Subject: [PATCH 36/53] Add template test with std::map as an argument

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../pro-bounds-avoid-unchecked-container-accesses.cpp    | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
index 9801dbb94ae2749..447b4d1bed195ab 100644
--- a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
+++ b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
@@ -115,9 +115,15 @@ template<typename T> int TestTemplate(T t){
 
 }
 
+
 auto v = TestTemplate<>(a);
 auto w = TestTemplate<>(p);
 
+std::map<int,int> TestMap;
+auto x = TestTemplate<>(TestMap);
+
+auto y = TestMap[0];
+
 //explicitely excluded classes / struct / template
 ExcludedClass1 E1;
 auto x1 = E1[0];
@@ -125,9 +131,6 @@ auto x1 = E1[0];
 ExcludedClass2 E2;
 auto x2 = E1[0];
 
-std::map<int,int> TestMap;
-auto y = TestMap[0];
-
 #define SUBSCRIPT_BEHIND_MARCO(x) a[x]
 #define ARG_BEHIND_MACRO 0
 #define OBJECT_BEHIND_MACRO a

>From 0f1bc937acf4d89f78013c97ed589aeea941adf5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Fri, 2 Aug 2024 16:53:35 +0200
Subject: [PATCH 37/53] Use getNameInfo().getSourceRange() instead of
 getSourceRange() when printing the location of the alternative

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../ProBoundsAvoidUncheckedContainerAccesses.cpp                | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index 81cb943082a6877..6435277a020f5a2 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -131,7 +131,7 @@ void ProBoundsAvoidUncheckedContainerAccesses::check(
       << MatchedExpr->getSourceRange();
   diag(Alternative->getBeginLoc(), "alternative 'at()' defined here",
        DiagnosticIDs::Note)
-      << Alternative->getSourceRange();
+      << Alternative->getNameInfo().getSourceRange();
 }
 
 } // namespace clang::tidy::cppcoreguidelines

>From edf1a0a0db57a435d745983a9dd530548ebc105d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Sat, 3 Aug 2024 22:04:25 +0200
Subject: [PATCH 38/53] Replace use of Method->getNameInfo().getAsString() with
 Method->getName()

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../ProBoundsAvoidUncheckedContainerAccesses.cpp              | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index 6435277a020f5a2..c0f1fbd7923758b 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -74,8 +74,8 @@ findAlternative(const CXXMethodDecl *MatchedOperator) {
     if (SubscriptThisObjType != AtThisObjType)
       continue;
 
-    const bool CorrectName = Method->getNameInfo().getAsString() == "at";
-    if (!CorrectName)
+    if (!Method->getNameInfo().getName().isIdentifier() ||
+        Method->getName() != "at")
       continue;
 
     const bool SameReturnType =

>From 93b3f3bb84018abf0d5df78f2d33b9274051050c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Thu, 8 Aug 2024 11:33:36 +0200
Subject: [PATCH 39/53] Add TODO comment re: findAlternative()'s capabilities
 in class hierarchies

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../ProBoundsAvoidUncheckedContainerAccesses.cpp               | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index c0f1fbd7923758b..2bd4b2b96506a24 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -55,6 +55,9 @@ void ProBoundsAvoidUncheckedContainerAccesses::storeOptions(
                 Serialized.substr(0, Serialized.size() - DefaultsStringLength));
 }
 
+// TODO: if at() is defined in another class in the class hierarchy of the class
+// that defines the operator[] we matched on, findAlternative() will not detect
+// it.
 static const CXXMethodDecl *
 findAlternative(const CXXMethodDecl *MatchedOperator) {
   const CXXRecordDecl *Parent = MatchedOperator->getParent();

>From c71d7bb5a23686ab160aced40282389117359254 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Thu, 8 Aug 2024 12:52:25 +0200
Subject: [PATCH 40/53] Reduce size of SourceRange when printing warnings

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../ProBoundsAvoidUncheckedContainerAccesses.cpp              | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index 2bd4b2b96506a24..77798ccebdf897b 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -129,9 +129,9 @@ void ProBoundsAvoidUncheckedContainerAccesses::check(
 
   const auto *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("caller");
 
-  diag(MatchedExpr->getBeginLoc(),
+  diag(MatchedExpr->getCallee()->getBeginLoc(),
        "found possibly unsafe 'operator[]', consider using 'at()' instead")
-      << MatchedExpr->getSourceRange();
+      << MatchedExpr->getCallee()->getSourceRange();
   diag(Alternative->getBeginLoc(), "alternative 'at()' defined here",
        DiagnosticIDs::Note)
       << Alternative->getNameInfo().getSourceRange();

>From 0a7a3159e4f8b18450a057754470eddde2b2ea6e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Thu, 8 Aug 2024 16:09:34 +0200
Subject: [PATCH 41/53] Add customizable fixit suggestions

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 ...oBoundsAvoidUncheckedContainerAccesses.cpp | 142 ++++++++++++++++--
 ...ProBoundsAvoidUncheckedContainerAccesses.h |  21 ++-
 2 files changed, 145 insertions(+), 18 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index 77798ccebdf897b..09950ca516f585a 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -31,11 +31,15 @@ ProBoundsAvoidUncheckedContainerAccesses::
   SubscriptExcludedClasses.insert(SubscriptExcludedClasses.end(),
                                   SubscriptDefaultExclusions.begin(),
                                   SubscriptDefaultExclusions.end());
+  SubscriptFixMode = Options.get("SubscriptFixMode", None);
+  SubscriptFixFunction = Options.get("SubscriptFixFunction", "gsl::at");
 }
 
 void ProBoundsAvoidUncheckedContainerAccesses::storeOptions(
     ClangTidyOptions::OptionMap &Opts) {
 
