[analyzer] CastValueChecker: Model castAs(), getAs()

[Charusso]

Summary

Thanks to Kristóf Umann for the great idea!

[Charusso]

This is a little-bit WIP as the symbol conjuring is very naive.

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

111

That is a very lame way to conjure a symbol, but with a cool wrapper I believe this would be okay. Do we have a better way to create a non-null symbol?

clang/lib/StaticAnalyzer/Core/CallEvent.cpp

718

This is the only necessary addition to make it usable.

clang/test/Analysis/cast-value.cpp

113

I am not sure what is going on here,

131

and here.

193

Known-value printing fails, but at least it is working well.

[NoQ]

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

111

This creates a concrete 1 rather than a symbol. That's the right behavior for isa, but it's not the right behavior for getAs. In case of getAs we need to return our this.

[Charusso]

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

111

Could you explain what is this, please? At this case we are working with a CXXMemberCallExpr. Do you mean its getImplicitObjectArgument()?

[NoQ]

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

111

Yeah, its value.

[Charusso]

• Remove symbol-conjuring.
• Add a forgotten test case.

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

111

Hm, I have not understand why it is not working as I definitely wanted to use this. I believe I had forgotten an early-return at a wrong place. Thanks!

[Szelethus]

Cheers! :)

[NoQ]

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

51

I'd rather have only one map from call descriptions to (callback, kind) pairs. This should make the evalCall code much more readable.

223

Use Call.getResultType() instead.

And please add a test with references, as getResultType behaves more correctly for references:

C &c = ...;
D &d = dyn_cast<D>(c);

231

*Call.parameters()[0]->getType(). It should also help with references.

239

const auto *InstanceCall = dyn_cast<CXXInstanceCall>(&Call);
...
DV = InstanceCall->getCXXThisVal();

clang/lib/StaticAnalyzer/Core/CallEvent.cpp

718

I don't think you need this anymore.

clang/test/Analysis/cast-value.cpp

188

To think: this note isn't very useful because hard casts aren't really supposed to fail anyway.

[Charusso]

• Make it usable with references.
• Test references.
• Better messages on simple cast<>.

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

51

The problem with that I really want to use something like that:

auto &&[Check, Kind, MoreData] = *Lookup;

but I cannot. Until that time it equally non-readable and difficult to scale sadly. For now it is fine, but that C++17 feature would be more awesome.

239

Hm, not bad. Thanks!

clang/test/Analysis/cast-value.cpp

188

I believe it is better than the generic Assuming... piece.

[Charusso]

• Fix a comment.

[Charusso]

• May it is better to also check for getAsCXXRecordDecl() for obtaining a class.

[Charusso]

• The call as getAsCXXRecordDecl() sometimes run into an assertion failure, so we need to avoid it:

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp:333:
ExprEngine::createTemporaryRegionIfNeeded():
Assertion `!InitValWithAdjustments.getAs<Loc>() || Loc::isLocType(Result->getType()) || Result->getType()->isMemberPointerType()' failed.

[NoQ]

Looking good now! I still recommend eventually adding tests with casts of references.

In D65889#1620128, @Charusso wrote:

• May it is better to also check for getAsCXXRecordDecl() for obtaining a class.

In D65889#1621587, @Charusso wrote:

• The call as getAsCXXRecordDecl() sometimes run into an assertion failure, so we need to avoid it

Well, yeah, i was just about to say "good thing that you don't do this because we really don't want to get into business of modeling return-by-value getAs calls such as SVal::getAs".

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

25

Please explain "Checking" and "Sugar". Checking what? Sugar... you mean syntactic sugar? For what?

51

I think it turned out pretty pretty (no pun intended).

226–246

What's the point of making this a raw pointer? (no pun intended)

[NoQ]

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

84

IsDynamicCast.

96–97

More suggestions for the :-branch: "Hard cast" (a bit too jargon-y), "Safe cast", "Checked cast".

clang/test/Analysis/cast-value.cpp

155–166

Mmm, wait a sec. That's a false positive. cast<> doesn't accept null pointers. We have cast_or_null for this.

[Charusso]

• Added a test case for casting *to* a reference.
• Better naming.

