[clang] [clang-tools-extra] [clang][Analysis] Handle const-qualified pointer refs in `ExprMutationAnalyzer` (PR #190421)

[Daniil Dudkin via cfe-commits]

================
@@ -145,9 +145,20 @@ class ExprPointeeResolve {
       // explicit cast will be checked in `findPointeeToNonConst`
       const CastKind kind = ICE->getCastKind();
       if (kind == CK_LValueToRValue || kind == CK_DerivedToBase ||
-          kind == CK_UncheckedDerivedToBase ||
-          (kind == CK_NoOp && (ICE->getType() == ICE->getSubExpr()->getType())))
+          kind == CK_UncheckedDerivedToBase)
         return resolveExpr(ICE->getSubExpr());
+      if (kind == CK_NoOp) {
+        // Binding `T *` to `T *const &` only adds top-level qualifiers to the
+        // pointer object, so this `CK_NoOp` still refers to the same pointer.
+        const QualType CastType =
+            ICE->getType().getLocalUnqualifiedType().getCanonicalType();
----------------
unterumarmung wrote:

`getLocalUnqualifiedType()` is needed because this path is trying to recognize when the cast only changes the pointer object itself, not the pointee type. Binding `T *` to `T *const &` adds `const` to the pointer value, but it still exposes the same mutable `T` pointee through the reference. If we treat that top-level `const` as a meaningful type difference, the analyzer stops looking through the cast and misses the later non-const use, which is what causes the false positive.

https://github.com/llvm/llvm-project/pull/190421