+  Options.store(Opts, "SubscriptFixFunction", SubscriptFixFunction);
+  Options.store(Opts, "SubscriptFixMode", SubscriptFixMode);
   if (SubscriptExcludedClasses.size() == SubscriptDefaultExclusions.size()) {
     Options.store(Opts, "ExcludeClasses", "");
     return;
@@ -51,7 +55,7 @@ void ProBoundsAvoidUncheckedContainerAccesses::storeOptions(
   std::string Serialized = clang::tidy::utils::options::serializeStringList(
       SubscriptExcludedClasses);
 
-  Options.store(Opts, "ExcludeClasses",
+  Options.store(Opts, "SubscriptExcludeClasses",
                 Serialized.substr(0, Serialized.size() - DefaultsStringLength));
 }
 
@@ -59,7 +63,7 @@ void ProBoundsAvoidUncheckedContainerAccesses::storeOptions(
 // that defines the operator[] we matched on, findAlternative() will not detect
 // it.
 static const CXXMethodDecl *
-findAlternative(const CXXMethodDecl *MatchedOperator) {
+findAlternativeAt(const CXXMethodDecl *MatchedOperator) {
   const CXXRecordDecl *Parent = MatchedOperator->getParent();
   const QualType SubscriptThisObjType =
       MatchedOperator->getFunctionObjectParameterReferenceType();
@@ -109,8 +113,6 @@ void ProBoundsAvoidUncheckedContainerAccesses::registerMatchers(
   Finder->addMatcher(
       mapAnyOf(cxxOperatorCallExpr, cxxMemberCallExpr)
           .with(callee(cxxMethodDecl(hasOverloadedOperatorName("[]"),
-                                     ofClass(cxxRecordDecl(hasMethod(
-                                         cxxMethodDecl(hasName("at"))))),
                                      unless(matchers::matchesAnyListedName(
                                          SubscriptExcludedClasses)))
                            .bind("operator")))
@@ -120,21 +122,129 @@ void ProBoundsAvoidUncheckedContainerAccesses::registerMatchers(
 
 void ProBoundsAvoidUncheckedContainerAccesses::check(
     const MatchFinder::MatchResult &Result) {
-  const auto *MatchedOperator =
-      Result.Nodes.getNodeAs<CXXMethodDecl>("operator");
-  const CXXMethodDecl *Alternative = findAlternative(MatchedOperator);
-
-  if (!Alternative)
-    return;
 
   const auto *MatchedExpr = Result.Nodes.getNodeAs<CallExpr>("caller");
 
-  diag(MatchedExpr->getCallee()->getBeginLoc(),
-       "found possibly unsafe 'operator[]', consider using 'at()' instead")
-      << MatchedExpr->getCallee()->getSourceRange();
-  diag(Alternative->getBeginLoc(), "alternative 'at()' defined here",
-       DiagnosticIDs::Note)
-      << Alternative->getNameInfo().getSourceRange();
+  if (SubscriptFixMode == None) {
+    diag(MatchedExpr->getCallee()->getBeginLoc(),
+         "possibly unsafe 'operator[]', consider bound-safe alternatives")
+        << MatchedExpr->getCallee()->getSourceRange();
+    return;
+  }
+
+  if (const auto *OCE = dyn_cast<CXXOperatorCallExpr>(MatchedExpr)) {
+    // Case: a[i]
+    auto LeftBracket = SourceRange(OCE->getCallee()->getBeginLoc(),
+                                   OCE->getCallee()->getBeginLoc());
+    auto RightBracket =
+        SourceRange(OCE->getOperatorLoc(), OCE->getOperatorLoc());
+
+    if (SubscriptFixMode == At) {
+      // Case: a[i] => a.at(i)
+      const auto *MatchedOperator =
+          Result.Nodes.getNodeAs<CXXMethodDecl>("operator");
+      const CXXMethodDecl *Alternative = findAlternativeAt(MatchedOperator);
+
+      if (!Alternative) {
+        diag(MatchedExpr->getCallee()->getBeginLoc(),
+             "possibly unsafe 'operator[]', consider "
+             "bound-safe alternatives")
+            << MatchedExpr->getCallee()->getSourceRange();
+        return;
+      }
+
+      diag(MatchedExpr->getCallee()->getBeginLoc(),
+           "possibly unsafe 'operator[]', consider "
+           "bound-safe alternative 'at()'")
+          << MatchedExpr->getCallee()->getSourceRange()
+          << FixItHint::CreateReplacement(LeftBracket, ".at(")
+          << FixItHint::CreateReplacement(RightBracket, ")");
+
+      diag(Alternative->getBeginLoc(), "viable 'at()' is defined here",
+           DiagnosticIDs::Note)
+          << Alternative->getNameInfo().getSourceRange();
+
+    } else if (SubscriptFixMode == Function) {
+      // Case: a[i] => f(a, i)
+      diag(MatchedExpr->getCallee()->getBeginLoc(),
+           "possibly unsafe 'operator[]', use safe function '" +
+               SubscriptFixFunction.str() + "()' instead")
+          << MatchedExpr->getCallee()->getSourceRange()
+          << FixItHint::CreateInsertion(MatchedExpr->getBeginLoc(),
+                                        SubscriptFixFunction.str() + "(")
+          // Since C++23, the subscript operator may also be called without an
+          // argument, which makes the following distinction necessary
+          << (MatchedExpr->getDirectCallee()->getNumParams() > 0
+                  ? FixItHint::CreateReplacement(LeftBracket, ", ")
+                  : FixItHint::CreateRemoval(LeftBracket))
+          << FixItHint::CreateReplacement(RightBracket, ")");
+    }
+  } else if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(MatchedExpr)) {
+    // Case: a.operator[](i) or a->operator[](i)
+    const auto *Callee = dyn_cast<MemberExpr>(MCE->getCallee());
+
+    if (SubscriptFixMode == At) {
+      // Cases: a.operator[](i) => a.at(i) and a->operator[](i) => a->at(i)
+
+      const auto *MatchedOperator =
+          Result.Nodes.getNodeAs<CXXMethodDecl>("operator");
+
+      const CXXMethodDecl *Alternative = findAlternativeAt(MatchedOperator);
+      if (!Alternative) {
+        diag(Callee->getBeginLoc(), "possibly unsafe 'operator[]', consider "
+                                    "bound-safe alternative 'at()'")
+            << Callee->getSourceRange();
+        return;
+      }
+      diag(MatchedExpr->getCallee()->getBeginLoc(),
+           "possibly unsafe 'operator[]', consider "
+           "bound-safe alternative 'at()'")
+          << FixItHint::CreateReplacement(
+                 SourceRange(Callee->getMemberLoc(), Callee->getEndLoc()),
+                 "at");
+
+      diag(Alternative->getBeginLoc(), "viable 'at()' defined here",
+           DiagnosticIDs::Note)
+          << Alternative->getNameInfo().getSourceRange();
+
+    } else if (SubscriptFixMode == Function) {
+      // Cases: a.operator[](i) => f(a, i) and a->operator[](i) => f(*a, i)
+      const auto *Callee = dyn_cast<MemberExpr>(MCE->getCallee());
+      std::string BeginInsertion = SubscriptFixFunction.str() + "(";
+
+      if (Callee->isArrow())
+        BeginInsertion += "*";
+
+      diag(Callee->getBeginLoc(),
+           "possibly unsafe 'operator[]', use safe function '" +
+               SubscriptFixFunction.str() + "()' instead")
+          << Callee->getSourceRange()
+          << FixItHint::CreateInsertion(MatchedExpr->getBeginLoc(),
+                                        BeginInsertion)
+          // Since C++23, the subscript operator may also be called without an
+          // argument, which makes the following distinction necessary
+          << ((MCE->getMethodDecl()->getNumNonObjectParams() > 0)
+                  ? FixItHint::CreateReplacement(
+                        SourceRange(
+                            Callee->getOperatorLoc(),
+                            MCE->getArg(0)->getBeginLoc().getLocWithOffset(-1)),
+                        ", ")
+                  : FixItHint::CreateRemoval(
+                        SourceRange(Callee->getOperatorLoc(),
+                                    MCE->getRParenLoc().getLocWithOffset(-1))));
+    }
+  }
 }
 