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

25

I have no idea what devs mean by those names:

• Checking kind:

The cast<> operator is a “checked cast” operation.
The dyn_cast<> operator is a “checking cast” operation.

from http://llvm.org/docs/ProgrammersManual.html#the-isa-cast-and-dyn-cast-templates

• Sugar kind:

Member-template castAs<specific type>. Look through sugar for the underlying instance of <specific type>.
Member-template getAs<specific type>'. Look through sugar for an instance of <specific type>.

from https://clang.llvm.org/doxygen/classclang_1_1Type.html#a436b8b08ae7f2404b4712d37986194ce
and https://clang.llvm.org/doxygen/classclang_1_1Type.html#adae68e1f4c85ede2d36da45fbefc48a2

• isa() would be Instance kind:

The isa<> operator works exactly like the Java “instanceof” operator.

from http://llvm.org/docs/ProgrammersManual.html#the-isa-cast-and-dyn-cast-templates

If you could imagine better names, please let me know. I have tried to use the definitions.

84

It is not dyn_cast but simple cast. Because we have decided to use Checked for that cast, I believe IsCheckedCast the one.

96–97

Well, let us pick Checked then as that is the proper definition for cast(), but that other sugar-based castAs() definition makes me mad.

226–246

I just wanted to make it usable as it being used since the first review as (*Check) and emphasize it is not a given function-call but a pointer to one. If you think as a nude Check() it is fine, then I have no idea which is better and it is fine for me as well.

clang/test/Analysis/cast-value.cpp

155–166

This Assuming pointer value is null note is very random. I believe it is not made by me and my code is fine, so I have printed a graph:

graph-print-dark.svg98 KBDownload

Do you see any problem?

[NoQ]

Aha, ok!

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

25

{ Function, Method }?

clang/test/Analysis/cast-value.cpp

155–166

Whoops, sorry, i didn't notice the !. Seems fine.

Yeah, the note is broken. I have another interesting reproducer for a problem with the same note: https://bugs.llvm.org/show_bug.cgi?id=42938

[Charusso]

• Better naming.

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

25

These are cool identifiers, thanks!

clang/test/Analysis/cast-value.cpp

155–166

I will leave that not "Done" as FIXME: Broken notes.

[Charusso]

Thanks you for the review!

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "llvm/ADT/Optional.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class CastValueChecker : public Checker<eval::Call> {
+  enum class CastKind { Checking, Sugar };
+
   using CastCheck =
       std::function<void(const CastValueChecker *, const CallExpr *,
                          DefinedOrUnknownSVal, CheckerContext &)>;
 
 public:
-  // We have three cases to evaluate a cast:
+  // We have five cases to evaluate a cast:
   // 1) The parameter is non-null, the return value is non-null
   // 2) The parameter is non-null, the return value is null
   // 3) The parameter is null, the return value is null
-  //
   // cast: 1;  dyn_cast: 1, 2;  cast_or_null: 1, 3;  dyn_cast_or_null: 1, 2, 3.
+  //
+  // 4) castAs: has no parameter, the return value is non-null.
+  // 5) getAs:  has no parameter, the return value is null or non-null.
   bool evalCall(const CallEvent &Call, CheckerContext &C) const;
 
 private:
-  // These are known in the LLVM project.
-  const CallDescriptionMap<CastCheck> CDM = {
-      {{{"llvm", "cast"}, 1}, &CastValueChecker::evalCast},
-      {{{"llvm", "dyn_cast"}, 1}, &CastValueChecker::evalDynCast},
+  // These are known in the LLVM project. The pairs are in the following form:
+  // {{{namespace, call}, argument-count}, callback}
+  const CallDescriptionMap<CastCheck> CheckingCastCDM = {
+      {{{"llvm", "dyn_cast_or_null"}, 1}, &CastValueChecker::evalDynCastOrNull},
       {{{"llvm", "cast_or_null"}, 1}, &CastValueChecker::evalCastOrNull},
-      {{{"llvm", "dyn_cast_or_null"}, 1},
-       &CastValueChecker::evalDynCastOrNull}};
+      {{{"llvm", "dyn_cast"}, 1}, &CastValueChecker::evalDynCast},
+      {{{"llvm", "cast"}, 1}, &CastValueChecker::evalCast}};
+
+  const CallDescriptionMap<CastCheck> SugarCastCDM = {
+      {{{"clang", "castAs"}, 0}, &CastValueChecker::evalCastAs},
+      {{{"clang", "getAs"}, 0}, &CastValueChecker::evalGetAs}};
 
