[analyzer] CastValueChecker: Model castAs(), getAs()

[Charusso]

Summary

Thanks to Kristóf Umann for the great idea!

[Charusso]

This is a little-bit WIP as the symbol conjuring is very naive.

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

114

That is a very lame way to conjure a symbol, but with a cool wrapper I believe this would be okay. Do we have a better way to create a non-null symbol?

clang/lib/StaticAnalyzer/Core/CallEvent.cpp

718 ↗

(On Diff #213919)

This is the only necessary addition to make it usable.

clang/test/Analysis/cast-value.cpp

117

I am not sure what is going on here,

135

and here.

216

Known-value printing fails, but at least it is working well.

[NoQ]

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

114

This creates a concrete 1 rather than a symbol. That's the right behavior for isa, but it's not the right behavior for getAs. In case of getAs we need to return our this.

[Charusso]

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

114

Could you explain what is this, please? At this case we are working with a CXXMemberCallExpr. Do you mean its getImplicitObjectArgument()?

[NoQ]

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

114

Yeah, its value.

[Charusso]

• Remove symbol-conjuring.
• Add a forgotten test case.

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

114

Hm, I have not understand why it is not working as I definitely wanted to use this. I believe I had forgotten an early-return at a wrong place. Thanks!

[Szelethus]

Cheers! :)

[NoQ]

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

59

I'd rather have only one map from call descriptions to (callback, kind) pairs. This should make the evalCall code much more readable.

216–218

Use Call.getResultType() instead.

And please add a test with references, as getResultType behaves more correctly for references:

C &c = ...;
D &d = dyn_cast<D>(c);

226

*Call.parameters()[0]->getType(). It should also help with references.

234

const auto *InstanceCall = dyn_cast<CXXInstanceCall>(&Call);
...
DV = InstanceCall->getCXXThisVal();

clang/lib/StaticAnalyzer/Core/CallEvent.cpp

718 ↗

(On Diff #213952)

I don't think you need this anymore.

clang/test/Analysis/cast-value.cpp

211

To think: this note isn't very useful because hard casts aren't really supposed to fail anyway.

[Charusso]

• Make it usable with references.
• Test references.
• Better messages on simple cast<>.

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

59

The problem with that I really want to use something like that:

auto &&[Check, Kind, MoreData] = *Lookup;

but I cannot. Until that time it equally non-readable and difficult to scale sadly. For now it is fine, but that C++17 feature would be more awesome.

234

Hm, not bad. Thanks!

clang/test/Analysis/cast-value.cpp

211

I believe it is better than the generic Assuming... piece.

[Charusso]

• Fix a comment.

[Charusso]

• May it is better to also check for getAsCXXRecordDecl() for obtaining a class.

[Charusso]

• The call as getAsCXXRecordDecl() sometimes run into an assertion failure, so we need to avoid it:

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp:333:
ExprEngine::createTemporaryRegionIfNeeded():
Assertion `!InitValWithAdjustments.getAs<Loc>() || Loc::isLocType(Result->getType()) || Result->getType()->isMemberPointerType()' failed.

[NoQ]

Looking good now! I still recommend eventually adding tests with casts of references.

In D65889#1620128, @Charusso wrote:

• May it is better to also check for getAsCXXRecordDecl() for obtaining a class.

In D65889#1621587, @Charusso wrote:

• The call as getAsCXXRecordDecl() sometimes run into an assertion failure, so we need to avoid it

Well, yeah, i was just about to say "good thing that you don't do this because we really don't want to get into business of modeling return-by-value getAs calls such as SVal::getAs".

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

26

Please explain "Checking" and "Sugar". Checking what? Sugar... you mean syntactic sugar? For what?

59

I think it turned out pretty pretty (no pun intended).

221–222

What's the point of making this a raw pointer? (no pun intended)

[NoQ]

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

95

IsDynamicCast.

99–101

More suggestions for the :-branch: "Hard cast" (a bit too jargon-y), "Safe cast", "Checked cast".

clang/test/Analysis/cast-value.cpp

165–176

Mmm, wait a sec. That's a false positive. cast<> doesn't accept null pointers. We have cast_or_null for this.

[Charusso]

• Added a test case for casting *to* a reference.
• Better naming.