 } // namespace clang::tidy::cppcoreguidelines
+
+namespace clang::tidy {
+using P = cppcoreguidelines::ProBoundsAvoidUncheckedContainerAccesses;
+
+llvm::ArrayRef<std::pair<P::SubscriptFixModes, StringRef>>
+OptionEnumMapping<P::SubscriptFixModes>::getEnumMapping() {
+  static constexpr std::pair<P::SubscriptFixModes, StringRef> Mapping[] = {
+      {P::None, "None"}, {P::At, "at"}, {P::Function, "function"}};
+  return {Mapping};
+}
+} // namespace clang::tidy
diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
index a4770384db0ab20..aa2d3e94d046787 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
@@ -13,7 +13,8 @@
 
 namespace clang::tidy::cppcoreguidelines {
 
-/// Flags the unsafe ``operator[]`` and suggests replacing it with ``at()``.
+/// Flags the unsafe ``operator[]``. Can suggests fixing it with ``at()`` or a
+/// user-provided function.
 ///
 /// See
 /// https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors
@@ -30,11 +31,27 @@ class ProBoundsAvoidUncheckedContainerAccesses : public ClangTidyCheck {
   void check(const ast_matchers::MatchFinder::MatchResult &Result) override;
   void storeOptions(ClangTidyOptions::OptionMap &Opts) override;
 
+  enum SubscriptFixModes { None, At, Function };
+
 private:
   // A list of class names that are excluded from the warning
   std::vector<llvm::StringRef> SubscriptExcludedClasses;
+  // Setting which fix to suggest
+  SubscriptFixModes SubscriptFixMode;
+  llvm::StringRef SubscriptFixFunction;
 };
-
 } // namespace clang::tidy::cppcoreguidelines
 
+namespace clang::tidy {
+template <>
+struct OptionEnumMapping<
+    cppcoreguidelines::ProBoundsAvoidUncheckedContainerAccesses::
+        SubscriptFixModes> {
+  static ArrayRef<
+      std::pair<cppcoreguidelines::ProBoundsAvoidUncheckedContainerAccesses::
+                    SubscriptFixModes,
+                StringRef>>
+  getEnumMapping();
+};
+} // namespace clang::tidy
 #endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CPPCOREGUIDELINES_PRO_BOUNDS_AVOID_UNCHECKED_CONTAINER_ACCESSES_H

>From 5e22f3a22ed1ee588b206f2bb34b1fa7c6c57166 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Thu, 8 Aug 2024 16:15:41 +0200
Subject: [PATCH 42/53] Document customizable fixit suggestions

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 clang-tools-extra/docs/ReleaseNotes.rst       |  3 ++-
 ...nds-avoid-unchecked-container-accesses.rst | 21 ++++++++++++++-----
 .../docs/clang-tidy/checks/list.rst           |  2 +-
 3 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/clang-tools-extra/docs/ReleaseNotes.rst b/clang-tools-extra/docs/ReleaseNotes.rst
index 570660b96acf515..f83dded839f8c87 100644
--- a/clang-tools-extra/docs/ReleaseNotes.rst
+++ b/clang-tools-extra/docs/ReleaseNotes.rst
@@ -145,7 +145,8 @@ Changes in existing checks
 - New :doc:`cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses
   <clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses>` check.
 
