[clang][dataflow] Fix a null pointer crash in `computeBlockInputState()`.

[mboehme]

Summary

The crash was due to unconditionally calling
Block.succ_begin()->getReachableBlock()->hasNoReturnElement(), but
getReachableBlock() can return null now that we have turned
PruneTriviallyFalseEdges on.

This patch adds two tests that crash without the fix.

[ymandel]

clang/lib/Analysis/FlowSensitive/TypeErasedDataflowAnalysis.cpp

218–221

Nit.

[gribozavr2]

LGTM too.

clang/lib/Analysis/FlowSensitive/TypeErasedDataflowAnalysis.cpp

if (Block.getTerminator().isTemporaryDtorsBranch()) {
     // destructor. If that block has a noreturn element then the predecessor
     // block that constructed the temporary object (B3 above) is effectively a
     // noreturn block and its state should not be used as input for the state
     // of the block that has a temporary destructor terminator (B4 above). This
     // holds regardless of which branch of the ternary operator calls the
     // noreturn destructor. However, it doesn't cases where a nested ternary
     // operator includes a branch that contains a noreturn destructor call.
     //
     // See `NoreturnDestructorTest` for concrete examples.
-    if (Block.succ_begin()->getReachableBlock()->hasNoReturnElement()) {
+    if (Block.succ_begin()->getReachableBlock() != nullptr &&
+        Block.succ_begin()->getReachableBlock()->hasNoReturnElement()) {
       auto &StmtToBlock = AC.CFCtx.getStmtToBlock();
       auto StmtBlock = StmtToBlock.find(Block.getTerminatorStmt());
       assert(StmtBlock != StmtToBlock.end());
       Preds.erase(StmtBlock->getSecond());
     }
   }
 
   std::optional<TypeErasedDataflowAnalysisState> MaybeState;
 

clang/unittests/Analysis/FlowSensitive/TypeErasedDataflowAnalysisTest.cpp

void target(bool b) {
       // [[p]]
     }
   )";
   runDataflow(Code, UnorderedElementsAre(IsStringMapEntry(
                         "p", HoldsFunctionCallLattice(HasCalledFunctions(
                                  UnorderedElementsAre("foo"))))));
 }
 
+TEST_F(NoreturnDestructorTest,
+       ConditionalOperatorConstantCondition_LeftBranchReturns) {
+  std::string Code = R"(
+    #include "noreturn_destructor_test_defs.h"
+
+    void target() {
+      int value = true ? foo() : Fatal().bar();
+      (void)0;
+      // [[p]]
+    }
+  )";
+  runDataflow(Code, UnorderedElementsAre(IsStringMapEntry(
+                        "p", HoldsFunctionCallLattice(HasCalledFunctions(
+                                 UnorderedElementsAre("foo"))))));
+}
+
 TEST_F(NoreturnDestructorTest, ConditionalOperatorRightBranchReturns) {
   std::string Code = R"(
     #include "noreturn_destructor_test_defs.h"
 
     void target(bool b) {
       int value = b ? Fatal().bar() : foo();
       (void)0;
       // [[p]]
     }
   )";
   runDataflow(Code, UnorderedElementsAre(IsStringMapEntry(
                         "p", HoldsFunctionCallLattice(HasCalledFunctions(
                                  UnorderedElementsAre("foo"))))));
 }
 
+TEST_F(NoreturnDestructorTest,
+       ConditionalOperatorConstantCondition_RightBranchReturns) {
+  std::string Code = R"(
+    #include "noreturn_destructor_test_defs.h"
+
+    void target() {
+      int value = false ? Fatal().bar() : foo();
+      (void)0;
+      // [[p]]
+    }
+  )";
+  runDataflow(Code, UnorderedElementsAre(IsStringMapEntry(
+                        "p", HoldsFunctionCallLattice(HasCalledFunctions(
+                                 UnorderedElementsAre("foo"))))));
+}
+
 TEST_F(NoreturnDestructorTest, ConditionalOperatorNestedBranchesDoNotReturn) {
   std::string Code = R"(
     #include "noreturn_destructor_test_defs.h"
 
     void target(bool b1, bool b2) {
       int value = b1 ? foo() : (b2 ? Fatal().bar() : Fatal().baz());
       (void)0;
       // [[p]]