   void evalCast(const CallExpr *CE, DefinedOrUnknownSVal ParamDV,
                 CheckerContext &C) const;
   void evalDynCast(const CallExpr *CE, DefinedOrUnknownSVal ParamDV,
                    CheckerContext &C) const;
   void evalCastOrNull(const CallExpr *CE, DefinedOrUnknownSVal ParamDV,
                       CheckerContext &C) const;
   void evalDynCastOrNull(const CallExpr *CE, DefinedOrUnknownSVal ParamDV,
                          CheckerContext &C) const;
+
+  void evalCastAs(const CallExpr *CE, DefinedOrUnknownSVal DV,
+                  CheckerContext &C) const;
+  void evalGetAs(const CallExpr *CE, DefinedOrUnknownSVal DV,
+                 CheckerContext &C) const;
 };
 } // namespace
 
 static std::string getCastName(const Expr *Cast) {
   return Cast->getType()->getPointeeCXXRecordDecl()->getNameAsString();
 }
 
-static void evalNonNullParamNonNullReturn(const CallExpr *CE,
-                                          DefinedOrUnknownSVal ParamDV,
-                                          CheckerContext &C) {
-  ProgramStateRef State = C.getState()->assume(ParamDV, true);
-  if (!State)
-    return;
-
-  State = State->BindExpr(CE, C.getLocationContext(), ParamDV, false);
-
-  std::string CastFromName = getCastName(CE->getArg(0));
+static const NoteTag *getCastTag(bool IsNullReturn, const CallExpr *CE,
+  Optional<std::string> CastFromName = (CE->getNumArgs() > 0)
+                                           ? getCastName(CE->getArg(0))
+                                           : Optional<std::string>();
   std::string CastToName = getCastName(CE);
 
-  const NoteTag *CastTag = C.getNoteTag(
-      [CastFromName, CastToName](BugReport &) -> std::string {
+  return C.getNoteTag(
+      [CastFromName, CastToName, IsNullReturn](BugReport &) -> std::string {
         SmallString<128> Msg;
         llvm::raw_svector_ostream Out(Msg);
 
-        Out << "Assuming dynamic cast from '" << CastFromName << "' to '"
-            << CastToName << "' succeeds";
+        Out << "Assuming dynamic cast ";
+        if (CastFromName)
+          Out << "from '" << *CastFromName << "' ";
+
+        Out << "to '" << CastToName << "' "
+            << (!IsNullReturn ? "succeeds" : "fails");
+
         return Out.str();
       },
       /*IsPrunable=*/true);
-
-  C.addTransition(State, CastTag);
 }
 
-static void evalNonNullParamNullReturn(const CallExpr *CE,
-                                       DefinedOrUnknownSVal ParamDV,
-                                       CheckerContext &C) {
-  ProgramStateRef State = C.getState()->assume(ParamDV, true);
-  if (!State)
-    return;
-
-  State = State->BindExpr(CE, C.getLocationContext(),
-                          C.getSValBuilder().makeNull(), false);
+static ProgramStateRef getState(bool IsNullReturn,
+                                Optional<DefinedOrUnknownSVal> ReturnDV,
+                                const CallExpr *CE, ProgramStateRef State,
+  SVal V;
+  const LocationContext *LCtx = C.getLocationContext();
+  if (IsNullReturn) {
+    V = C.getSValBuilder().makeNull();
+  } else if (ReturnDV) {
+    V = *ReturnDV;
+  } else {
+    QualType Ty = CE->getCallReturnType(C.getASTContext());
+    V = C.getSValBuilder().makeTruthVal(true, Ty);
+  }
 
-  std::string CastFromName = getCastName(CE->getArg(0));
-  std::string CastToName = getCastName(CE);
+  return State->BindExpr(CE, LCtx, V, false);
+}
 