-  Flags the unsafe ``operator[]`` and suggests replacing it with ``at()``.
+  Flags the unsafe ``operator[]``. Can suggests fixing it with ``at()`` or a
+  user-provided function.
 
 
 Removed checks
diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
index 4bc91adb2ee62a6..62540f106e4bdcf 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
@@ -1,9 +1,10 @@
 .. title:: clang-tidy - cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses
 
 cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses
-===================================================
+===============================================================
 
-Flags the unsafe ``operator[]`` and suggests replacing it with ``at()``.
+Flags the unsafe ``operator[]``. Can suggests fixing it with ``at()`` or a
+user-provided function.
 
 For example the code
 
@@ -19,7 +20,7 @@ will generate a warning but
   std::unique_ptr<vector> a;
   int b = a[0];
 
-will not.
+will generate a warning.
 
 The classes ``std::map``, ``std::unordered_map`` and ``std::flat_map`` are
 excluded from this check, because their subscript operator has a defined
@@ -28,13 +29,23 @@ behaviour when a key does not exist (inserting a new element).
 This check enforces part of the `SL.con.3
 <https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors>`
 guideline and is part of the `Bounds Safety (Bounds 4)
-<https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#Pro-bounds-arrayindex>` profile 
+<https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#Pro-bounds-arrayindex>`
 profile from the C++ Core Guidelines.
 
 Options
 -------
 
-.. option:: ExcludeClasses
+.. option:: SubscriptExcludeClasses
 
     Semicolon-delimited list of class names that should additionally be
     excluded from this check. By default empty.
+
+.. option:: SubscriptFixMode
+
+    Determines what fixes are suggested. Either `None` (default), `at` (use 
+    ``a.at(index)`` if a fitting function exists ) or `function` (use a 
+    function ``f(a, index)``).
+
+.. option:: SubscriptFixFunction
+
+    The function to use in the `function` mode. ``gsl::at`` by default.
diff --git a/clang-tools-extra/docs/clang-tidy/checks/list.rst b/clang-tools-extra/docs/clang-tidy/checks/list.rst
index 27f4b5730bc4d44..b4e2f2c8fc5f25d 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/list.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/list.rst
@@ -197,7 +197,7 @@ Clang-Tidy Checks
    :doc:`cppcoreguidelines-owning-memory <cppcoreguidelines/owning-memory>`,
    :doc:`cppcoreguidelines-prefer-member-initializer <cppcoreguidelines/prefer-member-initializer>`, "Yes"
    :doc:`cppcoreguidelines-pro-bounds-array-to-pointer-decay <cppcoreguidelines/pro-bounds-array-to-pointer-decay>`,
-   :doc:`cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses <cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses>`,
+   :doc:`cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses <cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses>`, "Yes"
    :doc:`cppcoreguidelines-pro-bounds-constant-array-index <cppcoreguidelines/pro-bounds-constant-array-index>`, "Yes"
    :doc:`cppcoreguidelines-pro-bounds-pointer-arithmetic <cppcoreguidelines/pro-bounds-pointer-arithmetic>`,
    :doc:`cppcoreguidelines-pro-type-const-cast <cppcoreguidelines/pro-type-const-cast>`,

>From 909804d086da0ed002fa9f546d22344e25ad8886 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Thu, 8 Aug 2024 16:10:46 +0200
Subject: [PATCH 43/53] Test customizable fixit suggestions

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 ...nds-avoid-unchecked-container-accesses.cpp | 124 +++++++++++++++---
 1 file changed, 103 insertions(+), 21 deletions(-)

diff --git a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
index 447b4d1bed195ab..b7f5e9ba3e5cb8b 100644
--- a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
+++ b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
@@ -1,16 +1,33 @@
-// RUN: %check_clang_tidy %s \
+// RUN: %check_clang_tidy -std=c++2b -check-suffix=DEFAULT %s \
 // RUN: cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses %t -- \
 // RUN: -config='{CheckOptions: {cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses.ExcludeClasses: "::ExcludedClass1;::ExcludedClass2"}}'
 
+// RUN: %check_clang_tidy -std=c++2b -check-suffix=AT %s \
+// RUN: cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses %t -- \
+// RUN: -config='{CheckOptions: {cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses.ExcludeClasses: "::ExcludedClass1;::ExcludedClass2", \
+// RUN: cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses.SubscriptFixMode: at}}'
+
+// RUN: %check_clang_tidy -std=c++2b -check-suffix=FUNC %s \
+// RUN: cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses %t -- \
+// RUN: -config='{CheckOptions: {cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses.ExcludeClasses: "::ExcludedClass1;::ExcludedClass2", \
+// RUN: cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses.SubscriptFixMode: function, \
+// RUN: cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses.SubscriptFixFunction: "f"}}'
+
 namespace std {
   template<typename T, unsigned size>
   struct array {
     T operator[](unsigned i) {
       return T{1};
     }
+    T operator[]() {
+      return T{1};
+    }
     T at(unsigned i) {
       return T{1};
     }
+    T at() {
+      return T{1};
+    }
   };
 
   template<typename T, typename V>
@@ -69,49 +86,96 @@ class ExcludedClass2 {
     }
 };
 
+template<class T> int f(T, unsigned){ return 0;}
+template<class T> int f(T){ return 0;}
+
 std::array<int, 3> a;
 
 auto b = a[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto b = a.at(0);
+// CHECK-FIXES-FUNC: auto b = f(a, 0);
+
+auto b23 = a[];
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:13: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto b23 = a.at();
+// CHECK-FIXES-FUNC: auto b23 = f(a);
+
 
 auto c = a[1+1];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto c = a.at(1+1);
+// CHECK-FIXES-FUNC: auto c = f(a, 1+1);
 
 constexpr int Index = 1;
 auto d = a[Index];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto d = a.at(Index);
+// CHECK-FIXES-FUNC: auto d = f(a, Index);
 
 int e(int Ind) {
   return a[Ind];
-  // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+  // CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+  // CHECK-FIXES-AT: return a.at(Ind);
+  // CHECK-FIXES-FUNC: return f(a, Ind);
 }
 
