In VirtualCallChecker, handle indirect calls

[sammccall]

Summary

In VirtualCallChecker, handle indirect calls.

getDirectCallee() can be nullptr, and dyn_cast(nullptr) is UB

[sammccall]

Oops, reverted noise :(

[sammccall]

I couldn't work out how to add a test for this, advice appreciated.

Closest I could get was adding something like this to test/Analysis/virtualcall.cpp:

class F { public: F(); void foo(); };
F::F() { void (F::* ptr) = &F::foo; (this->*ptr)(); }

which crashes, but only if I add extra logging :\

[bkramer]

Your test case is fine, it crashes with assertions enabled.

[sammccall]

Add regression test.

[bkramer]

lg

[zaks.anna]

Has this been cherry-picked into the clang 4.0 release branch? If not, we should definitely do that!

lib/StaticAnalyzer/Checkers/VirtualCallChecker.cpp

if (Expr *base = CME->getBase()->IgnoreImpCasts()) {
       // If the most derived class is marked final, we know that now subclass
       // can override this member.
       if (base->getBestDynamicClassType()->hasAttr<FinalAttr>())
         callIsNonVirtual = true;
     }
   }
 
   // Get the callee.
-  const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(CE->getDirectCallee());
+  const CXXMethodDecl *MD =
+      dyn_cast_or_null<CXXMethodDecl>(CE->getDirectCallee());
   if (MD && MD->isVirtual() && !callIsNonVirtual && !MD->hasAttr<FinalAttr>() &&
       !MD->getParent()->hasAttr<FinalAttr>())
     ReportVirtualCall(CE, MD->isPure());
 
   if (IsInterprocedural)
     Enqueue(CE);
 }