In VirtualCallChecker, handle indirect calls

[sammccall]

Summary

In VirtualCallChecker, handle indirect calls.

getDirectCallee() can be nullptr, and dyn_cast(nullptr) is UB

[sammccall]

Oops, reverted noise :(

[sammccall]

I couldn't work out how to add a test for this, advice appreciated.

Closest I could get was adding something like this to test/Analysis/virtualcall.cpp:

class F { public: F(); void foo(); };
F::F() { void (F::* ptr) = &F::foo; (this->*ptr)(); }

which crashes, but only if I add extra logging :\

[bkramer]

Your test case is fine, it crashes with assertions enabled.

[sammccall]

Add regression test.

[bkramer]

lg

[zaks.anna]

Has this been cherry-picked into the clang 4.0 release branch? If not, we should definitely do that!

cfe/trunk/lib/StaticAnalyzer/Checkers/VirtualCallChecker.cpp

if (Expr *base = CME->getBase()->IgnoreImpCasts()) {
       // If the most derived class is marked final, we know that now subclass
       // can override this member.
       if (base->getBestDynamicClassType()->hasAttr<FinalAttr>())
         callIsNonVirtual = true;
     }
   }
 
   // Get the callee.
-  const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(CE->getDirectCallee());
+  const CXXMethodDecl *MD =
+      dyn_cast_or_null<CXXMethodDecl>(CE->getDirectCallee());
   if (MD && MD->isVirtual() && !callIsNonVirtual && !MD->hasAttr<FinalAttr>() &&
       !MD->getParent()->hasAttr<FinalAttr>())
     ReportVirtualCall(CE, MD->isPure());
 
   if (IsInterprocedural)
     Enqueue(CE);
 }
 

cfe/trunk/test/Analysis/virtualcall.cpp

 public:
   E() {
     foo(); // no-warning
   }
   ~E() { bar(); }
   int foo() override;
 };
 
+// Regression test: don't crash when there's no direct callee.
+class F {
+public:
+  F() {
+    void (F::* ptr)() = &F::foo;
+    (this->*ptr)();
+  }
+  void foo();
+};
+
 int main() {
   A *a;
   B *b;
   C *c;
   D *d;
   E *e;
+  F *f;
 }
 
 #include "virtualcall.h"
 
 #define AS_SYSTEM
 #include "virtualcall.h"
 #undef AS_SYSTEM