[analyzer] Treat pointers to static member functions as function pointers

[dcoughlin]

Summary

Sema treats pointers to static member functions as having function pointer
type, so treat treat them as function pointer values in the analyzer as well.
This prevents an assertion failure in SValBuilder::evalBinOp caused by code
that expects function pointers to be Locs (in contrast, PointerToMember values
are nonlocs).

Kirill: does this look alright to you?

[kromanenkov]

Looks good to me, apart from a very small cavil introduced in not even your code. Thanks for not leaving pointers to static member functions out of account!

test/Analysis/pointer-to-member.cpp

80 ↗

(On Diff #82274)

This line is not affected by your patch but would you please delete the extra space before the second brace?

[dcoughlin]

Updating spacing, as @kromanenkov requested.

cfe/trunk/lib/StaticAnalyzer/Core/SValBuilder.cpp

SValBuilder::getDerivedRegionValueSymbolVal(SymbolRef parentSymbol,
 
   if (Loc::isLocType(T))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
 
   return nonloc::SymbolVal(sym);
 }
 
 DefinedSVal SValBuilder::getMemberPointer(const DeclaratorDecl* DD) {
+  assert(!DD || isa<CXXMethodDecl>(DD) || isa<FieldDecl>(DD));
+
+  if (auto *MD = dyn_cast_or_null<CXXMethodDecl>(DD)) {
+    // Sema treats pointers to static member functions as have function pointer
+    // type, so return a function pointer for the method.
+    // We don't need to play a similar trick for static member fields
+    // because these are represented as plain VarDecls and not FieldDecls
+    // in the AST.
+    if (MD->isStatic())
+      return getFunctionPointer(MD);
+  }
+
   return nonloc::PointerToMember(DD);
 }
 
 DefinedSVal SValBuilder::getFunctionPointer(const FunctionDecl *func) {
   return loc::MemRegionVal(MemMgr.getFunctionCodeRegion(func));
 }
 
 DefinedSVal SValBuilder::getBlockPointer(const BlockDecl *block,

cfe/trunk/test/Analysis/pointer-to-member.cpp

bool testDereferencing() {
   member = 0;
 
   return obj.*member; // expected-warning{{The result of the '.*' expression is undefined}}
 }
 
 namespace testPointerToMemberFunction {
   struct A {
     virtual int foo() { return 1; }
-    int bar() { return 2;  }
+    int bar() { return 2; }
+    int static staticMemberFunction(int p) { return p + 1; };
   };
 
   struct B : public A {
     virtual int foo() { return 3; }
   };
 
   typedef int (A::*AFnPointer)();
   typedef int (B::*BFnPointer)();
void testPointerToMemberVirtualCall() {
     AFnPointer AFP = &A::foo;
 
     clang_analyzer_eval((APtr->*AFP)() == 1); // expected-warning{{TRUE}}
 
     APtr = &b;
 
     clang_analyzer_eval((APtr->*AFP)() == 3); // expected-warning{{TRUE}}
   }
+
+  void testPointerToStaticMemberCall() {
+    int (*fPtr)(int) = &A::staticMemberFunction;
+    if (fPtr != 0) { // no-crash
+      clang_analyzer_eval(fPtr(2) == 3); // expected-warning{{TRUE}}
+    }
+  }
 } // end of testPointerToMemberFunction namespace
 
 namespace testPointerToMemberData {
   struct A {
     int i;
+    static int j;
   };
 
   void testPointerToMemberData() {
     int A::*AMdPointer = &A::i;
     A a;
 
     a.i = 42;
     a.*AMdPointer += 1;
 
     clang_analyzer_eval(a.i == 43); // expected-warning{{TRUE}}
+
+    int *ptrToStaticField = &A::j;
+    if (ptrToStaticField != 0) {
+      *ptrToStaticField = 7;
+      clang_analyzer_eval(*ptrToStaticField == 7); // expected-warning{{TRUE}}
+      clang_analyzer_eval(A::j == 7); // expected-warning{{TRUE}}
+    }
   }
 } // end of testPointerToMemberData namespace
 
 namespace testPointerToMemberMiscCasts {
 struct B {
   int f;
 };