-  const NoteTag *CastTag = C.getNoteTag(
-      [CastFromName, CastToName](BugReport &) -> std::string {
-        SmallString<128> Msg;
-        llvm::raw_svector_ostream Out(Msg);
+//===----------------------------------------------------------------------===//
+// Evaluating cast, dyn_cast, cast_or_null, dyn_cast_or_null.
+//===----------------------------------------------------------------------===//
 
-        Out << "Assuming dynamic cast from '" << CastFromName << "' to '"
-            << CastToName << "' fails";
-        return Out.str();
-      },
-      /*IsPrunable=*/true);
+static void evalNonNullParamNonNullReturn(const CallExpr *CE,
+                                          DefinedOrUnknownSVal ParamDV,
+                                          CheckerContext &C) {
+  bool IsNullReturn = false;
+  if (ProgramStateRef State = C.getState()->assume(ParamDV, true))
+    C.addTransition(getState(IsNullReturn, ParamDV, CE, State, C),
+                    getCastTag(IsNullReturn, CE, C));
+}
 
-  C.addTransition(State, CastTag);
+static void evalNonNullParamNullReturn(const CallExpr *CE,
+                                       DefinedOrUnknownSVal ParamDV,
+                                       CheckerContext &C) {
+  bool IsNullReturn = true;
+  if (ProgramStateRef State = C.getState()->assume(ParamDV, true))
+    C.addTransition(getState(IsNullReturn, ParamDV, CE, State, C),
+                    getCastTag(IsNullReturn, CE, C));
 }
 
 static void evalNullParamNullReturn(const CallExpr *CE,
                                     DefinedOrUnknownSVal ParamDV,
                                     CheckerContext &C) {
-  ProgramStateRef State = C.getState()->assume(ParamDV, false);
-  if (!State)
-    return;
-
-  State = State->BindExpr(CE, C.getLocationContext(),
-                          C.getSValBuilder().makeNull(), false);
-
-  const NoteTag *CastTag =
+  if (ProgramStateRef State = C.getState()->assume(ParamDV, false))
+    C.addTransition(getState(/*IsNullReturn=*/true, ParamDV, CE, State, C),
                     C.getNoteTag("Assuming null pointer is passed into cast",
-                   /*IsPrunable=*/true);
-
-  C.addTransition(State, CastTag);
+                                 /*IsPrunable=*/true));
 }
 
 void CastValueChecker::evalCast(const CallExpr *CE,
                                 DefinedOrUnknownSVal ParamDV,
                                 CheckerContext &C) const {
   evalNonNullParamNonNullReturn(CE, ParamDV, C);
 }
 

 void CastValueChecker::evalDynCastOrNull(const CallExpr *CE,
                                          DefinedOrUnknownSVal ParamDV,
                                          CheckerContext &C) const {
   evalNonNullParamNonNullReturn(CE, ParamDV, C);
   evalNonNullParamNullReturn(CE, ParamDV, C);
   evalNullParamNullReturn(CE, ParamDV, C);
 }
 
+//===----------------------------------------------------------------------===//
+// Evaluating castAs, getAs.
+//===----------------------------------------------------------------------===//
+
+static void evalZeroParamNonNullReturn(const CallExpr *CE,
+                                       DefinedOrUnknownSVal DV,
+                                       CheckerContext &C) {
+  bool IsNullReturn = false;
+  if (ProgramStateRef State = C.getState()->assume(DV, true))
+    C.addTransition(getState(IsNullReturn, None, CE, C.getState(), C),
+                    getCastTag(IsNullReturn, CE, C));
+}
+
+static void evalZeroParamNullReturn(const CallExpr *CE, DefinedOrUnknownSVal DV,
+                                    CheckerContext &C) {
+  bool IsNullReturn = true;
+  if (ProgramStateRef State = C.getState()->assume(DV, true))
+    C.addTransition(getState(IsNullReturn, None, CE, C.getState(), C),
+                    getCastTag(IsNullReturn, CE, C));
+}
+
+void CastValueChecker::evalCastAs(const CallExpr *CE, DefinedOrUnknownSVal DV,
+                                  CheckerContext &C) const {
+  evalZeroParamNonNullReturn(CE, DV, C);
+}
+
+void CastValueChecker::evalGetAs(const CallExpr *CE, DefinedOrUnknownSVal DV,
+                                 CheckerContext &C) const {
+  evalZeroParamNonNullReturn(CE, DV, C);
+  evalZeroParamNullReturn(CE, DV, C);
+}
+
 bool CastValueChecker::evalCall(const CallEvent &Call,
                                 CheckerContext &C) const {
-  const CastCheck *Check = CDM.lookup(Call);
+  const CastCheck *Check = CheckingCastCDM.lookup(Call);
+  CastKind Kind = CastKind::Checking;
+
+  if (!Check) {
+    Check = SugarCastCDM.lookup(Call);
+    Kind = CastKind::Sugar;
+  }
+
   if (!Check)
     return false;
 
