clang-analyzer-alpha.cplusplus.DeleteWithNonVirtualDtor does not handle indirection through base pointer

[tiagomacarios]

The following code will trigger clang-analyzer-alpha.cplusplus.DeleteWithNonVirtualDtor
https://godbolt.org/z/7jPa8dr5W

#include <cstdio>

struct A {};

struct B : A {
    virtual ~B() { std::puts("B dtor"); }
};

struct C : B {
    ~C() { std::puts("C dtor"); }
};

int main() {
    C* c1 = new C{};
    C* c2 = nullptr;

    A** pp = (A**)&c2; // note: Casting from 'C' to 'A' here
    *pp = c1;

    delete c2; // warning: Destruction of a polymorphic object with no virtual destructor [clang-analyzer-alpha.cplusplus.DeleteWithNonVirtualDtor]
}

[llvmbot]

@llvm/issue-subscribers-clang-static-analyzer

Author: Tiago (tiagomacarios)

The following code will trigger clang-analyzer-alpha.cplusplus.DeleteWithNonVirtualDtor https://godbolt.org/z/7jPa8dr5W ``` #include <cstdio>

struct A {};

struct B : A {
virtual ~B() { std::puts("B dtor"); }
};

struct C : B {
~C() { std::puts("C dtor"); }
};

int main() {
C* c1 = new C{};
C* c2 = nullptr;

A** pp = (A**)&c2; // note: Casting from 'C' to 'A' here
*pp = c1;

delete c2; // warning: Destruction of a polymorphic object with no virtual destructor [clang-analyzer-alpha.cplusplus.DeleteWithNonVirtualDtor]

}

</details>

[steakhal]

Yea, the checker should have checked if the pointer is null and ignore it if its null. I guess, there are other reasons too why this checker is alpha (aka. experimental).

Thanks for the report.

[YehezkelShB]

It isn't null, after *pp = c1, but A** pp = (A**)&c2; seems like UB to me (static_cast<A**>(&c2) doesn't compile here, so this is effectively a reinterpret_cast), thus I won't blame the analyzer