[analyzer] Fix an assertion fail in VirtualCallChecker

[xazax.hun]

Summary

This patch attempts to fix PR34451.

The getBestDynamicClassType call can only handle RecordDecls and pointers to RecordDecls. The code removed all the implicit casts, this includes the array to pointer decay. After removing the decay, the checker passed an array type to getBestDynamicClassType which triggered the assertion.

[alexfh]

Looks reasonable, but please wait for someone who actually knows this code.

[alexfh]

Actually, after looking at the getBestDynamicClassType() implementation, I'm pretty sure it does all things IgnoreImpCasts() used to do that are relevant to the use case. So the patch seems to be trivially correct. Other reviewers' comments (if any) can be addressed post-commit. Thanks again for the fix!

cfe/trunk/lib/StaticAnalyzer/Checkers/VirtualCallChecker.cpp

static bool isVirtualCall(const CallExpr *CE) {
   bool CallIsNonVirtual = false;
 
   if (const MemberExpr *CME = dyn_cast<MemberExpr>(CE->getCallee())) {
     // The member access is fully qualified (i.e., X::F).
     // Treat this as a non-virtual call and do not warn.
     if (CME->getQualifier())
       CallIsNonVirtual = true;
 
-    if (const Expr *Base = CME->getBase()->IgnoreImpCasts()) {
+    if (const Expr *Base = CME->getBase()) {
       // The most derived class is marked final.
       if (Base->getBestDynamicClassType()->hasAttr<FinalAttr>())
         CallIsNonVirtual = true;
     }
   }
 
   const CXXMethodDecl *MD =
       dyn_cast_or_null<CXXMethodDecl>(CE->getDirectCallee());

cfe/trunk/test/Analysis/virtualcall.cpp

#endif
   header::Z z;
 #if !PUREONLY
   // expected-note-re@-2 {{{{^}}Calling default constructor for 'Z'}}
 #endif
 }
 #if !PUREONLY
   //expected-note-re@-2 2{{{{^}}Calling '~E'}}
 #endif
+
+namespace PR34451 {
+struct a {
+  void b() {
+    a c[1];
+    c->b();
+  }
+};
+
+class e {
+ public:
+  void b() const;
+};
+
+class c {
+  void m_fn2() const;
+  e d[];
+};
+
+void c::m_fn2() const { d->b(); }
+}