Keep the reference of the return type in the ValueType of a function pointer

The type of a call through a function pointer is derived from the ValueType
of the pointer, so resetting the reference caused false positives like
returnTempReference for `int& f(int& (*fp)()) { return fp(); }`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: autoantwort

lib/symboldatabase.cpp

@@ -7582,8 +7582,6 @@ static const Token* parsedecl(const Token* type,
             if (par)
                 break;
             par = true;
-            // a reference before the parentheses belongs to the return type of the function pointer
-            valuetype->reference = Reference::None;
         }
         if (Token::simpleMatch(type, "decltype (") && type->next()->valueType()) {
             const ValueType *vt2 = type->next()->valueType();

test/testautovariables.cpp

@@ -133,6 +133,7 @@ class TestAutoVariables : public TestFixture {
         TEST_CASE(returnReference27);
         TEST_CASE(returnReference28);
         TEST_CASE(returnReference29);
+        TEST_CASE(returnReference30); // #15094
         TEST_CASE(returnReferenceFunction);
         TEST_CASE(returnReferenceContainer);
         TEST_CASE(returnReferenceLiteral);
@@ -1772,6 +1773,23 @@ class TestAutoVariables : public TestFixture {
                       errout_str());
     }
 
+    void returnReference30() // #15094
+    {
+        check("int& f1(int& (*fp)()) { return fp(); }\n"
+              "void f2(int& (*fp)()) { int& r = fp(); r = 2; }\n"
+              "struct D {\n"
+              "    int& call() { return f(); }\n"
+              "    int& (*f)();\n"
+              "};\n"
+              "const int& f3(const int& (*fp)(int)) { return fp(1); }\n"
+              "int& (*g)();\n"
+              "int& f4() { return g(); }\n"
+              "typedef int& (*FP)();\n"
+              "int& f5(FP fp) { return fp(); }\n"
+              "int* f6(int& (*fp)()) { return &fp(); }\n");
+        ASSERT_EQUALS("", errout_str());
+    }
+
     void returnReferenceFunction() {
         check("int& f(int& a) {\n"
               "    return a;\n"

test/testsymboldatabase.cpp

@@ -1602,30 +1602,28 @@ class TestSymbolDatabase : public TestFixture {
             ASSERT(p->valueType()->originalTypeName == "ubFunctionPointer_fp");
             ASSERT(p->valueType()->reference == Reference::None);
         }
-        { // function pointer returning a reference
+        { // function pointer returning a reference, the ValueType keeps the reference of the return type
             GET_SYMBOL_DB("void foo(int& (*f)()) {}\n");
             const Variable* const p = db->getVariableFromVarId(1);
             ASSERT(!p->isReference());
             ASSERT(p->isPointer());
             ASSERT(p->valueType());
             ASSERT(p->valueType()->pointer == 1);
-            ASSERT(p->valueType()->reference == Reference::None);
+            ASSERT(p->valueType()->reference == Reference::LValue);
         }
         {
             GET_SYMBOL_DB("void foo(int&& (*f)()) {}\n");
             const Variable* const p = db->getVariableFromVarId(1);
             ASSERT(!p->isReference());
             ASSERT(!p->isRValueReference());
             ASSERT(p->valueType());
-            ASSERT(p->valueType()->reference == Reference::None);
+            ASSERT(p->valueType()->reference == Reference::RValue);
         }
         {
             GET_SYMBOL_DB("struct S { int& (*f[2])(); };\n");
             const Variable* const p = db->getVariableFromVarId(1);
             ASSERT(!p->isReference());
             ASSERT(p->isArray());
-            ASSERT(p->valueType());
-            ASSERT(p->valueType()->reference == Reference::None);
         }
         { // pointer to member function returning a reference
             GET_SYMBOL_DB("struct S { int& g(); };\n"
@@ -1634,8 +1632,6 @@ class TestSymbolDatabase : public TestFixture {
             ASSERT(p);
             ASSERT_EQUALS("pm", p->name());
             ASSERT(!p->isReference());
-            ASSERT(p->valueType());
-            ASSERT(p->valueType()->reference == Reference::None);
         }
         { // parentheses that are no function declarator
             GET_SYMBOL_DB("void foo(int& (r)) {}\n");
@@ -9910,6 +9906,8 @@ class TestSymbolDatabase : public TestFixture {
         ASSERT_EQUALS("signed long", typeOf("a = (long)32;\n", "("));
         ASSERT_EQUALS("signed long", typeOf("a = (long int)32;\n", "("));
         ASSERT_EQUALS("signed long long", typeOf("a = (long long)32;\n", "("));
+        ASSERT_EQUALS("signed int &", typeOf("void f(int& (*fp)()) { fp(); }\n", "( ) ;")); // #15094
+        ASSERT_EQUALS("signed int &&", typeOf("void f(int&& (*fp)()) { fp(); }\n", "( ) ;"));
         ASSERT_EQUALS("long double", typeOf("a = (long double)32;\n", "("));
         ASSERT_EQUALS("char", typeOf("a = static_cast<char>(32);\n", "("));
         ASSERT_EQUALS("", typeOf("a = (unsigned x)0;\n", "("));