[analyzer] Handle NTTP invocation in CallContext.getCalleeDecl()

[tomasz-kaminski-sonarsource]

Summary

This fixes a crash in MallocChecker for the situation when operator new (delete) is invoked via NTTP and makes the behavior of CallContext.getCalleeDecl(Expr) identical to CallEvent.getDecl().

[tomasz-kaminski-sonarsource]

The alternative solution, that I think may be preferable is to remove following functions from CheckerContext and use CallEvent.getDecl() instead:

const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const;
StringRef getCalleeName(const CallExpr *CE) const;

[tomasz-kaminski-sonarsource]

Ping,

[tomasz-kaminski-sonarsource]

Any input on the change?

[vsavchenko]

Looks good to me!
Sorry it took forever!

[tomasz-kaminski-sonarsource]

Would it be possible to merge it for me, as I do not have a commit right?

[vsavchenko]

In D103025#2826482, @tomasz-kaminski-sonarsource wrote:

Would it be possible to merge it for me, as I do not have a commit right?

Sure thing!
Which email should I set for commit author?

[tomasz-kaminski-sonarsource]

For the author information use:
Tomasz Kamiński
[e-mail]

[vsavchenko]

Thanks for fixing this!

clang/lib/StaticAnalyzer/Core/CheckerContext.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/Basic/Builtins.h"
 #include "clang/Lex/Lexer.h"
 
 using namespace clang;
 using namespace ento;
 
 const FunctionDecl *CheckerContext::getCalleeDecl(const CallExpr *CE) const {
+  const FunctionDecl *D = CE->getDirectCallee();
+  if (D)
+    return D;
+
   const Expr *Callee = CE->getCallee();
   SVal L = Pred->getSVal(Callee);
   return L.getAsFunctionDecl();
 }
 
 StringRef CheckerContext::getCalleeName(const FunctionDecl *FunDecl) const {
   if (!FunDecl)
     return StringRef();

clang/test/Analysis/NewDelete-checker-test.cpp

 Base *allocate() {
   return new Derived;
 }
 
 void shouldNotReportLeak() {
   Derived *p = (Derived *)allocate();
   delete p;
 }
+
+template<void *allocate_fn(size_t)>
+void* allocate_via_nttp(size_t n) {
+  return allocate_fn(n);
+}
+
+template<void deallocate_fn(void*)>
+void deallocate_via_nttp(void* ptr) {
+  deallocate_fn(ptr);
+}
+
+void testNTTPNewNTTPDelete() {
+  void* p = allocate_via_nttp<::operator new>(10);
+  deallocate_via_nttp<::operator delete>(p);
+} // no warn
+
+void testNTTPNewDirectDelete() {
+  void* p = allocate_via_nttp<::operator new>(10);
+  ::operator delete(p);
+} // no warn
+
+void testDirectNewNTTPDelete() {
+  void* p = ::operator new(10);
+  deallocate_via_nttp<::operator delete>(p);
+}
+
+void not_free(void*) {
+}
+
+void testLeakBecauseNTTPIsNotDeallocation() {
+  void* p = ::operator new(10);
+  deallocate_via_nttp<not_free>(p);
+}  // leak-warning{{Potential leak of memory pointed to by 'p'}}