Generate ImplicitNullDerefEvent from CallAndMessageChecker

[chrisbazley]

Summary

Without this change, the following code does
not generate "warning: Nullable pointer is dereferenced":

void test(void (*_Nullable fn)(void))
{

fn();

}

[chrisbazley]

Please refer to https://discourse.llvm.org/t/rfc-optional-a-type-qualifier-to-indicate-pointer-nullability/ and https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3089.pdf for the wider context of this commit.

clang/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp

 
 using namespace clang;
 using namespace ento;
 
 namespace {
 
 class CallAndMessageChecker
     : public Checker<check::PreObjCMessage, check::ObjCMessageNil,
-                     check::PreCall> {
+                     check::PreCall, EventDispatcher<ImplicitNullDerefEvent>> {
   mutable std::unique_ptr<BugType> BT_call_null;
   mutable std::unique_ptr<BugType> BT_call_undef;
   mutable std::unique_ptr<BugType> BT_cxx_call_null;
   mutable std::unique_ptr<BugType> BT_cxx_call_undef;
   mutable std::unique_ptr<BugType> BT_call_arg;
   mutable std::unique_ptr<BugType> BT_cxx_delete_undef;
   mutable std::unique_ptr<BugType> BT_msg_undef;
   mutable std::unique_ptr<BugType> BT_objc_prop_undef;
if (!BT_call_undef)
           "Called function pointer is an uninitialized pointer value"));
     emitBadCall(BT_call_undef.get(), C, Callee);
     return nullptr;
   }
 
   ProgramStateRef StNonNull, StNull;
   std::tie(StNonNull, StNull) = State->assume(L.castAs<DefinedOrUnknownSVal>());
 
-  if (StNull && !StNonNull) {
+  if (StNull) {
+    if (!StNonNull) {
       if (!ChecksEnabled[CK_FunctionPointer]) {
         C.addSink(StNull);
         return nullptr;
       }
       if (!BT_call_null)
         BT_call_null.reset(new BuiltinBug(
-          OriginalName, "Called function pointer is null (null dereference)"));
+            OriginalName,
+            "Called function pointer is null (null dereference)"));
       emitBadCall(BT_call_null.get(), C, Callee);
       return nullptr;
     }
 
+    // Otherwise, we have the case where the location could either be
+    // null or not-null.  Record the error node as an "implicit" null
+    // dereference.
+    if (ExplodedNode *N = C.generateSink(StNull, C.getPredecessor())) {
+      printf("\nimplicit null dereference\n");
+      ImplicitNullDerefEvent event = {L, /*isLoad=*/true, N,
+                                      &C.getBugReporter(),
+                                      /*IsDirectDereference=*/true};
+      dispatchEvent(event);
+    }
+  }
+
   return StNonNull;
 }
 
 ProgramStateRef CallAndMessageChecker::checkParameterCount(
     const CallEvent &Call, CheckerContext &C, ProgramStateRef State) const {
 
   // If we have a function or block declaration, we can make sure we pass
   // enough parameters.