-auto f = (&a)->operator[](1);
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+auto fa = (&a)->operator[](1);
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto fa = (&a)->at(1);
+// CHECK-FIXES-FUNC: auto fa = f(*(&a), 1);
+
+auto fd = a.operator[](1);
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto fd = a.at(1);
+// CHECK-FIXES-FUNC: auto fd = f(a, 1);
+//
+auto fa23 = (&a)->operator[]();
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:13: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto fa23 = (&a)->at();
+// CHECK-FIXES-FUNC: auto fa23 = f(*(&a));
+
+auto fd23 = a.operator[]();
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:13: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto fd23 = a.at();
+// CHECK-FIXES-FUNC: auto fd23 = f(a);
 
 auto g = a.at(0);
 
 std::unique_ptr<int> p;
 auto q = p[0];
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto q = p[0];
+// CHECK-FIXES-FUNC: auto q = f(p, 0);
 
 std::span<int> s;
 auto t = s[0];
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto t = s[0];
+// CHECK-FIXES-FUNC: auto t = f(s, 0);
 
 json::node<int> n;
 auto m = n[0];
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto m = n[0];
+// CHECK-FIXES-FUNC: auto m = f(n, 0);
 
 SubClass Sub;
 auto r = Sub[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:13: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto r = Sub.at(0);
+// CHECK-FIXES-FUNC: auto r = f(Sub, 0);
 
 typedef std::array<int, 3> ar;
 ar BehindDef;
 auto u = BehindDef[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:19: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto u = BehindDef.at(0);
+// CHECK-FIXES-FUNC: auto u = f(BehindDef, 0);
 
 template<typename T> int TestTemplate(T t){
   return t[0];
-  // CHECK-MESSAGES: :[[@LINE-1]]:10: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+  // CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:10: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 }
 
@@ -119,27 +183,45 @@ template<typename T> int TestTemplate(T t){
 auto v = TestTemplate<>(a);
 auto w = TestTemplate<>(p);
 
-std::map<int,int> TestMap;
-auto x = TestTemplate<>(TestMap);
-
-auto y = TestMap[0];
-
-//explicitely excluded classes / struct / template
+//excluded classes 
 ExcludedClass1 E1;
 auto x1 = E1[0];
 
 ExcludedClass2 E2;
 auto x2 = E1[0];
 
-#define SUBSCRIPT_BEHIND_MARCO(x) a[x]
+std::map<int,int> TestMap;
+auto y = TestMap[0];
+
+#define SUBSCRIPT_BEHIND_MACRO(x) a[x]
 #define ARG_BEHIND_MACRO 0
 #define OBJECT_BEHIND_MACRO a
 
-auto m1 = SUBSCRIPT_BEHIND_MARCO(0);
-// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+auto m1 = SUBSCRIPT_BEHIND_MACRO(0);
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 auto m2 = a[ARG_BEHIND_MACRO];
-// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:12: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto m2 = a.at(ARG_BEHIND_MACRO);
+// CHECK-FIXES-FUNC: auto m2 = f(a, ARG_BEHIND_MACRO);
 
 auto m3 = OBJECT_BEHIND_MACRO[0];
-// CHECK-MESSAGES: :[[@LINE-1]]:11: warning: found possibly unsafe 'operator[]', consider using 'at()' instead [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:30: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto m3 = OBJECT_BEHIND_MACRO.at(0);
+// CHECK-FIXES-FUNC: auto m3 = f(OBJECT_BEHIND_MACRO, 0);
+
+// Check that spacing does not invalidate the fixes 
+std::array<int , 3> longname;
+
+auto z1 = longname   [    0    ]  ;
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:22: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto z1 = longname   .at(    0    )  ;
+// CHECK-FIXES-FUNC: auto z1 = f(longname   ,     0    )  ;
+auto z2 = longname   . operator[]   ( 0 );
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto z2 = longname   . at   ( 0 );
+// CHECK-FIXES-FUNC: auto z2 = f(longname   ,  0 );
+auto z3 = (&longname)   -> operator[]   ( 0 );
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-FIXES-AT: auto z3 = (&longname)   -> at   ( 0 );
+// CHECK-FIXES-FUNC: auto z3 = f(*(&longname)   ,  0 );

>From 466818eea200bf45cc3a14f76e47a3dbf0703e01 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Sat, 26 Oct 2024 20:43:04 +0200
Subject: [PATCH 44/53] Remove rebase artifacts in ReleaseNotes.rst

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 clang-tools-extra/docs/ReleaseNotes.rst | 45 ++++---------------------
 1 file changed, 6 insertions(+), 39 deletions(-)

diff --git a/clang-tools-extra/docs/ReleaseNotes.rst b/clang-tools-extra/docs/ReleaseNotes.rst
index f83dded839f8c87..068be5177fd409d 100644
--- a/clang-tools-extra/docs/ReleaseNotes.rst
+++ b/clang-tools-extra/docs/ReleaseNotes.rst
@@ -91,6 +91,12 @@ Improvements to clang-tidy
 New checks
 ^^^^^^^^^^
 
+- New :doc:`cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses
+  <clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses>` check.
+
+  Flags the unsafe ``operator[]``. Can suggests fixing it with ``at()`` or a
+  user-provided function.
+
 New check aliases
 ^^^^^^^^^^^^^^^^^
 
@@ -110,45 +116,6 @@ Changes in existing checks
   <clang-tidy/checks/misc/redundant-expression>` check by providing additional
   examples and fixing some macro related false positives.
 
