Re: [PATCH v2 2/2] analyzer: add dynamic_cast support [PR110578]

On Mon Aug 17, 2026 at 11:35 PM WEST, David Malcolm wrote:
> On Sun, 2026-08-16 at 20:24 +0100, Egas Ribeiro wrote:
>
> Hi Egas
>
> Thanks for the updated patch.
>
> I spent some time today stepping through the code to get a sense for
> how it works, and I think I understand it now, and the places where
> you've been able to (re)use helper subroutines from ipa-devirt.cc
>
> This patch is OK for trunk.  Please push, assuming you've done your
> usual testing.
>
> One issue I noticed: I think we need a kf_cxa_bad_cast to handle
> __cxa_bad_cast.  Right now, for dyncast-5.C the patch emits:
>
> ../../src/gcc/testsuite/g++.dg/analyzer/dyncast-5.C: In function ‘void
> test_ref_success()’:
> ../../src/gcc/testsuite/g++.dg/analyzer/dyncast-5.C:14:19: warning: TRUE
>    14 |   __analyzer_eval (b.m == 3);   /* { dg-warning "TRUE" } */
>       |   ~~~~~~~~~~~~~~~~^~~~~~~~~~
> ../../src/gcc/testsuite/g++.dg/analyzer/dyncast-5.C: In function ‘void test_ref_failure()’:
> ../../src/gcc/testsuite/g++.dg/analyzer/dyncast-5.C:28:28: note: path
>    28 |       __analyzer_dump_path ();  /* { dg-message "path" } */
>       |       ~~~~~~~~~~~~~~~~~~~~~^~
>   ‘void test_ref_failure()’: event 1
>    22 |       B &b = dynamic_cast<B &> (a);
>       |                                  ^
>       |                                  |
>       |                                  (1) following ‘false’ branch... ─>─┐
>       |                                                                     │
>   ‘void test_ref_failure()’: events 2-5
>       |                                                                     │
>       |┌────────────────────────────────────────────────────────────────────┘
>    22 |│      B &b = dynamic_cast<B &> (a);
>       |│                                 ^
>       |│                                 |
>       |└────────────────────────────────>(2) ...to here
>       |                                  (3) if ‘void __cxa_bad_cast()’ throws an exception...
> ......
>    26 |   catch (std::bad_cast &)
>       |                        ~          
>       |                        |
>       |                        (4) ...catching exception here
>    27 |     {
>    28 |       __analyzer_dump_path ();  /* { dg-message "path" } */
>       |       ~~~~~~~~~~~~~~~~~~~~~~~     
>       |                            |
>       |                            (5) ⚠️  here
>
> Note how in the failure path, it looks like we're considering
> __cxa_bad_cast as an unknown function that could throw an exception,
> whereas we probably want to treat it as a known function that always
> throws a bad_cast exception, as per
> https://itanium-cxx-abi.github.io/cxx-abi/abi-eh.html#cxx-aux
>
> But this can be done as followup work on top of these patches.
>
> Thanks again; this is great work.
> Dave
>

I did notice that, initally I had wondered whether we would later need a
kf_cxa_bad_cast or not while implementing reference tests.  Once I
finish my final report for GSoC and so on, I'll work on a patch for this
as well.

Egas