[clang][analyzer] Fix a crash in alpha.unix.BlockInCriticalSection

[gamesh411]

When analyzing C code with function pointers the checker crashes because
of how the implementation extracts IdentifierInfo. Without the fix, this
test crashes.

[llvmbot]

@llvm/pr-subscribers-clang-static-analyzer-1

@llvm/pr-subscribers-clang

Author: Endre Fülöp (gamesh411)

Changes

In CTU there is not always an AnalysisDeclContext for a given call. This
led to crashes. The AnalysisDeclContext access is now checked.

---

Full diff: https://github.com/llvm/llvm-project/pull/90030.diff

1 Files Affected:

• (modified) clang/lib/StaticAnalyzer/Checkers/BlockInCriticalSectionChecker.cpp (+5-3)

diff --git a/clang/lib/StaticAnalyzer/Checkers/BlockInCriticalSectionChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/BlockInCriticalSectionChecker.cpp
index e4373915410fb2..9874a68ebe47af 100644
--- a/clang/lib/StaticAnalyzer/Checkers/BlockInCriticalSectionChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/BlockInCriticalSectionChecker.cpp
@@ -14,6 +14,7 @@
 //
 //===----------------------------------------------------------------------===//
 
+#include "clang/Analysis/AnalysisDeclContext.h"
 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
@@ -103,9 +104,10 @@ class RAIIMutexDescriptor {
       // this function is called instead of early returning it. To avoid this, a
       // bool variable (IdentifierInfoInitialized) is used and the function will
       // be run only once.
-      Guard = &Call.getCalleeAnalysisDeclContext()->getASTContext().Idents.get(
-          GuardName);
-      IdentifierInfoInitialized = true;
+      if (AnalysisDeclContext *CalleCtx = Call.getCalleeAnalysisDeclContext()) {
+        Guard = &CalleCtx->getASTContext().Idents.get(GuardName);
+        IdentifierInfoInitialized = true;
+      }
     }
   }
 

[steakhal]

In CTU there is not always an AnalysisDeclContext for a given call.

Why?

Could you demonstrate the fix in a test?

[gamesh411]

After reducing a crashing TU, I have found, that the issue came up without CTU analysis as well.
I have added a test case that demonstrates the crash without the fix.
I also updated the commit message to reflect the real cause.

[steakhal]

Now the change makes sense. I disagree with the fix though, see inline.

[steakhal]

LGTM, thanks!