-- New :doc:`bugprone-crtp-constructor-accessibility
-  <clang-tidy/checks/bugprone/crtp-constructor-accessibility>` check.
-
-  Detects error-prone Curiously Recurring Template Pattern usage, when the CRTP
-  can be constructed outside itself and the derived class.
-
-- New :doc:`bugprone-return-const-ref-from-parameter
-  <clang-tidy/checks/bugprone/return-const-ref-from-parameter>` check.
-
-  Detects return statements that return a constant reference parameter as constant
-  reference. This may cause use-after-free errors if the caller uses xvalues as
-  arguments.
-
-- New :doc:`bugprone-suspicious-stringview-data-usage
-  <clang-tidy/checks/bugprone/suspicious-stringview-data-usage>` check.
-
-  Identifies suspicious usages of ``std::string_view::data()`` that could lead
-  to reading out-of-bounds data due to inadequate or incorrect string null
-  termination.
-
-- New :doc:`misc-use-internal-linkage
-  <clang-tidy/checks/misc/use-internal-linkage>` check.
-
-  Detects variables and functions that can be marked as static or moved into
-  an anonymous namespace to enforce internal linkage.
-
-- New :doc:`modernize-min-max-use-initializer-list
-  <clang-tidy/checks/modernize/min-max-use-initializer-list>` check.
-
-  Replaces nested ``std::min`` and ``std::max`` calls with an initializer list
-  where applicable.
-
-- New :doc:`cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses
-  <clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses>` check.
-
-  Flags the unsafe ``operator[]``. Can suggests fixing it with ``at()`` or a
-  user-provided function.
-
-
 Removed checks
 ^^^^^^^^^^^^^^
 

>From 3a50664cf749f6acc2c5d56bcc3efbd55e4975b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Sat, 26 Oct 2024 20:56:56 +0200
Subject: [PATCH 45/53] Update one-sentence description of
 `cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses` check

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../ProBoundsAvoidUncheckedContainerAccesses.h                | 4 ++--
 clang-tools-extra/docs/ReleaseNotes.rst                       | 4 ++--
 .../pro-bounds-avoid-unchecked-container-accesses.rst         | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
index aa2d3e94d046787..6e7f28708773e5b 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.h
@@ -13,8 +13,8 @@
 
 namespace clang::tidy::cppcoreguidelines {
 
-/// Flags the unsafe ``operator[]``. Can suggests fixing it with ``at()`` or a
-/// user-provided function.
+/// Flags calls to operator[] in STL containers and suggests replacing it with
+/// safe alternatives.
 ///
 /// See
 /// https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors
diff --git a/clang-tools-extra/docs/ReleaseNotes.rst b/clang-tools-extra/docs/ReleaseNotes.rst
index 068be5177fd409d..c66d4af9aa954d0 100644
--- a/clang-tools-extra/docs/ReleaseNotes.rst
+++ b/clang-tools-extra/docs/ReleaseNotes.rst
@@ -94,8 +94,8 @@ New checks
 - New :doc:`cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses
   <clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses>` check.
 
-  Flags the unsafe ``operator[]``. Can suggests fixing it with ``at()`` or a
-  user-provided function.
+  Flags calls to operator[] in STL containers and suggests replacing it with
+  safe alternatives.
 
 New check aliases
 ^^^^^^^^^^^^^^^^^
diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
index 62540f106e4bdcf..3b546446bb065dc 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
@@ -3,8 +3,8 @@
 cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses
 ===============================================================
 
-Flags the unsafe ``operator[]``. Can suggests fixing it with ``at()`` or a
-user-provided function.
+Flags calls to operator[] in STL containers and suggests replacing it with
+safe alternatives.
 
 For example the code
 

>From 4e24fdab48e0a94a0f1ebb678c85d5f9071bb9ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Sat, 26 Oct 2024 21:01:59 +0200
Subject: [PATCH 46/53] Format description of the
 `cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses` in
 ReleaseNotes.rst

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 clang-tools-extra/docs/ReleaseNotes.rst | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/clang-tools-extra/docs/ReleaseNotes.rst b/clang-tools-extra/docs/ReleaseNotes.rst
index c66d4af9aa954d0..bc0dcf78e042688 100644
--- a/clang-tools-extra/docs/ReleaseNotes.rst
+++ b/clang-tools-extra/docs/ReleaseNotes.rst
@@ -92,7 +92,8 @@ New checks
 ^^^^^^^^^^
 
 - New :doc:`cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses
-  <clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses>` check.
+  <clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses>`
+  check.
 
   Flags calls to operator[] in STL containers and suggests replacing it with
   safe alternatives.

>From da347712e00fa713221a32da26eafb83854296ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Sat, 26 Oct 2024 21:06:26 +0200
Subject: [PATCH 47/53] Generalise description of excluded classes in
 `pro-bounds-avoid-unchecked-container-accesses.rst`

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../pro-bounds-avoid-unchecked-container-accesses.rst        | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
index 3b546446bb065dc..b677e1d34e41450 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
@@ -22,9 +22,8 @@ will generate a warning but
 
 will generate a warning.
 
-The classes ``std::map``, ``std::unordered_map`` and ``std::flat_map`` are
-excluded from this check, because their subscript operator has a defined
-behaviour when a key does not exist (inserting a new element).
+STL containers with well-defined behavior for `operator[] are excluded from this
+check.
 
