[analyzer] Fix null deref in AnyFunctionCall::getRuntimeDefinition

[r.stahl]

Summary

In D30691 code was added to getRuntimeDefinition that does not handle the case when FD==nullptr.

Add regression test.

[r.stahl]

I encountered this with a construct like this:

struct S
{
    void (*fp)();
};

int main()
{
    struct S s;
    s.fp();
}

[xazax.hun]

We encountered the same problem but did not have time yet to submit the patch. We have literally the same fix internally, so it looks good to me. One minor style nit inline.

Could you add your repro as a regression test? You can also extend existing CTU tests just make sure to trigger the crash before the patch.

Thank you for the submission and the minimal reproducer.

lib/StaticAnalyzer/Core/CallEvent.cpp

390

We usually do not write the braces for single statements.

[r.stahl]

addressed review comments.

I created a new test because certain checkers would cause early exits in the engine (because of undefined func ptr) and not cause the crash.

Since I don't have commit access, please commit for me.

lib/StaticAnalyzer/Core/CallEvent.cpp

ArrayRef<ParmVarDecl*> AnyFunctionCall::parameters() const {
   const FunctionDecl *D = getDecl();
   if (!D)
     return None;
   return D->parameters();
 }
 
 RuntimeDefinition AnyFunctionCall::getRuntimeDefinition() const {
   const FunctionDecl *FD = getDecl();
+  if (!FD)
+    return {};
+
   // Note that the AnalysisDeclContext will have the FunctionDecl with
   // the definition (if one exists).
-  if (FD) {
-    AnalysisDeclContext *AD =
-      getLocationContext()->getAnalysisDeclContext()->
-      getManager()->getContext(FD);
-    bool IsAutosynthesized;
-    Stmt* Body = AD->getBody(IsAutosynthesized);
-    DEBUG({
-        if (IsAutosynthesized)
-          llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
-                       << "\n";
-    });
-    if (Body) {
-      const Decl* Decl = AD->getDecl();
-      return RuntimeDefinition(Decl);
-    }
-  }
 
   SubEngine *Engine = getState()->getStateManager().getOwningEngine();
   AnalyzerOptions &Opts = Engine->getAnalysisManager().options;
 
   // Try to get CTU definition only if CTUDir is provided.
   if (!Opts.naiveCTUEnabled())
-    return RuntimeDefinition();
+    return {};
 
   cross_tu::CrossTranslationUnitContext &CTUCtx =
       *Engine->getCrossTranslationUnitContext();
   llvm::Expected<const FunctionDecl *> CTUDeclOrError =
       CTUCtx.getCrossTUDefinition(FD, Opts.getCTUDir(), Opts.getCTUIndexName());
 
   if (!CTUDeclOrError) {
     handleAllErrors(CTUDeclOrError.takeError(),

test/Analysis/undef-call.c

+// RUN: %clang_cc1 -fsyntax-only -analyze -analyzer-checker=debug.ExprInspection -analyzer-config experimental-enable-naive-ctu-analysis=true -analyzer-config ctu-dir=%T/ctudir -verify %s
+// expected-no-diagnostics
+
+struct S {
+  void (*fp)();
+};
+
+int main() {
+  struct S s;
+  // This will cause the analyzer to look for a function definition that has
+  // no FunctionDecl. It used to cause a crash in AnyFunctionCall::getRuntimeDefinition.
+  // It would only occur when CTU analysis is enabled.
+  s.fp();
+}