[Analyzer] Support bodyfarming std::call_once for libstdc++

[dcoughlin]

LGTM with the dyn_cast mentioned inline changed.

lib/Analysis/BodyFarm.cpp

359

Should this be a cast<>() rather than a dyn_cast<>()? Do you expect this to fail? If so then you should check the result for null. If not then the idiom is to use cast<>().

An alternative would be to change findMemberField() to return a FieldDecl.

lib/Analysis/BodyFarm.cpp

public:
 
   /// Create a member expression.
   MemberExpr *makeMemberExpression(Expr *base, ValueDecl *MemberDecl,
                                    bool IsArrow = false,
                                    ExprValueKind ValueKind = VK_LValue);
 
   /// Returns a *first* member field of a record declaration with a given name.
   /// \return an nullptr if no member with such a name exists.
-  NamedDecl *findMemberField(const CXXRecordDecl *RD, StringRef Name);
+  NamedDecl *findMemberField(const RecordDecl *RD, StringRef Name);
 
 private:
   ASTContext &C;
 };
 }
 
 BinaryOperator *ASTMaker::makeAssignment(const Expr *LHS, const Expr *RHS,
                                          QualType Ty) {
MemberExpr *ASTMaker::makeMemberExpression(Expr *base, ValueDecl *MemberDecl,
   return MemberExpr::Create(
       C, base, IsArrow, SourceLocation(), NestedNameSpecifierLoc(),
       SourceLocation(), MemberDecl, FoundDecl,
       DeclarationNameInfo(MemberDecl->getDeclName(), SourceLocation()),
       /* TemplateArgumentListInfo= */ nullptr, MemberDecl->getType(), ValueKind,
       OK_Ordinary);
 }
 
-NamedDecl *ASTMaker::findMemberField(const CXXRecordDecl *RD, StringRef Name) {
+NamedDecl *ASTMaker::findMemberField(const RecordDecl *RD, StringRef Name) {
 
   CXXBasePaths Paths(
       /* FindAmbiguities=*/false,
       /* RecordPaths=*/false,
       /* DetectVirtual= */ false);
   const IdentifierInfo &II = C.Idents.get(Name);
   DeclarationName DeclName = C.DeclarationNames.getIdentifier(&II);
 
if (D->param_size() < 2)
     return nullptr;
 
   ASTMaker M(C);
 
   const ParmVarDecl *Flag = D->getParamDecl(0);
   const ParmVarDecl *Callback = D->getParamDecl(1);
   QualType CallbackType = Callback->getType().getNonReferenceType();
   QualType FlagType = Flag->getType().getNonReferenceType();
-  CXXRecordDecl *FlagCXXDecl = FlagType->getAsCXXRecordDecl();
-  if (!FlagCXXDecl) {
-    DEBUG(llvm::dbgs() << "Flag field is not a CXX record: "
-                       << "unknown std::call_once implementation."
-                       << "Ignoring the call.\n");
+  auto *FlagRecordDecl = dyn_cast_or_null<RecordDecl>(FlagType->getAsTagDecl());
+
+  if (!FlagRecordDecl) {
+    DEBUG(llvm::dbgs() << "Flag field is not a record: "
+                       << "unknown std::call_once implementation, "
+                       << "ignoring the call.\n");
     return nullptr;
   }
 
-  // Note: here we are assuming libc++ implementation of call_once,
-  // which has a struct with a field `__state_`.
-  // Body farming might not work for other `call_once` implementations.
-  NamedDecl *FoundDecl = M.findMemberField(FlagCXXDecl, "__state_");
-  ValueDecl *FieldDecl;
-  if (FoundDecl) {
-    FieldDecl = dyn_cast<ValueDecl>(FoundDecl);
-  } else {
+  // We initially assume libc++ implementation of call_once,
+  // where the once_flag struct has a field `__state_`.
+  NamedDecl *FoundDecl = M.findMemberField(FlagRecordDecl, "__state_");
+
+  // Otherwise, try libstdc++ implementation, with a field
+  // `_M_once`
+  if (!FoundDecl) {
     DEBUG(llvm::dbgs() << "No field __state_ found on std::once_flag struct, "
-                       << "unable to synthesize call_once body, ignoring "
-                       << "the call.\n");
+                       << "trying libstdc++ implementation\n");
+    FoundDecl = M.findMemberField(FlagRecordDecl, "_M_once");
+  }
+
+  if (!FoundDecl) {
+    DEBUG(llvm::dbgs() << "No field _M_once found on std::once flag struct: "
+                       << "unknown std::call_once implementation, "
+                       << "ignoring the call");
     return nullptr;
   }
 
+  ValueDecl *FieldDecl = dyn_cast<ValueDecl>(FoundDecl);
   bool isLambdaCall = CallbackType->getAsCXXRecordDecl() &&
                       CallbackType->getAsCXXRecordDecl()->isLambda();
 
   SmallVector<Expr *, 5> CallArgs;
 
   if (isLambdaCall)
     // Lambda requires callback itself inserted as a first parameter.
     CallArgs.push_back(

test/Analysis/call_once.cpp

-// RUN: %clang_analyze_cc1 -std=c++11 -fblocks -analyzer-checker=core,debug.ExprInspection -w -verify %s
+// RUN: %clang_analyze_cc1 -std=c++11 -fblocks -analyzer-checker=core,debug.ExprInspection -verify %s
+// RUN: %clang_analyze_cc1 -std=c++11 -fblocks -analyzer-checker=core,debug.ExprInspection -DEMULATE_LIBSTDCPP -verify %s
 
 void clang_analyzer_eval(bool);
 
 // Faking std::std::call_once implementation.
 namespace std {
+
+#ifndef EMULATE_LIBSTDCPP
 typedef struct once_flag_s {
   unsigned long __state_ = 0;
 } once_flag;
+#else
+typedef struct once_flag_s {
+  int _M_once = 0;
+} once_flag;
+#endif
 
 template <class Callable, class... Args>
 void call_once(once_flag &o, Callable func, Args... args) {};
+
 } // namespace std
 
 // Check with Lambdas.
 void test_called_warning() {
   std::once_flag g_initialize;
   int z;
 
   std::call_once(g_initialize, [&] {