 This check enforces part of the `SL.con.3
 <https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#slcon3-avoid-bounds-errors>`

>From e346926ffe21e3e437ac121b044f01baf81100b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Sat, 26 Oct 2024 21:21:47 +0200
Subject: [PATCH 48/53] s/bound-safe/bounds-safe

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 ...oBoundsAvoidUncheckedContainerAccesses.cpp | 10 ++---
 ...nds-avoid-unchecked-container-accesses.cpp | 42 +++++++++----------
 2 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
index 09950ca516f585a..e2f1072bfbaf0d4 100644
--- a/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
+++ b/clang-tools-extra/clang-tidy/cppcoreguidelines/ProBoundsAvoidUncheckedContainerAccesses.cpp
@@ -127,7 +127,7 @@ void ProBoundsAvoidUncheckedContainerAccesses::check(
 
   if (SubscriptFixMode == None) {
     diag(MatchedExpr->getCallee()->getBeginLoc(),
-         "possibly unsafe 'operator[]', consider bound-safe alternatives")
+         "possibly unsafe 'operator[]', consider bounds-safe alternatives")
         << MatchedExpr->getCallee()->getSourceRange();
     return;
   }
@@ -148,14 +148,14 @@ void ProBoundsAvoidUncheckedContainerAccesses::check(
       if (!Alternative) {
         diag(MatchedExpr->getCallee()->getBeginLoc(),
              "possibly unsafe 'operator[]', consider "
-             "bound-safe alternatives")
+             "bounds-safe alternatives")
             << MatchedExpr->getCallee()->getSourceRange();
         return;
       }
 
       diag(MatchedExpr->getCallee()->getBeginLoc(),
            "possibly unsafe 'operator[]', consider "
-           "bound-safe alternative 'at()'")
+           "bounds-safe alternative 'at()'")
           << MatchedExpr->getCallee()->getSourceRange()
           << FixItHint::CreateReplacement(LeftBracket, ".at(")
           << FixItHint::CreateReplacement(RightBracket, ")");
@@ -192,13 +192,13 @@ void ProBoundsAvoidUncheckedContainerAccesses::check(
       const CXXMethodDecl *Alternative = findAlternativeAt(MatchedOperator);
       if (!Alternative) {
         diag(Callee->getBeginLoc(), "possibly unsafe 'operator[]', consider "
-                                    "bound-safe alternative 'at()'")
+                                    "bounds-safe alternative 'at()'")
             << Callee->getSourceRange();
         return;
       }
       diag(MatchedExpr->getCallee()->getBeginLoc(),
            "possibly unsafe 'operator[]', consider "
-           "bound-safe alternative 'at()'")
+           "bounds-safe alternative 'at()'")
           << FixItHint::CreateReplacement(
                  SourceRange(Callee->getMemberLoc(), Callee->getEndLoc()),
                  "at");
diff --git a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
index b7f5e9ba3e5cb8b..9cff7c3e54bf3a1 100644
--- a/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
+++ b/clang-tools-extra/test/clang-tidy/checkers/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.cpp
@@ -92,51 +92,51 @@ template<class T> int f(T){ return 0;}
 std::array<int, 3> a;
 
 auto b = a[0];
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto b = a.at(0);
 // CHECK-FIXES-FUNC: auto b = f(a, 0);
 
 auto b23 = a[];
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:13: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:13: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto b23 = a.at();
 // CHECK-FIXES-FUNC: auto b23 = f(a);
 
 
 auto c = a[1+1];
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto c = a.at(1+1);
 // CHECK-FIXES-FUNC: auto c = f(a, 1+1);
 
 constexpr int Index = 1;
 auto d = a[Index];
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto d = a.at(Index);
 // CHECK-FIXES-FUNC: auto d = f(a, Index);
 
 int e(int Ind) {
   return a[Ind];
-  // CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+  // CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
   // CHECK-FIXES-AT: return a.at(Ind);
   // CHECK-FIXES-FUNC: return f(a, Ind);
 }
 
 auto fa = (&a)->operator[](1);
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto fa = (&a)->at(1);
 // CHECK-FIXES-FUNC: auto fa = f(*(&a), 1);
 
 auto fd = a.operator[](1);
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto fd = a.at(1);
 // CHECK-FIXES-FUNC: auto fd = f(a, 1);
 //
 auto fa23 = (&a)->operator[]();
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:13: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:13: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto fa23 = (&a)->at();
 // CHECK-FIXES-FUNC: auto fa23 = f(*(&a));
 
 auto fd23 = a.operator[]();
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:13: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:13: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto fd23 = a.at();
 // CHECK-FIXES-FUNC: auto fd23 = f(a);
 
@@ -144,38 +144,38 @@ auto g = a.at(0);
 
 std::unique_ptr<int> p;
 auto q = p[0];
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto q = p[0];
 // CHECK-FIXES-FUNC: auto q = f(p, 0);
 
 std::span<int> s;
 auto t = s[0];
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto t = s[0];
 // CHECK-FIXES-FUNC: auto t = f(s, 0);
 
 json::node<int> n;
 auto m = n[0];
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto m = n[0];
 // CHECK-FIXES-FUNC: auto m = f(n, 0);
 
 SubClass Sub;
 auto r = Sub[0];
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:13: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:13: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto r = Sub.at(0);
 // CHECK-FIXES-FUNC: auto r = f(Sub, 0);
 
 typedef std::array<int, 3> ar;
 ar BehindDef;
 auto u = BehindDef[0];
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:19: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:19: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto u = BehindDef.at(0);
 // CHECK-FIXES-FUNC: auto u = f(BehindDef, 0);
 
 template<typename T> int TestTemplate(T t){
   return t[0];
-  // CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:10: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+  // CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:10: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 }
 