+  // If we cannot obtain the call's class we cannot be sure how to model it.
   const auto *CE = cast<CallExpr>(Call.getOriginExpr());
-  if (!CE)
+  if (!CE->getType()->getPointeeCXXRecordDecl())
+    return false;
+
+  Optional<DefinedOrUnknownSVal> DV;
+
+  switch (Kind) {
+  case CastKind::Checking:
+    // If we cannot obtain the arg's class we cannot be sure how to model it.
+    if (!CE->getArg(0)->getType()->getPointeeCXXRecordDecl())
       return false;
 
-  // If we cannot obtain both of the classes we cannot be sure how to model it.
-  if (!CE->getType()->getPointeeCXXRecordDecl() ||
-      !CE->getArg(0)->getType()->getPointeeCXXRecordDecl())
+    DV = Call.getArgSVal(0).getAs<DefinedOrUnknownSVal>();
+    break;
+
+  case CastKind::Sugar:
+    // If we cannot obtain 'MCE' we cannot be sure how to model it.
+    const auto *MCE = dyn_cast<CXXMemberCallExpr>(CE->IgnoreParenImpCasts());
+    if (!MCE)
       return false;
 
-  SVal ParamV = Call.getArgSVal(0);
-  auto ParamDV = ParamV.getAs<DefinedOrUnknownSVal>();
-  if (!ParamDV)
+    DV = C.getSVal(MCE->getImplicitObjectArgument())
+             .getAs<DefinedOrUnknownSVal>();
+    break;
+  }
+
+  if (!DV)
     return false;
 
-  (*Check)(this, CE, *ParamDV, C);
+  (*Check)(this, CE, *DV, C);
   return true;
 }
 
 void ento::registerCastValueChecker(CheckerManager &Mgr) {
   Mgr.registerChecker<CastValueChecker>();
 }
 
 bool ento::shouldRegisterCastValueChecker(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Core/CallEvent.cpp

 
 SVal CXXInstanceCall::getCXXThisVal() const {
   const Expr *Base = getCXXThisExpr();
   // FIXME: This doesn't handle an overloaded ->* operator.
   if (!Base)
     return UnknownVal();
 
   SVal ThisVal = getSVal(Base);
-  assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
+  assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>() ||
+         ThisVal.getAs<nonloc::ConcreteInt>()->getValue().getExtValue() == 1);
   return ThisVal;
 }
 
 RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const {
   // Do we have a decl at all?
   const Decl *D = getDecl();
   if (!D)
     return {};

clang/test/Analysis/cast-value.cpp

 
 template <class X, class Y>
 const X *cast_or_null(Y Value);
 
 template <class X, class Y>
 const X *dyn_cast_or_null(Y Value);
 } // namespace llvm
 
-using namespace llvm;
-
-class Shape {};
+namespace clang {
+struct Shape {
+  template <typename T>
+  const T *castAs() const;
+
+  template <typename T>
+  const T *getAs() const;
+};
 class Triangle : public Shape {};
 class Circle : public Shape {};
+} // namespace clang
+
+using namespace llvm;
+using namespace clang;
 
 namespace test_cast {
 void evalLogic(const Shape *S) {
   const Circle *C = cast<Circle>(S);
   clang_analyzer_numTimesReached(); // logic-warning {{1}}
 
   if (S && C)
     clang_analyzer_eval(C == S); // logic-warning {{TRUE}}
if (S && C)
     clang_analyzer_eval(C == S); // logic-warning {{TRUE}}
 