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

26

I have no idea what devs mean by those names:

• Checking kind:

The cast<> operator is a “checked cast” operation.
The dyn_cast<> operator is a “checking cast” operation.

from http://llvm.org/docs/ProgrammersManual.html#the-isa-cast-and-dyn-cast-templates

• Sugar kind:

Member-template castAs<specific type>. Look through sugar for the underlying instance of <specific type>.
Member-template getAs<specific type>'. Look through sugar for an instance of <specific type>.

from https://clang.llvm.org/doxygen/classclang_1_1Type.html#a436b8b08ae7f2404b4712d37986194ce
and https://clang.llvm.org/doxygen/classclang_1_1Type.html#adae68e1f4c85ede2d36da45fbefc48a2

• isa() would be Instance kind:

The isa<> operator works exactly like the Java “instanceof” operator.

from http://llvm.org/docs/ProgrammersManual.html#the-isa-cast-and-dyn-cast-templates

If you could imagine better names, please let me know. I have tried to use the definitions.

95

It is not dyn_cast but simple cast. Because we have decided to use Checked for that cast, I believe IsCheckedCast the one.

99–101

Well, let us pick Checked then as that is the proper definition for cast(), but that other sugar-based castAs() definition makes me mad.

221–222

I just wanted to make it usable as it being used since the first review as (*Check) and emphasize it is not a given function-call but a pointer to one. If you think as a nude Check() it is fine, then I have no idea which is better and it is fine for me as well.

clang/test/Analysis/cast-value.cpp

165–176

This Assuming pointer value is null note is very random. I believe it is not made by me and my code is fine, so I have printed a graph:

graph-print-dark.svg98 KBDownload

Do you see any problem?

[NoQ]

Aha, ok!

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

26

{ Function, Method }?

clang/test/Analysis/cast-value.cpp

165–176

Whoops, sorry, i didn't notice the !. Seems fine.

Yeah, the note is broken. I have another interesting reproducer for a problem with the same note: https://bugs.llvm.org/show_bug.cgi?id=42938

[Charusso]

• Better naming.

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

26

These are cool identifiers, thanks!

clang/test/Analysis/cast-value.cpp

165–176

I will leave that not "Done" as FIXME: Broken notes.

[Charusso]

Thanks you for the review!

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

 //===----------------------------------------------------------------------===//
 
 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "llvm/ADT/Optional.h"
+#include <utility>
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class CastValueChecker : public Checker<eval::Call> {
+  enum class CastKind { Checking, Sugar };
+
   using CastCheck =
       std::function<void(const CastValueChecker *, const CallExpr *,
                          DefinedOrUnknownSVal, CheckerContext &)>;
 
+  using CheckKindPair = std::pair<CastCheck, CastKind>;
+
 public:
-  // We have three cases to evaluate a cast:
+  // We have five cases to evaluate a cast:
   // 1) The parameter is non-null, the return value is non-null
   // 2) The parameter is non-null, the return value is null
   // 3) The parameter is null, the return value is null
-  //
   // cast: 1;  dyn_cast: 1, 2;  cast_or_null: 1, 3;  dyn_cast_or_null: 1, 2, 3.
+  //
+  // 4) castAs: has no parameter, the return value is non-null.
+  // 5) getAs:  has no parameter, the return value is null or non-null.
   bool evalCall(const CallEvent &Call, CheckerContext &C) const;
 
 private:
-  // These are known in the LLVM project.
-  const CallDescriptionMap<CastCheck> CDM = {
-      {{{"llvm", "cast"}, 1}, &CastValueChecker::evalCast},
-      {{{"llvm", "dyn_cast"}, 1}, &CastValueChecker::evalDynCast},
-      {{{"llvm", "cast_or_null"}, 1}, &CastValueChecker::evalCastOrNull},
+  // These are known in the LLVM project. The pairs are in the following form:
+  // {{{namespace, call}, argument-count}, {callback, kind}}
+  const CallDescriptionMap<CheckKindPair> CDM = {
+      {{{"llvm", "cast"}, 1},
+       {&CastValueChecker::evalCast, CastKind::Checking}},
+      {{{"llvm", "dyn_cast"}, 1},
+       {&CastValueChecker::evalDynCast, CastKind::Checking}},
+      {{{"llvm", "cast_or_null"}, 1},
+       {&CastValueChecker::evalCastOrNull, CastKind::Checking}},
       {{{"llvm", "dyn_cast_or_null"}, 1},
-       &CastValueChecker::evalDynCastOrNull}};
+       {&CastValueChecker::evalDynCastOrNull, CastKind::Checking}},
+      {{{"clang", "castAs"}, 0},
+       {&CastValueChecker::evalCastAs, CastKind::Sugar}},
+      {{{"clang", "getAs"}, 0},
+       {&CastValueChecker::evalGetAs, CastKind::Sugar}}};
 
