[analyzer] Support modelling no-op BaseToDerived casts in ExprEngine

[NoQ]

Tried to address the regression with double inheritance by introducing a CXXDerivedObjectRegion, which is the opposite of CXXBaseObjectRegion, to represent such casts. Such region is a bit weird because it is by design bigger than its super-region. But it's not harmful when it is put on top of a SymbolicRegion that has unknown extent anyway.

Offset computation for CXXDerivedObjectRegion and proper modeling of casts still remains to be implemented. It seems to be useful to keep the base class decl as part of the region's identity, but i didn't do that yet.

In any case, it addresses the regression that i was thinking of: otherwise, in the base_to_derived_double_inheritance test it'd think that x, rather than y, was set.

clang/lib/StaticAnalyzer/Core/Store.cpp

if (Uncasted == MR) {
       // class. We must be casting the base to derived, so the cast should
       // fail.
       break;
     }
 
     MR = Uncasted;
   }
 
+  if (const auto *SR = dyn_cast<SymbolicRegion>(MR)) {
+    return loc::MemRegionVal(GetElementZeroRegion(SR, TargetType));
+  }
+
   // We failed if the region we ended up with has perfect type info.
   Failed = isa<TypedValueRegion>(MR);
   return UnknownVal();
 }
 
 /// CastRetrievedVal - Used by subclasses of StoreManager to implement
 ///  implicit casts that arise from loads from regions that are reinterpreted
 ///  as another region.

clang/test/Analysis/casts.cpp

-// RUN: %clang_analyze_cc1 -analyzer-checker=core -analyzer-store=region -verify %s
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -analyzer-store=region -verify %s
+
+void clang_analyzer_eval(bool);
 
 bool PR14634(int x) {
   double y = (double)x;
   return !y;
 }
 
 bool PR14634_implicit(int x) {
   double y = (double)x;
bool testCastToIntPtrRValueRef(char *p, int *s) {
   return castToIntPtrRValueRef(p) != s; // no-crash
 }
 
 bool retrievePointerFromBoolean(int *p) {
   bool q;
   *reinterpret_cast<int **>(&q) = p;
   return q;
 }
+
+struct A {};
+struct B : public A{};
+
+void testNoopCast(A* a) {
+  B* b = (B* ) a;
+  A* a2 = (A *) b;
+  clang_analyzer_eval(a2 == a); // expected-warning{{TRUE}}
+}