   if (S && !C)
     clang_analyzer_warnIfReached(); // logic-warning {{REACHABLE}}
 
   if (!S)
     clang_analyzer_eval(!C); // logic-warning {{TRUE}}
 }
+} // namespace test_dyn_cast_or_null
+
+namespace test_cast_as {
+void evalLogic(const Shape *S) {
+  const Circle *C = S->castAs<Circle>();
+  clang_analyzer_numTimesReached(); // logic-warning {{1}}
+
+  if (S && C)
+    clang_analyzer_eval(C == S);
+  // logic-warning@-1 {{TRUE}}
+  // logic-warning@-2 {{FALSE}}
+
+  if (S && !C)
+    clang_analyzer_warnIfReached(); // no-warning
+
+  if (!S)
+    clang_analyzer_warnIfReached(); // no-warning
+}
+} // namespace test_cast_as
+
+namespace test_get_as {
+void evalLogic(const Shape *S) {
+  const Circle *C = S->getAs<Circle>();
+  clang_analyzer_numTimesReached(); // logic-warning {{2}}
+
+  if (S && C)
+    clang_analyzer_eval(C == S);
+  // logic-warning@-1 {{TRUE}}
+  // logic-warning@-2 {{FALSE}}
+
+  if (S && !C)
+    clang_analyzer_warnIfReached(); // logic-warning {{REACHABLE}}
+
+  if (!S)
+    clang_analyzer_warnIfReached(); // no-warning
+}
+} // namespace test_get_as
 
+namespace test_notes {
 void evalNonNullParamNonNullReturn(const Shape *S) {
   const auto *C = dyn_cast_or_null<Circle>(S);
   // expected-note@-1 {{Assuming dynamic cast from 'Shape' to 'Circle' succeeds}}
   // expected-note@-2 {{Assuming pointer value is null}}
   // expected-note@-3 {{'C' initialized here}}
 
   (void)(1 / !(bool)C);
   // expected-note@-1 {{'C' is non-null}}
   // expected-note@-2 {{Division by zero}}
   // expected-warning@-3 {{Division by zero}}
   // logic-warning@-4 {{Division by zero}}
 }
 
 void evalNonNullParamNullReturn(const Shape *S) {
   const auto *C = dyn_cast_or_null<Circle>(S);
   // expected-note@-1 {{Assuming dynamic cast from 'Shape' to 'Circle' fails}}
   // expected-note@-2 {{Assuming pointer value is null}}
 
   if (const auto *T = dyn_cast_or_null<Triangle>(S)) {
     // expected-note@-1 {{Assuming dynamic cast from 'Shape' to 'Triangle' succeeds}}
     // expected-note@-2 {{'T' initialized here}}
     // expected-note@-3 {{'T' is non-null}}
     // expected-note@-4 {{Taking true branch}}
 
     (void)(1 / !T);
     // expected-note@-1 {{'T' is non-null}}
     // expected-note@-2 {{Division by zero}}
     // expected-warning@-3 {{Division by zero}}
     // logic-warning@-4 {{Division by zero}}
   }
 }
 
 void evalNullParamNullReturn(const Shape *S) {
   const auto *C = dyn_cast_or_null<Circle>(S);
   // expected-note@-1 {{Assuming null pointer is passed into cast}}
   // expected-note@-2 {{'C' initialized to a null pointer value}}
 
   (void)(1 / (bool)C);
   // expected-note@-1 {{Division by zero}}
   // expected-warning@-2 {{Division by zero}}
   // logic-warning@-3 {{Division by zero}}
 }
-} // namespace test_dyn_cast_or_null
+
+void evalZeroParamNonNullReturn(const Shape *S) {
+  const auto *C = S->castAs<Circle>();
+  // expected-note@-1 {{Assuming dynamic cast to 'Circle' succeeds}}
+  // expected-note@-2 {{'C' initialized to a null pointer value}}
+
+  (void)(1 / !(bool)C);
+  // expected-note@-1 {{Division by zero}}
+  // expected-warning@-2 {{Division by zero}}
+  // logic-warning@-3 {{Division by zero}}
+}
+} // namespace test_notes