[analyzer] SmartPtrModeling: Fix a null dereference.

[NoQ]

Summary

(whoops, accidentally sent too early)

Generally, Call.getDecl() is nullable, we should always check it before use!

[Charusso]

When I see ->* I go mad, but we should handle unknown stuff, cool patch.

[xazax.hun]

LG! These mistakes are so easy to make. Maybe we should add nullability annotations (or use optionals) in the future? (Or just make every non-null pointer a reference and make it a convention to always check for nulls?)

[NoQ]

The whole AST consists in passing raw unannotated pointers around and i suspect it'll be annoying to deal with Stmt &s and Decl &s specifically in the Analyzer when all AST APIs accept pointers.

I guess we'll have to go with some sort of nullability annotations, yeah. But first we need to fix Static Analyzer false positives on LLVM :)

lib/StaticAnalyzer/Checkers/SmartPtrModeling.cpp

 } // end of anonymous namespace
 
 bool SmartPtrModeling::isNullAfterMoveMethod(
     const CXXInstanceCall *Call) const {
   // TODO: Update CallDescription to support anonymous calls?
   // TODO: Handle other methods, such as .get() or .release().
   // But once we do, we'd need a visitor to explain null dereferences
   // that are found via such modeling.
-  const auto *CD = dyn_cast<CXXConversionDecl>(Call->getDecl());
+  const auto *CD = dyn_cast_or_null<CXXConversionDecl>(Call->getDecl());
   return CD && CD->getConversionType()->isBooleanType();
 }
 
 bool SmartPtrModeling::evalCall(const CallExpr *CE, CheckerContext &C) const {
   CallEventRef<> CallRef = C.getStateManager().getCallEventManager().getCall(
       CE, C.getState(), C.getLocationContext());
   const auto *Call = dyn_cast_or_null<CXXInstanceCall>(CallRef);
   if (!Call || !isNullAfterMoveMethod(Call))

test/Analysis/smart-ptr.cpp

void derefAfterMove(std::unique_ptr<int> P) {
   if (Q)
     clang_analyzer_warnIfReached(); // expected-warning{{REACHABLE}}
   *Q.get() = 1; // no-warning
   if (P)
     clang_analyzer_warnIfReached(); // no-warning
   // TODO: Report a null dereference (instead).
   *P.get() = 1; // expected-warning {{Method called on moved-from object 'P'}}
 }
+
+// Don't crash when attempting to model a call with unknown callee.
+namespace testUnknownCallee {
+struct S {
+  void foo();
+};
+void bar(S *s, void (S::*func)(void)) {
+  (s->*func)(); // no-crash
+}
+} // namespace testUnknownCallee