-  void evalCast(const CallExpr *CE, DefinedOrUnknownSVal ParamDV,
+  void evalCast(const CallExpr *CE, DefinedOrUnknownSVal DV,
                 CheckerContext &C) const;
-  void evalDynCast(const CallExpr *CE, DefinedOrUnknownSVal ParamDV,
+  void evalDynCast(const CallExpr *CE, DefinedOrUnknownSVal DV,
                    CheckerContext &C) const;
-  void evalCastOrNull(const CallExpr *CE, DefinedOrUnknownSVal ParamDV,
+  void evalCastOrNull(const CallExpr *CE, DefinedOrUnknownSVal DV,
                       CheckerContext &C) const;
-  void evalDynCastOrNull(const CallExpr *CE, DefinedOrUnknownSVal ParamDV,
-                         CheckerContext &C) const;
+  void evalDynCastOrNull(const CallExpr *CE, DefinedOrUnknownSVal DV,
+                         CheckerContext &C) const;
+  void evalCastAs(const CallExpr *CE, DefinedOrUnknownSVal DV,
+                  CheckerContext &C) const;
+  void evalGetAs(const CallExpr *CE, DefinedOrUnknownSVal DV,
 };
 } // namespace
 
 static std::string getCastName(const Expr *Cast) {
-  return Cast->getType()->getPointeeCXXRecordDecl()->getNameAsString();
+  QualType Ty = Cast->getType();
+  if (const CXXRecordDecl *RD = Ty->getAsCXXRecordDecl())
+    return RD->getNameAsString();
+
+  return Ty->getPointeeCXXRecordDecl()->getNameAsString();
 }
 
-static void evalNonNullParamNonNullReturn(const CallExpr *CE,
-                                          DefinedOrUnknownSVal ParamDV,
-                                          CheckerContext &C) {
-  ProgramStateRef State = C.getState()->assume(ParamDV, true);
-  if (!State)
-    return;
-
-  State = State->BindExpr(CE, C.getLocationContext(), ParamDV, false);
-
-  std::string CastFromName = getCastName(CE->getArg(0));
+static const NoteTag *getCastTag(bool IsNullReturn, const CallExpr *CE,
+                                 CheckerContext &C,
+                                 bool IsCheckedCast = false) {
+  Optional<std::string> CastFromName = (CE->getNumArgs() > 0)
+                                           ? getCastName(CE->getArg(0))
+                                           : Optional<std::string>();
   std::string CastToName = getCastName(CE);
 
-  const NoteTag *CastTag = C.getNoteTag(
-      [CastFromName, CastToName](BugReport &) -> std::string {
+  return C.getNoteTag(
+      [CastFromName, CastToName, IsNullReturn,
+       IsCheckedCast](BugReport &) -> std::string {
         SmallString<128> Msg;
         llvm::raw_svector_ostream Out(Msg);
 
-        Out << "Assuming dynamic cast from '" << CastFromName << "' to '"
-            << CastToName << "' succeeds";
+        Out << (!IsCheckedCast ? "Assuming dynamic cast " : "Checked cast ");
+        if (CastFromName)
+          Out << "from '" << *CastFromName << "' ";
+
+        Out << "to '" << CastToName << "' "
+            << (!IsNullReturn ? "succeeds" : "fails");
+
         return Out.str();
       },
       /*IsPrunable=*/true);
-
-  C.addTransition(State, CastTag);
 }
 
