The successfulness of a dynamic cast depends only on the C++ class, not the pointer or reference. Thus if *A is a *B, then &A is a &B, const *A is a const *B etc. This patch changes DynamicCastInfo to store and check the cast between the unqualified pointed/referenced types. It also removes e.g. SubstTemplateTypeParmType from both the pointer and the pointed type.
Is this doing what you intended? What about a reference to a pointer? Wouldn't you do too much unboxing?
Also, I think a function returning a value would be more conventional.
Other sugars like typedefs cannot interfere? I think this patch might benefit from additional test coverage. I also see no tests for template substitutions.
Reference to pointer cast using LLVM's cast functions are syntactically invalid, they do not compile.
For QualType in-place modification is usual, since we use it by value.
I see no test coverage for this particular part of the analyzer specifically, it seems that its is only tested indirectly in the tests for CastValueChecker.
The usual idiom is
if (Ty->isPointerType() || Ty->isReferenceType()) Ty = Ty->getPointeeType();
It makes sure that you don't unwrap things twice. Also there's no need to canonicalize before unwrapping the pointee type; all these methods automatically operate over the canonical type.
You might want to add tests for typedefs.