[clang][dataflow] Bug fix: `BuiltinFnToFnPtr` cast does not produce a pointer.

[mboehme]

Summary

See comments in the code for details.

[mboehme]

See also

https://github.com/google/crubit/commit/381e2b904073a1c6490f1e1c323eb1b8e5b8595f

for a corresponding change in the Crubit nullability checker.

[mboehme]

Pre-merge failure looks unrelated

clang/lib/Analysis/FlowSensitive/Transfer.cpp

case CK_NullToPointer: {
           Env.getOrCreateNullPointerValue(S->getType()->getPointeeType());
       Env.setValue(Loc, NullPointerVal);
       break;
     }
     case CK_NullToMemberPointer:
       // FIXME: Implement pointers to members. For now, don't associate a value
       // with this expression.
       break;
-    case CK_FunctionToPointerDecay:
-    case CK_BuiltinFnToFnPtr: {
+    case CK_FunctionToPointerDecay: {
       StorageLocation *PointeeLoc =
           Env.getStorageLocation(*SubExpr, SkipPast::Reference);
       if (PointeeLoc == nullptr)
         break;
 
       auto &PointerLoc = Env.createStorageLocation(*S);
       auto &PointerVal = Env.create<PointerValue>(*PointeeLoc);
       Env.setStorageLocation(*S, PointerLoc);
       Env.setValue(PointerLoc, PointerVal);
       break;
     }
+    case CK_BuiltinFnToFnPtr:
+      // Despite its name, the result type of `BuiltinFnToFnPtr` is a function,
+      // not a function pointer. In addition, builtin functions can only be
+      // called directly; it is not legal to take their address. We therefore
+      // don't need to create a value or storage location for them.
+      break;
     default:
       break;
     }
   }
 
   void VisitUnaryOperator(const UnaryOperator *S) {
     const Expr *SubExpr = S->getSubExpr();
     assert(SubExpr != nullptr);

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

runDataflow(
         auto &MemberP1 =
             getValueForDecl<PointerValue>(ASTCtx, Env, "member_p1");
         auto &MemberP2 =
             getValueForDecl<PointerValue>(ASTCtx, Env, "member_p2");
         EXPECT_EQ(&MemberP1.getPointeeLoc(), &MemberP2.getPointeeLoc());
       });
 }
 
-// Check that the pointer that a builtin function decays to is associated with
-// a value.
+// Check that a builtin function is not associated with a value. (It's only
+// possible to call builtin functions directly, not take their address.)
 TEST(TransferTest, BuiltinFunctionModeled) {
   std::string Code = R"(
     void target() {
       __builtin_expect(0, 0);
       // [[p]]
     }
   )";
   runDataflow(
runDataflow(
         auto *ImplicitCast = selectFirst<ImplicitCastExpr>(
             "implicit_cast",
             match(traverse(TK_AsIs,
                            implicitCastExpr(hasCastKind(CK_BuiltinFnToFnPtr))
                                .bind("implicit_cast")),
                   ASTCtx));
 
         ASSERT_THAT(ImplicitCast, NotNull());
-        EXPECT_THAT(Env.getValueStrict(*ImplicitCast), NotNull());
+        EXPECT_THAT(Env.getValueStrict(*ImplicitCast), IsNull());
       });
 }
 
 // Check that fields of anonymous records are modeled.
 TEST(TransferTest, AnonymousStruct) {
   std::string Code = R"(
     struct S {
       struct {