-static void evalNonNullParamNullReturn(const CallExpr *CE,
-                                       DefinedOrUnknownSVal ParamDV,
-                                       CheckerContext &C) {
-  ProgramStateRef State = C.getState()->assume(ParamDV, true);
-  if (!State)
-    return;
-
-  State = State->BindExpr(CE, C.getLocationContext(),
-                          C.getSValBuilder().makeNull(), false);
-
-  std::string CastFromName = getCastName(CE->getArg(0));
-  std::string CastToName = getCastName(CE);
-
-  const NoteTag *CastTag = C.getNoteTag(
-      [CastFromName, CastToName](BugReport &) -> std::string {
-        SmallString<128> Msg;
-        llvm::raw_svector_ostream Out(Msg);
+static ProgramStateRef getState(bool IsNullReturn,
+                                DefinedOrUnknownSVal ReturnDV,
+                                const CallExpr *CE, ProgramStateRef State,
+  return State->BindExpr(
+      CE, C.getLocationContext(),
+      IsNullReturn ? C.getSValBuilder().makeNull() : ReturnDV, false);
+}
 
-        Out << "Assuming dynamic cast from '" << CastFromName << "' to '"
-            << CastToName << "' fails";
-        return Out.str();
-      },
-      /*IsPrunable=*/true);
+//===----------------------------------------------------------------------===//
+// Evaluating cast, dyn_cast, cast_or_null, dyn_cast_or_null.
+//===----------------------------------------------------------------------===//
 
-  C.addTransition(State, CastTag);
+static void evalNonNullParamNonNullReturn(const CallExpr *CE,
+                                          DefinedOrUnknownSVal DV,
+                                          CheckerContext &C,
+                                          bool IsCheckedCast = false) {
+  bool IsNullReturn = false;
+  if (ProgramStateRef State = C.getState()->assume(DV, true))
+    C.addTransition(getState(IsNullReturn, DV, CE, State, C),
+                    getCastTag(IsNullReturn, CE, C, IsCheckedCast));
 }
 
-static void evalNullParamNullReturn(const CallExpr *CE,
-                                    DefinedOrUnknownSVal ParamDV,
+static void evalNonNullParamNullReturn(const CallExpr *CE,
+                                       DefinedOrUnknownSVal DV,
                                        CheckerContext &C) {
-  ProgramStateRef State = C.getState()->assume(ParamDV, false);
-  if (!State)
-    return;
-
-  State = State->BindExpr(CE, C.getLocationContext(),
-                          C.getSValBuilder().makeNull(), false);
+  bool IsNullReturn = true;
+  if (ProgramStateRef State = C.getState()->assume(DV, true))
+    C.addTransition(getState(IsNullReturn, DV, CE, State, C),
+                    getCastTag(IsNullReturn, CE, C));
+}
 
-  const NoteTag *CastTag =
+static void evalNullParamNullReturn(const CallExpr *CE, DefinedOrUnknownSVal DV,
+                                    CheckerContext &C) {
+  if (ProgramStateRef State = C.getState()->assume(DV, false))
+    C.addTransition(getState(/*IsNullReturn=*/true, DV, CE, State, C),
                     C.getNoteTag("Assuming null pointer is passed into cast",
-                   /*IsPrunable=*/true);
-
-  C.addTransition(State, CastTag);
+                                 /*IsPrunable=*/true));
 }
 
-void CastValueChecker::evalCast(const CallExpr *CE,
-                                DefinedOrUnknownSVal ParamDV,
+void CastValueChecker::evalCast(const CallExpr *CE, DefinedOrUnknownSVal DV,
                                 CheckerContext &C) const {
-  evalNonNullParamNonNullReturn(CE, ParamDV, C);
+  evalNonNullParamNonNullReturn(CE, DV, C, /*IsCheckedCast=*/true);
 }
 
-void CastValueChecker::evalDynCast(const CallExpr *CE,
-                                   DefinedOrUnknownSVal ParamDV,
+void CastValueChecker::evalDynCast(const CallExpr *CE, DefinedOrUnknownSVal DV,
                                    CheckerContext &C) const {
-  evalNonNullParamNonNullReturn(CE, ParamDV, C);
-  evalNonNullParamNullReturn(CE, ParamDV, C);
+  evalNonNullParamNonNullReturn(CE, DV, C);
+  evalNonNullParamNullReturn(CE, DV, C);
 }
 
