Fix #14308 FP nullPointerRedundantCheck with pointer reference parameter (*&)

lib/valueflow.cpp

@@ -5861,6 +5861,12 @@ static void valueFlowSubFunction(const TokenList& tokenlist,
                         continue;
                 }
 
+                if (argvar->isReference()) {
+                    argvalues.remove_if([](const ValueFlow::Value& v) {
+                        return v.isReverse();
+                    });
+                }
+
                 if (argvalues.empty())
                     continue;
 

lib/vf_analyzers.cpp

@@ -1606,6 +1606,7 @@ ValuePtr<Analyzer> makeAnalyzer(const Token* exprTok, ValueFlow::Value value, co
 
 ValuePtr<Analyzer> makeReverseAnalyzer(const Token* exprTok, ValueFlow::Value value, const Settings& settings)
 {
+    value.setFlow(ValueFlow::Value::Flow::REVERSE);
     if (value.isContainerSizeValue())
         return ContainerExpressionAnalyzer(exprTok, std::move(value), settings);
     return ExpressionAnalyzer(exprTok, std::move(value), settings);

lib/vfvalue.h

@@ -346,7 +346,19 @@
         };
         UnknownFunctionReturn unknownFunctionReturn{UnknownFunctionReturn::no};
 
-        long long : 24; // padding
+        enum class Flow : std::uint8_t {
+            UNKNOWN,
+            FORWARD,
+            REVERSE
+        } flow = Flow::UNKNOWN;
+        bool isReverse() const {
+            return flow == Flow::REVERSE;
+        }
+        void setFlow(Flow f) {
+            flow = f;
+        }
+
+        long long : 16; // padding
 
         /** Path id */
         MathLib::bigint path{};

test/testnullpointer.cpp

@@ -3020,6 +3020,21 @@ class TestNullPointer : public TestFixture {
               "    f(nullptr, nullptr);\n"
               "}\n", dinit(CheckOptions, $.inconclusive = true));
         ASSERT_EQUALS("", errout_str());
+
+        check("struct T {\n" // #14308
+              "    bool b{};\n"
+              "    T* next{};\n"
+              "};\n"
+              "bool g(const T*& r) {\n"
+              "    const T* t = r;\n"
+              "    r = t->next;\n"
+              "    return t->b;\n"
+              "}\n"
+              "void f(const T* tok) {\n"
+              "    if (g(tok)) {}\n"
+              "    if (tok) {}\n"
+              "}\n", dinit(CheckOptions, $.inconclusive = true));
+        ASSERT_EQUALS("", errout_str());
     }
 
     // Check if pointer is null and the dereference it