Fix #15094 SymbolDatabase: Variable::isReference() is true for function pointer returning a reference (#8931)

https://trac.cppcheck.net/ticket/15094

For a function pointer returning a reference, the reference of the
return type was taken as reference of the variable:

```cpp
struct S {
    std::string& (*f)(int, int);
    int& (*g[2])();
};
void foo(int& (*fp)(), int&& (*fp2)());
```

`Variable::isReference()` (and `isRValueReference()` for `fp2`) was true
for all of them.

`Variable::evaluate()` now drops the reference collected before the `(`
of a function declarator, as it belongs to the return type. A `&` after
the `(` still makes the variable a reference, so `int (*&f)()`, `int
(&f)()`, `int*& r`, `int (&a)[2]` and `int& (r)` are unchanged.

The `ValueType` of the function pointer is not changed: the type of a
call `fp()` is derived from it, so its reference has to stay the one of
the return type (clearing it caused `returnTempReference` FPs).

Two places relied on the wrong flags and are adjusted:
- `checkConstVariable`: a reference to a function returning a reference
(`int& (&f)()`) was skipped only because it was wrongly flagged as
rvalue reference. References to functions are now skipped explicitly
(this also fixes the existing FP for `int (&f)()`).
- Copy/move constructor detection: `Foo(Foo&& (*f)())` was a move
constructor. With the fix it is a normal constructor, and parameters
that are references to functions (`Foo(Foo& (&f)())`) no longer make a
copy/move constructor either.

Found with #8910, where it suppressed `uninitMemberVarNoCtor` for a
struct with such a member (codelite in the PR test results). #8910
contains a workaround in CheckClass for this; with this PR merged it can
be replaced by `var.isReference()` again.

This PR was created by Claude Code (an AI coding agent) on behalf of
@autoantwort.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: autoantwort

lib/checkother.cpp

@@ -1783,6 +1783,8 @@ void CheckOtherImpl::checkConstVariable()
             continue;
         if (var->isConst())
             continue;
+        if (Tokenizer::isFunctionPointer(var->nameToken())) // reference to function
+            continue;
         const Scope* scope = var->scope();
         if (!scope)
             continue;

lib/symboldatabase.cpp

@@ -917,7 +917,8 @@ void SymbolDatabase::createSymbolDatabaseCopyAndMoveConstructors()
                 continue;
 
             const Variable* firstArg = func->getArgumentVar(0);
-            if (firstArg->type() == scope.definedType) {
+            // skip references to functions: Foo(Foo& (&f)())
+            if (firstArg->type() == scope.definedType && !Token::Match(firstArg->typeEndToken(), "&|&& %name%| ) (")) {
                 if (firstArg->isRValueReference())
                     func->type = FunctionType::eMoveConstructor;
                 else if (firstArg->isReference() && !firstArg->isPointer())
@@ -2596,6 +2597,10 @@ void Variable::evaluate(const Settings& settings)
         } else if (tok->str() == "&&") { // Before simplification, && isn't split up
             setFlag(fIsRValueRef, true);
             setFlag(fIsReference, true); // Set also fIsReference
+        } else if (tok->str() == "(" && Token::simpleMatch(tok->link(), ") (")) {
+            // a reference before the parentheses belongs to the return type of a function pointer: int& (*f)()
+            setFlag(fIsRValueRef, false);
+            setFlag(fIsReference, false);
         }
 
         if (tok->str() == "<" && tok->link())

test/testautovariables.cpp

@@ -133,6 +133,7 @@ class TestAutoVariables : public TestFixture {
         TEST_CASE(returnReference27);
         TEST_CASE(returnReference28);
         TEST_CASE(returnReference29);
+        TEST_CASE(returnReference30); // #15094
         TEST_CASE(returnReferenceFunction);
         TEST_CASE(returnReferenceContainer);
         TEST_CASE(returnReferenceLiteral);
@@ -1772,6 +1773,23 @@ class TestAutoVariables : public TestFixture {
                       errout_str());
     }
 
+    void returnReference30() // #15094
+    {
+        check("int& f1(int& (*fp)()) { return fp(); }\n"
+              "void f2(int& (*fp)()) { int& r = fp(); r = 2; }\n"
+              "struct D {\n"
+              "    int& call() { return f(); }\n"
+              "    int& (*f)();\n"
+              "};\n"
+              "const int& f3(const int& (*fp)(int)) { return fp(1); }\n"
+              "int& (*g)();\n"
+              "int& f4() { return g(); }\n"
+              "typedef int& (*FP)();\n"
+              "int& f5(FP fp) { return fp(); }\n"
+              "int* f6(int& (*fp)()) { return &fp(); }\n");
+        ASSERT_EQUALS("", errout_str());
+    }
+
     void returnReferenceFunction() {
         check("int& f(int& a) {\n"
               "    return a;\n"

test/testother.cpp

@@ -4226,6 +4226,17 @@ class TestOther : public TestFixture {
               "    int select(DS &ds) { return select(ds, [](int) {}); }\n"
               "};\n");
         ASSERT_EQUALS("", errout_str());
+
+        check("int& g();\n" // reference to function
+              "int k();\n"
+              "int f1() { int& (&r)() = g; return r(); }\n"
+              "int f2() { int (&r)() = k; return r(); }\n"
+              "int& f3(int& (&f)()) { return f(); }\n"
+              "int f4(int&& (&f)()) { return f(); }\n"
+              "int f5(int (&f)()) { return f(); }\n"
+              "using FR = int&(&)();\n"
+              "void f6(FR f) { f(); }\n");
+        ASSERT_EQUALS("", errout_str());
     }
 