 void CastValueChecker::evalCastOrNull(const CallExpr *CE,
-                                      DefinedOrUnknownSVal ParamDV,
+                                      DefinedOrUnknownSVal DV,
                                       CheckerContext &C) const {
-  evalNonNullParamNonNullReturn(CE, ParamDV, C);
-  evalNullParamNullReturn(CE, ParamDV, C);
+  evalNonNullParamNonNullReturn(CE, DV, C);
+  evalNullParamNullReturn(CE, DV, C);
 }
 
 void CastValueChecker::evalDynCastOrNull(const CallExpr *CE,
-                                         DefinedOrUnknownSVal ParamDV,
+                                         DefinedOrUnknownSVal DV,
                                          CheckerContext &C) const {
-  evalNonNullParamNonNullReturn(CE, ParamDV, C);
-  evalNonNullParamNullReturn(CE, ParamDV, C);
-  evalNullParamNullReturn(CE, ParamDV, C);
+  evalNonNullParamNonNullReturn(CE, DV, C);
+  evalNonNullParamNullReturn(CE, DV, C);
+  evalNullParamNullReturn(CE, DV, C);
+}
+
+//===----------------------------------------------------------------------===//
+// Evaluating castAs, getAs.
+//===----------------------------------------------------------------------===//
+
+static void evalZeroParamNonNullReturn(const CallExpr *CE,
+                                       DefinedOrUnknownSVal DV,
+                                       CheckerContext &C,
+                                       bool IsCheckedCast = false) {
+  bool IsNullReturn = false;
+  if (ProgramStateRef State = C.getState()->assume(DV, true))
+    C.addTransition(getState(IsNullReturn, DV, CE, C.getState(), C),
+                    getCastTag(IsNullReturn, CE, C, IsCheckedCast));
+}
+
+static void evalZeroParamNullReturn(const CallExpr *CE, DefinedOrUnknownSVal DV,
+                                    CheckerContext &C) {
+  bool IsNullReturn = true;
+  if (ProgramStateRef State = C.getState()->assume(DV, true))
+    C.addTransition(getState(IsNullReturn, DV, CE, C.getState(), C),
+                    getCastTag(IsNullReturn, CE, C));
+}
+
+void CastValueChecker::evalCastAs(const CallExpr *CE, DefinedOrUnknownSVal DV,
+                                  CheckerContext &C) const {
+  evalZeroParamNonNullReturn(CE, DV, C, /*IsCheckedCast=*/true);
+}
+
+void CastValueChecker::evalGetAs(const CallExpr *CE, DefinedOrUnknownSVal DV,
+                                 CheckerContext &C) const {
+  evalZeroParamNonNullReturn(CE, DV, C);
+  evalZeroParamNullReturn(CE, DV, C);
 }
 
 bool CastValueChecker::evalCall(const CallEvent &Call,
                                 CheckerContext &C) const {
-  const CastCheck *Check = CDM.lookup(Call);
-  if (!Check)
+  const auto *Lookup = CDM.lookup(Call);
+  if (!Lookup)
     return false;
 
+  // If we cannot obtain the call's class we cannot be sure how to model it.
+  QualType ResultTy = Call.getResultType();
+  if (!ResultTy->getPointeeCXXRecordDecl())
+    return false;
+
+  const CastCheck &Check = Lookup->first;
+  CastKind Kind = Lookup->second;
+
   const auto *CE = cast<CallExpr>(Call.getOriginExpr());
-  if (!CE)
+  Optional<DefinedOrUnknownSVal> DV;
+
+  switch (Kind) {
+  case CastKind::Checking: {
+    // If we cannot obtain the arg's class we cannot be sure how to model it.
+    QualType ArgTy = Call.parameters()[0]->getType();
+    if (!ArgTy->getAsCXXRecordDecl() && !ArgTy->getPointeeCXXRecordDecl())
       return false;
 
-  // If we cannot obtain both of the classes we cannot be sure how to model it.
-  if (!CE->getType()->getPointeeCXXRecordDecl() ||
-      !CE->getArg(0)->getType()->getPointeeCXXRecordDecl())
+    DV = Call.getArgSVal(0).getAs<DefinedOrUnknownSVal>();
+    break;
+  }
+  case CastKind::Sugar:
+    // If we cannot obtain the 'InstanceCall' we cannot be sure how to model it.
+    const auto *InstanceCall = dyn_cast<CXXInstanceCall>(&Call);
+    if (!InstanceCall)
       return false;
 
