Add logic for catching unsafe scoped_refptr conversions to T* in returns

tools/clang/rewrite_scoped_refptr/tests/ref-to-local-returned-as-raw-original.cc

Index: tools/clang/rewrite_scoped_refptr/tests/ref-to-local-returned-as-raw-original.cc
diff --git a/tools/clang/rewrite_scoped_refptr/tests/ref-to-local-returned-as-raw-original.cc b/tools/clang/rewrite_scoped_refptr/tests/ref-to-local-returned-as-raw-original.cc
new file mode 100644
index 0000000000000000000000000000000000000000..86081203adf43aaf3ea0f26f04465c83833ee40d
--- /dev/null
+++ b/tools/clang/rewrite_scoped_refptr/tests/ref-to-local-returned-as-raw-original.cc
@@ -0,0 +1,18 @@
+// Copyright (c) 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/memory/ref_counted.h"
+
+struct Foo : public base::RefCounted<Foo> {
+  int dummy;
+};
+
+// An example of an unsafe conversion, since the reference is bound to a
+// scoped_refptr with local storage. The tool should ignore this, since it
+// should prefer letting a human manually resolve trickier cases like this.
+Foo* TestFunction() {
+  scoped_refptr<Foo> a;
+  scoped_refptr<Foo>& b = a;
+  return b;
+}