[analyzer] Fix StringChecker for Unknown params

[steakhal]

Summary

It seems like protobuf crashed the std::string checker.
Somehow it acquired UnknownVal as the sole std::string constructor parameter, causing a crash in the castAs<Loc>().

This patch addresses this.

[martong]

Thanks! Looks good!

clang/lib/StaticAnalyzer/Checkers/StringChecker.cpp

bool StringChecker::isCharToStringCtor(const CallEvent &Call,
   StringConstCharPtrCtor = FD; // Cache the decl of the right overload.
   return true;
 }
 
 void StringChecker::checkPreCall(const CallEvent &Call,
                                  CheckerContext &C) const {
   if (!isCharToStringCtor(Call, C.getASTContext()))
     return;
-  const Loc Param = Call.getArgSVal(0).castAs<Loc>();
+  const auto Param = Call.getArgSVal(0).getAs<Loc>();
+  if (!Param.hasValue())
+    return;
 
   // We managed to constrain the parameter to non-null.
   ProgramStateRef NotNull, Null;
-  std::tie(NotNull, Null) = C.getState()->assume(Param);
+  std::tie(NotNull, Null) = C.getState()->assume(*Param);
 
   if (NotNull) {
     const auto Callback = [Param](PathSensitiveBugReport &BR) -> std::string {
-      return BR.isInteresting(Param) ? "Assuming the pointer is not null." : "";
+      return BR.isInteresting(*Param) ? "Assuming the pointer is not null."
+                                      : "";
     };
 
     // Emit note only if this operation constrained the pointer to be null.
     C.addTransition(NotNull, Null ? C.getNoteTag(Callback) : nullptr);
     return;
   }
 
   // We found a path on which the parameter is NULL.

clang/test/Analysis/std-string.cpp

 // RUN: %clang_analyze_cc1 -std=c++14 %s -verify                  \
 // RUN:   -analyzer-checker=core,unix.Malloc,debug.ExprInspection \
 // RUN:   -analyzer-checker=cplusplus.StringChecker               \
 // RUN:   -analyzer-config eagerly-assume=false                   \
 // RUN:   -analyzer-output=text
 
 #include "Inputs/system-header-simulator-cxx.h"
 
 void clang_analyzer_eval(bool);
 void clang_analyzer_warnIfReached();
+template <typename T> void clang_analyzer_dump(T);
 
 void free(void *ptr);
 
 void irrelevant_std_string_ctors(const char *p) {
   std::string x1;                             // no-warning
   std::string x2(2, 'x');                     // no-warning
   std::string x3(x1, /*pos=*/2);              // no-warning
   std::string x4(x1, /*pos=*/2, /*count=*/2); // no-warning

 }
 
 void null_constant_parameter() {
   std::string x((char *)0);
   // expected-warning@-1 {{The parameter must not be null}}
   // expected-note@-2    {{The parameter must not be null}}
 }
 
+void unknown_ctor_param(const char *p) {
+  // Pass 'UnknownVal' to the std::string constructor.
+  clang_analyzer_dump((char *)(p == 0)); // expected-warning {{Unknown}} expected-note {{Unknown}}
+  std::string x((char *)(p == 0));       // no-crash, no-warning
+}
+
 void ctor_notetag_on_constraining_symbol(const char *p) {
   clang_analyzer_eval(p == 0); // expected-warning {{UNKNOWN}} expected-note {{UNKNOWN}}
   std::string x(p);            // expected-note {{Assuming the pointer is not null}}
   clang_analyzer_eval(p == 0); // expected-warning {{FALSE}} expected-note {{FALSE}}
 
   free((void *)p); // expected-note {{Memory is released}}
   free((void *)p);
   // expected-warning@-1 {{Attempt to free released memory}}