-  SVal ParamV = Call.getArgSVal(0);
-  auto ParamDV = ParamV.getAs<DefinedOrUnknownSVal>();
-  if (!ParamDV)
+    DV = InstanceCall->getCXXThisVal().getAs<DefinedOrUnknownSVal>();
+    break;
+  }
+
+  if (!DV)
     return false;
 
-  (*Check)(this, CE, *ParamDV, C);
+  Check(this, CE, *DV, C);
   return true;
 }
 
 void ento::registerCastValueChecker(CheckerManager &Mgr) {
   Mgr.registerChecker<CastValueChecker>();
 }
 
 bool ento::shouldRegisterCastValueChecker(const LangOptions &LO) {
   return true;
 }

clang/test/Analysis/cast-value.cpp

 // RUN: %clang_analyze_cc1 \
 // RUN:  -analyzer-checker=core,apiModeling.llvm.CastValue,debug.ExprInspection\
 // RUN:  -verify=logic %s
 // RUN: %clang_analyze_cc1 \
 // RUN:  -analyzer-checker=core,apiModeling.llvm.CastValue \
 // RUN:  -analyzer-output=text -verify %s
 
 void clang_analyzer_numTimesReached();
 void clang_analyzer_warnIfReached();
 void clang_analyzer_eval(bool);
 
 namespace llvm {
 template <class X, class Y>
 const X *cast(Y Value);
 
 template <class X, class Y>
-const X *dyn_cast(Y Value);
+const X *dyn_cast(Y *Value);
+template <class X, class Y>
+const X &dyn_cast(Y &Value);
 
 template <class X, class Y>
 const X *cast_or_null(Y Value);
 
 template <class X, class Y>
-const X *dyn_cast_or_null(Y Value);
+const X *dyn_cast_or_null(Y *Value);
+template <class X, class Y>
+const X *dyn_cast_or_null(Y &Value);
 } // namespace llvm
 
-using namespace llvm;
-
-class Shape {};
+namespace clang {
+struct Shape {
+  template <typename T>
+  const T *castAs() const;
+
+  template <typename T>
+  const T *getAs() const;
+};
 class Triangle : public Shape {};
 class Circle : public Shape {};
+} // namespace clang
+
+using namespace llvm;
+using namespace clang;
 
 namespace test_cast {
 void evalLogic(const Shape *S) {
   const Circle *C = cast<Circle>(S);
   clang_analyzer_numTimesReached(); // logic-warning {{1}}
 
   if (S && C)
     clang_analyzer_eval(C == S); // logic-warning {{TRUE}}
if (S && C)
     clang_analyzer_eval(C == S); // logic-warning {{TRUE}}
 
   if (S && !C)
     clang_analyzer_warnIfReached(); // logic-warning {{REACHABLE}}
 
   if (!S)
     clang_analyzer_eval(!C); // logic-warning {{TRUE}}
 }
+} // namespace test_dyn_cast_or_null
 
-void evalNonNullParamNonNullReturn(const Shape *S) {
+namespace test_cast_as {
+void evalLogic(const Shape *S) {
+  const Circle *C = S->castAs<Circle>();
+  clang_analyzer_numTimesReached(); // logic-warning {{1}}
+
+  if (S && C)
+    clang_analyzer_eval(C == S);
+  // logic-warning@-1 {{TRUE}}
+
+  if (S && !C)
+    clang_analyzer_warnIfReached(); // no-warning
+
+  if (!S)
+    clang_analyzer_warnIfReached(); // no-warning
+}
+} // namespace test_cast_as
+
+namespace test_get_as {
+void evalLogic(const Shape *S) {
+  const Circle *C = S->getAs<Circle>();
+  clang_analyzer_numTimesReached(); // logic-warning {{2}}
+
+  if (S && C)
+    clang_analyzer_eval(C == S);
+  // logic-warning@-1 {{TRUE}}
+
+  if (S && !C)
+    clang_analyzer_warnIfReached(); // logic-warning {{REACHABLE}}
+
+  if (!S)
+    clang_analyzer_warnIfReached(); // no-warning
+}
+} // namespace test_get_as
+
+namespace test_notes {
+void evalReferences(const Shape &S) {
+  const auto &C = dyn_cast<Circle>(S);
+  // expected-note@-1 {{Assuming dynamic cast from 'Shape' to 'Circle' fails}}
+  // expected-note@-2 {{Dereference of null pointer}}
+  // expected-warning@-3 {{Dereference of null pointer}}
+  // logic-warning@-4 {{Dereference of null pointer}}
+}
+
+void evalNonNullParamNonNullReturnReference(const Shape &S) {
   const auto *C = dyn_cast_or_null<Circle>(S);
   // expected-note@-1 {{Assuming dynamic cast from 'Shape' to 'Circle' succeeds}}
   // expected-note@-2 {{Assuming pointer value is null}}
   // expected-note@-3 {{'C' initialized here}}
 
