[Bug analyzer/110578] Support dynamic_cast within the analyzer

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110578

--- Comment #1 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Egas Ribeiro <[email protected]>:

https://gcc.gnu.org/g:2f72dcc5e6cf444a46ce48364af98adf29d3f722

commit r17-3359-g2f72dcc5e6cf444a46ce48364af98adf29d3f722
Author: Egas Ribeiro <[email protected]>
Date:   Sun Aug 16 13:43:39 2026 +0100

    analyzer: add dynamic_cast support [PR110578]

    The analyzer doesn't currently understand dynamic_cast calls. This means
    that the returned object from a call is always opaque, and thus we miss
    a few classes of bugs such as dereferencing the result of a failed cast.

    This patch implements a new known_function for dynamic_cast, and sets
    the result of the callbased on the rules of [expr.dynamic.cast].

    The implementation effectively evaluates the results of a dynamic_cast
    cast call statically, similarly to what cxx_eval_dynamic_cast does in
    the frontend, but without using frontend methods and trees.

    It tries to derive the target object from the argumments passed to
    __dynamic_cast calls by traversing BINFOs based on the rules of
    [expr.dynamic.cast] and then calculating the relative offsets of the
    resulting object from the BINFOs we found.

    get_vtable_from_obj was also added so we can reuse the logic for
    deriving the vtable from objects added with virtual function support.

            PR analyzer/110578

    gcc/analyzer/ChangeLog:

            * kf-lang-cp.cc: Include "cgraph.h" and "ipa-utils.h".
            (struct dyncast_subobject): New struct.
            (get_type_from_tinfo_arg): New function.
            (lookup_binfo_at_same_offset): New function.
            (lookup_subobject_matches): New function.
            (evaluate_dyncast): New function.
            (class kf_dynamic_cast): New class.
            (register_known_functions_lang_cp): Register "__dynamic_cast".
            * region-model.cc (region_model::get_vtable_from_obj): New
function,
            factored out of...
            (region_model::get_fndecl_for_virtual_call): ...here.  Call it.
            Update comment.
            * region-model.h (region_model::get_vtable_from_obj): New decl.

    gcc/testsuite/ChangeLog:

            * g++.dg/analyzer/dyncast-1.C: Rewrite to cover
            [expr.dynamic.cast]/9.1 and /9.2 over public, non-virtual
            inheritance.
            * g++.dg/analyzer/dyncast-2.C: New test.
            * g++.dg/analyzer/dyncast-3.C: New test.
            * g++.dg/analyzer/dyncast-4.C: New test.
            * g++.dg/analyzer/dyncast-5.C: New test.

    Signed-off-by: Egas Ribeiro <[email protected]>