     void constParameterCallback() {

test/testsymboldatabase.cpp

@@ -1603,6 +1603,66 @@ class TestSymbolDatabase : public TestFixture {
             ASSERT(p->valueType()->originalTypeName == "ubFunctionPointer_fp");
             ASSERT(p->valueType()->reference == Reference::None);
         }
+        { // function pointer returning a reference
+            GET_SYMBOL_DB("void foo(int& (*f)()) {}\n");
+            const Variable* const p = db->getVariableFromVarId(1);
+            ASSERT(!p->isReference());
+            ASSERT(p->isPointer());
+            ASSERT(p->valueType());
+            ASSERT(p->valueType()->pointer == 1);
+        }
+        {
+            GET_SYMBOL_DB("void foo(int&& (*f)()) {}\n");
+            const Variable* const p = db->getVariableFromVarId(1);
+            ASSERT(!p->isReference());
+            ASSERT(!p->isRValueReference());
+        }
+        {
+            GET_SYMBOL_DB("struct S { int& (*f[2])(); };\n");
+            const Variable* const p = db->getVariableFromVarId(1);
+            ASSERT(!p->isReference());
+            ASSERT(p->isArray());
+        }
+        { // pointer to member function returning a reference
+            GET_SYMBOL_DB("struct S { int& g(); };\n"
+                          "void foo(int& (S::*pm)()) {}\n");
+            const Variable* const p = db->getVariableFromVarId(1);
+            ASSERT(p);
+            ASSERT_EQUALS("pm", p->name());
+            ASSERT(!p->isReference());
+        }
+        { // parentheses that are no function declarator
+            GET_SYMBOL_DB("void foo(int& (r)) {}\n");
+            const Variable* const p = db->functionScopes.front()->function->getArgumentVar(0);
+            ASSERT(p);
+            ASSERT(p->isReference());
+        }
+        {
+            GET_SYMBOL_DB("void foo(int& UNUSED(r)) {}\n");
+            const Variable* const p = db->functionScopes.front()->function->getArgumentVar(0);
+            ASSERT(p);
+            ASSERT(p->isReference());
+        }
+        { // reference to function pointer
+            GET_SYMBOL_DB("void foo(int (*&f)()) {}\n");
+            const Variable* const p = db->getVariableFromVarId(1);
+            ASSERT(p->isReference());
+            ASSERT(p->isPointer());
+            ASSERT(p->valueType());
+            ASSERT(p->valueType()->reference == Reference::LValue);
+        }
+        { // reference to function returning a reference
+            GET_SYMBOL_DB("void foo(int& (&f)()) {}\n");
+            const Variable* const p = db->getVariableFromVarId(1);
+            ASSERT(p->isReference());
+            ASSERT(!p->isRValueReference());
+        }
+        {
+            GET_SYMBOL_DB("void foo(int&& (&f)()) {}\n");
+            const Variable* const p = db->getVariableFromVarId(1);
+            ASSERT(p->isReference());
+            ASSERT(!p->isRValueReference());
+        }
     }
 
     void VariableValueTypeTemplate() {
@@ -2411,6 +2471,31 @@ class TestSymbolDatabase : public TestFixture {
             ASSERT(db && ctor && ctor->type == FunctionType::eMoveConstructor);
             ASSERT(ctor && ctor->retDef == nullptr);
         }
+        {
+            GET_SYMBOL_DB("class Foo { Foo(Foo&& (*f)()); };\n");
+            const Function* ctor = tokenizer.tokens()->tokAt(3)->function();
+            ASSERT(db && ctor && ctor->type == FunctionType::eConstructor);
+        }
+        {
+            GET_SYMBOL_DB("class Foo { Foo(Foo& (&f)()); };\n");
+            const Function* ctor = tokenizer.tokens()->tokAt(3)->function();
+            ASSERT(db && ctor && ctor->type == FunctionType::eConstructor);
+        }
+        {
+            GET_SYMBOL_DB("class Foo { Foo(Foo&& (&f)()); };\n");
+            const Function* ctor = tokenizer.tokens()->tokAt(3)->function();
+            ASSERT(db && ctor && ctor->type == FunctionType::eConstructor);
+        }
+        {
+            GET_SYMBOL_DB("class Foo { Foo(Foo (&f)()); };\n");
+            const Function* ctor = tokenizer.tokens()->tokAt(3)->function();
+            ASSERT(db && ctor && ctor->type == FunctionType::eConstructor);
+        }
+        {
+            GET_SYMBOL_DB("class Foo { Foo(Foo& (&)()); };\n");
+            const Function* ctor = tokenizer.tokens()->tokAt(3)->function();
+            ASSERT(db && ctor && ctor->type == FunctionType::eConstructor);
+        }
         {
             GET_SYMBOL_DB("void f() { extern void f(); }\n");
             ASSERT(db && db->scopeList.size() == 2);
@@ -9987,6 +10072,8 @@ class TestSymbolDatabase : public TestFixture {
         ASSERT_EQUALS("signed long", typeOf("a = (long)32;\n", "("));
         ASSERT_EQUALS("signed long", typeOf("a = (long int)32;\n", "("));
         ASSERT_EQUALS("signed long long", typeOf("a = (long long)32;\n", "("));
+        ASSERT_EQUALS("signed int &", typeOf("void f(int& (*fp)()) { fp(); }\n", "( ) ;")); // #15094
+        ASSERT_EQUALS("signed int &&", typeOf("void f(int&& (*fp)()) { fp(); }\n", "( ) ;"));
         ASSERT_EQUALS("long double", typeOf("a = (long double)32;\n", "("));
         ASSERT_EQUALS("char", typeOf("a = static_cast<char>(32);\n", "("));
         ASSERT_EQUALS("", typeOf("a = (unsigned x)0;\n", "("));