   (void)(1 / !(bool)C);
   // expected-note@-1 {{'C' is non-null}}
   // expected-note@-2 {{Division by zero}}
   // expected-warning@-3 {{Division by zero}}
   // logic-warning@-4 {{Division by zero}}
 }
 
+void evalNonNullParamNonNullReturn(const Shape *S) {
+  const auto *C = cast<Circle>(S);
+  // expected-note@-1 {{Checked cast from 'Shape' to 'Circle' succeeds}}
+  // expected-note@-2 {{Assuming pointer value is null}}
+  // expected-note@-3 {{'C' initialized here}}
+
+  (void)(1 / !(bool)C);
+  // expected-note@-1 {{'C' is non-null}}
+  // expected-note@-2 {{Division by zero}}
+  // expected-warning@-3 {{Division by zero}}
+  // logic-warning@-4 {{Division by zero}}
+}
+
 void evalNonNullParamNullReturn(const Shape *S) {
   const auto *C = dyn_cast_or_null<Circle>(S);
   // expected-note@-1 {{Assuming dynamic cast from 'Shape' to 'Circle' fails}}
   // expected-note@-2 {{Assuming pointer value is null}}
 
   if (const auto *T = dyn_cast_or_null<Triangle>(S)) {
     // expected-note@-1 {{Assuming dynamic cast from 'Shape' to 'Triangle' succeeds}}
     // expected-note@-2 {{'T' initialized here}}
void evalNullParamNullReturn(const Shape *S) {
   // expected-note@-1 {{Assuming null pointer is passed into cast}}
   // expected-note@-2 {{'C' initialized to a null pointer value}}
 
   (void)(1 / (bool)C);
   // expected-note@-1 {{Division by zero}}
   // expected-warning@-2 {{Division by zero}}
   // logic-warning@-3 {{Division by zero}}
 }
-} // namespace test_dyn_cast_or_null
+
+void evalZeroParamNonNullReturnPointer(const Shape *S) {
+  const auto *C = S->castAs<Circle>();
+  // expected-note@-1 {{Assuming pointer value is null}}
+  // expected-note@-2 {{Checked cast to 'Circle' succeeds}}
+  // expected-note@-3 {{'C' initialized here}}
+
+  (void)(1 / !(bool)C);
+  // expected-note@-1 {{'C' is non-null}}
+  // expected-note@-2 {{Division by zero}}
+  // expected-warning@-3 {{Division by zero}}
+  // logic-warning@-4 {{Division by zero}}
+}
+
+void evalZeroParamNonNullReturn(const Shape &S) {
+  const auto *C = S.castAs<Circle>();
+  // expected-note@-1 {{Checked cast to 'Circle' succeeds}}
+  // expected-note@-2 {{'C' initialized here}}
+
+  (void)(1 / !(bool)C);
+  // expected-note@-1 {{'C' is non-null}}
+  // expected-note@-2 {{Division by zero}}
+  // expected-warning@-3 {{Division by zero}}
+  // logic-warning@-4 {{Division by zero}}
+}
+
+void evalZeroParamNullReturn(const Shape &S) {
+  const auto *C = S.getAs<Circle>();
+  // expected-note@-1 {{Assuming dynamic cast to 'Circle' fails}}
+  // expected-note@-2 {{'C' initialized to a null pointer value}}
+
+  (void)(1 / (bool)C);
+  // expected-note@-1 {{Division by zero}}
+  // expected-warning@-2 {{Division by zero}}
+  // logic-warning@-3 {{Division by zero}}
+}
+} // namespace test_notes