@@ -198,15 +198,15 @@ auto y = TestMap[0];
 #define OBJECT_BEHIND_MACRO a
 
 auto m1 = SUBSCRIPT_BEHIND_MACRO(0);
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 
 auto m2 = a[ARG_BEHIND_MACRO];
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:12: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:12: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto m2 = a.at(ARG_BEHIND_MACRO);
 // CHECK-FIXES-FUNC: auto m2 = f(a, ARG_BEHIND_MACRO);
 
 auto m3 = OBJECT_BEHIND_MACRO[0];
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:30: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:30: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto m3 = OBJECT_BEHIND_MACRO.at(0);
 // CHECK-FIXES-FUNC: auto m3 = f(OBJECT_BEHIND_MACRO, 0);
 
@@ -214,14 +214,14 @@ auto m3 = OBJECT_BEHIND_MACRO[0];
 std::array<int , 3> longname;
 
 auto z1 = longname   [    0    ]  ;
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:22: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:22: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto z1 = longname   .at(    0    )  ;
 // CHECK-FIXES-FUNC: auto z1 = f(longname   ,     0    )  ;
 auto z2 = longname   . operator[]   ( 0 );
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto z2 = longname   . at   ( 0 );
 // CHECK-FIXES-FUNC: auto z2 = f(longname   ,  0 );
 auto z3 = (&longname)   -> operator[]   ( 0 );
-// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bound-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
+// CHECK-MESSAGES-DEFAULT: :[[@LINE-1]]:11: warning: possibly unsafe 'operator[]', consider bounds-safe alternatives [cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses]
 // CHECK-FIXES-AT: auto z3 = (&longname)   -> at   ( 0 );
 // CHECK-FIXES-FUNC: auto z3 = f(*(&longname)   ,  0 );

>From 8e73ccacd14304232591d75e4e305056aaccb8ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Mon, 4 Nov 2024 11:13:02 +0100
Subject: [PATCH 49/53] docs: remove whitespace

Co-authored-by: Manuel Pietsch <manuelpietsch at outlook.de>
---
 .../pro-bounds-avoid-unchecked-container-accesses.rst           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
index b677e1d34e41450..2fb34c795511c48 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
@@ -42,7 +42,7 @@ Options
 .. option:: SubscriptFixMode
 
     Determines what fixes are suggested. Either `None` (default), `at` (use 
-    ``a.at(index)`` if a fitting function exists ) or `function` (use a 
+    ``a.at(index)`` if a fitting function exists) or `function` (use a 
     function ``f(a, index)``).
 
 .. option:: SubscriptFixFunction

>From f0e5dddda186e910eebd4fb1a7f510711d6fa1c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Tue, 5 Nov 2024 10:33:45 +0100
Subject: [PATCH 50/53] Update clang-tools-extra/docs/ReleaseNotes.rst

Co-authored-by: EugeneZelenko <eugene.zelenko at gmail.com>
---
 clang-tools-extra/docs/ReleaseNotes.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang-tools-extra/docs/ReleaseNotes.rst b/clang-tools-extra/docs/ReleaseNotes.rst
index bc0dcf78e042688..1d54367a44879aa 100644
--- a/clang-tools-extra/docs/ReleaseNotes.rst
+++ b/clang-tools-extra/docs/ReleaseNotes.rst
@@ -95,7 +95,7 @@ New checks
   <clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses>`
   check.
 
-  Flags calls to operator[] in STL containers and suggests replacing it with
+  Flags calls to ``operator[]`` in STL containers and suggests replacing it with
   safe alternatives.
 
 New check aliases

>From 95044014560b92cabb0bc304d358193ba1558173 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Tue, 5 Nov 2024 10:34:34 +0100
Subject: [PATCH 51/53] Update
 clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst

Co-authored-by: EugeneZelenko <eugene.zelenko at gmail.com>
---
 .../pro-bounds-avoid-unchecked-container-accesses.rst           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
index 2fb34c795511c48..86bdaf3bdcd9ebc 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
@@ -22,7 +22,7 @@ will generate a warning but
 
 will generate a warning.
 
-STL containers with well-defined behavior for `operator[] are excluded from this
+STL containers with well-defined behavior for ``operator[]`` are excluded from this
 check.
 
 This check enforces part of the `SL.con.3

>From e8d756e4b681c486d0d7f8efe41f6c70be5ce689 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Tue, 5 Nov 2024 10:34:53 +0100
Subject: [PATCH 52/53] Update
 clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst

Co-authored-by: EugeneZelenko <eugene.zelenko at gmail.com>
---
 .../pro-bounds-avoid-unchecked-container-accesses.rst           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
index 86bdaf3bdcd9ebc..e03018f04eeb737 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
@@ -3,7 +3,7 @@
 cppcoreguidelines-pro-bounds-avoid-unchecked-container-accesses
 ===============================================================
 
-Flags calls to operator[] in STL containers and suggests replacing it with
+Flags calls to ``operator[]`` in STL containers and suggests replacing it with
 safe alternatives.
 
 For example the code

>From a7be15062a853218f5b577d0c4973d96b66682ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20Heidekr=C3=BCger?= <paul.heidekrueger at tum.de>
Date: Tue, 5 Nov 2024 10:41:43 +0100
Subject: [PATCH 53/53] Update
 clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst

Co-authored-by: EugeneZelenko <eugene.zelenko at gmail.com>
---
 .../pro-bounds-avoid-unchecked-container-accesses.rst           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
index e03018f04eeb737..91f6f661def536d 100644
--- a/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
+++ b/clang-tools-extra/docs/clang-tidy/checks/cppcoreguidelines/pro-bounds-avoid-unchecked-container-accesses.rst
@@ -37,7 +37,7 @@ Options
 .. option:: SubscriptExcludeClasses
 
     Semicolon-delimited list of class names that should additionally be
-    excluded from this check. By default empty.
+    excluded from this check. The default is an empty string.
 
 .. option:: SubscriptFixMode