https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110578
--- Comment #1 from GCC Commits <cvs-commit at gcc dot gnu.org> --- The master branch has been updated by Egas Ribeiro <[email protected]>: https://gcc.gnu.org/g:2f72dcc5e6cf444a46ce48364af98adf29d3f722 commit r17-3359-g2f72dcc5e6cf444a46ce48364af98adf29d3f722 Author: Egas Ribeiro <[email protected]> Date: Sun Aug 16 13:43:39 2026 +0100 analyzer: add dynamic_cast support [PR110578] The analyzer doesn't currently understand dynamic_cast calls. This means that the returned object from a call is always opaque, and thus we miss a few classes of bugs such as dereferencing the result of a failed cast. This patch implements a new known_function for dynamic_cast, and sets the result of the callbased on the rules of [expr.dynamic.cast]. The implementation effectively evaluates the results of a dynamic_cast cast call statically, similarly to what cxx_eval_dynamic_cast does in the frontend, but without using frontend methods and trees. It tries to derive the target object from the argumments passed to __dynamic_cast calls by traversing BINFOs based on the rules of [expr.dynamic.cast] and then calculating the relative offsets of the resulting object from the BINFOs we found. get_vtable_from_obj was also added so we can reuse the logic for deriving the vtable from objects added with virtual function support. PR analyzer/110578 gcc/analyzer/ChangeLog: * kf-lang-cp.cc: Include "cgraph.h" and "ipa-utils.h". (struct dyncast_subobject): New struct. (get_type_from_tinfo_arg): New function. (lookup_binfo_at_same_offset): New function. (lookup_subobject_matches): New function. (evaluate_dyncast): New function. (class kf_dynamic_cast): New class. (register_known_functions_lang_cp): Register "__dynamic_cast". * region-model.cc (region_model::get_vtable_from_obj): New function, factored out of... (region_model::get_fndecl_for_virtual_call): ...here. Call it. Update comment. * region-model.h (region_model::get_vtable_from_obj): New decl. gcc/testsuite/ChangeLog: * g++.dg/analyzer/dyncast-1.C: Rewrite to cover [expr.dynamic.cast]/9.1 and /9.2 over public, non-virtual inheritance. * g++.dg/analyzer/dyncast-2.C: New test. * g++.dg/analyzer/dyncast-3.C: New test. * g++.dg/analyzer/dyncast-4.C: New test. * g++.dg/analyzer/dyncast-5.C: New test. Signed-off-by: Egas Ribeiro <[email protected]>
