[analyzer] Assertion `!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method"' failed.

[k-arrows]

Reproducer:
https://godbolt.org/z/qx1z51dc6

class A {
public:
  virtual int v();
};

class B : public A {
public:
  int v();
};

class C : public A {
public:
  int v();
};

class D : public B, public C {};

void foo() {
  D d;
  A *pa = (B *)&d;

  int x = pa->v();
}

Backtrace:

clang++: /root/llvm-project/llvm/tools/clang/lib/StaticAnalyzer/Core/CallEvent.cpp:799: virtual clang::ento::RuntimeDefinition clang::ento::CXXInstanceCall::getRuntimeDefinition() const: Assertion `!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics --analyze <source>
1.	<eof> parser at end of file
2.	While analyzing stack: 
	#0 Calling foo()
3.	<source>:22:11: Error evaluating statement
4.	<source>:22:11: Error evaluating statement
 #0 0x000000000403c9d8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x403c9d8)
 #1 0x0000000004039e04 llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4039e04)
 #2 0x0000000003f7e518 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007f3162e42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007f3162e969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x00007f3162e42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007f3162e287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007f3162e2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #8 0x00007f3162e39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #9 0x000000000652badb clang::ento::CXXInstanceCall::getRuntimeDefinition() const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x652badb)
#10 0x000000000652be68 clang::ento::CXXMemberCall::getRuntimeDefinition() const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x652be68)
#11 0x00000000065bf857 clang::ento::ExprEngine::defaultEvalCall(clang::ento::NodeBuilder&, clang::ento::ExplodedNode*, clang::ento::CallEvent const&, clang::ento::EvalCallOptions const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x65bf857)
#12 0x0000000006541756 clang::ento::CheckerManager::runCheckersForEvalCall(clang::ento::ExplodedNodeSet&, clang::ento::ExplodedNodeSet const&, clang::ento::CallEvent const&, clang::ento::ExprEngine&, clang::ento::EvalCallOptions const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6541756)
#13 0x00000000065bc0d2 clang::ento::ExprEngine::evalCall(clang::ento::ExplodedNodeSet&, clang::ento::ExplodedNode*, clang::ento::CallEvent const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x65bc0d2)
#14 0x00000000065bd047 clang::ento::ExprEngine::VisitCallExpr(clang::CallExpr const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x65bd047)
#15 0x00000000065946d1 clang::ento::ExprEngine::Visit(clang::Stmt const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x65946d1)
#16 0x000000000659572d clang::ento::ExprEngine::ProcessStmt(clang::Stmt const*, clang::ento::ExplodedNode*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x659572d)
#17 0x000000000654a47b clang::ento::CoreEngine::HandlePostStmt(clang::CFGBlock const*, unsigned int, clang::ento::ExplodedNode*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x654a47b)
#18 0x000000000654ab68 clang::ento::CoreEngine::dispatchWorkItem(clang::ento::ExplodedNode*, clang::ProgramPoint, clang::ento::WorkListUnit const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x654ab68)
#19 0x000000000654aed1 clang::ento::CoreEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x654aed1)
#20 0x000000000611cc97 (anonymous namespace)::AnalysisConsumer::HandleCode(clang::Decl*, unsigned int, clang::ento::ExprEngine::InliningModes, llvm::DenseSet<clang::Decl const*, llvm::DenseMapInfo<clang::Decl const*, void>>*) AnalysisConsumer.cpp:0:0
#21 0x000000000611e8d6 (anonymous namespace)::AnalysisConsumer::HandleDeclsCallGraph(unsigned int) AnalysisConsumer.cpp:0:0
#22 0x00000000061202e3 (anonymous namespace)::AnalysisConsumer::HandleTranslationUnit(clang::ASTContext&) AnalysisConsumer.cpp:0:0
#23 0x00000000066cba0c clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x66cba0c)
#24 0x0000000004ca6b95 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4ca6b95)
#25 0x0000000004c22d3e clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4c22d3e)
#26 0x0000000004d98bc1 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4d98bc1)
#27 0x0000000000db3c5f cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xdb3c5f)
#28 0x0000000000daa90a ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#29 0x0000000004a186d9 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#30 0x0000000003f7e9b4 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3f7e9b4)
#31 0x0000000004a18cef clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#32 0x00000000049da9ad clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x49da9ad)
#33 0x00000000049dba3e clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x49dba3e)
#34 0x00000000049e3675 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x49e3675)
#35 0x0000000000db0115 clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xdb0115)
#36 0x0000000000c63a44 main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xc63a44)
#37 0x00007f3162e29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#38 0x00007f3162e29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#39 0x0000000000daa3b5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xdaa3b5)
clang++: error: clang frontend command failed with exit code 134 (use -v to see invocation)
Compiler returned: 134

[llvmbot]

@llvm/issue-subscribers-clang-static-analyzer

Author: None (k-arrows)

Reproducer: https://godbolt.org/z/qx1z51dc6 ```cpp class A { public: virtual int v(); };

class B : public A {
public:
int v();
};

class C : public A {
public:
int v();
};

class D : public B, public C {};

void foo() {
D d;
A *pa = (B *)&d;

int x = pa->v();
}

Backtrace:
```console
clang++: /root/llvm-project/llvm/tools/clang/lib/StaticAnalyzer/Core/CallEvent.cpp:799: virtual clang::ento::RuntimeDefinition clang::ento::CXXInstanceCall::getRuntimeDefinition() const: Assertion `!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics --analyze <source>
1.	<eof> parser at end of file
2.	While analyzing stack: 
	#<!-- -->0 Calling foo()
3.	&lt;source&gt;:22:11: Error evaluating statement
4.	&lt;source&gt;:22:11: Error evaluating statement
 #<!-- -->0 0x000000000403c9d8 llvm::sys::PrintStackTrace(llvm::raw_ostream&amp;, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x403c9d8)
 #<!-- -->1 0x0000000004039e04 llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4039e04)
 #<!-- -->2 0x0000000003f7e518 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #<!-- -->3 0x00007f3162e42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #<!-- -->4 0x00007f3162e969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #<!-- -->5 0x00007f3162e42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #<!-- -->6 0x00007f3162e287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #<!-- -->7 0x00007f3162e2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #<!-- -->8 0x00007f3162e39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #<!-- -->9 0x000000000652badb clang::ento::CXXInstanceCall::getRuntimeDefinition() const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x652badb)
#<!-- -->10 0x000000000652be68 clang::ento::CXXMemberCall::getRuntimeDefinition() const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x652be68)
#<!-- -->11 0x00000000065bf857 clang::ento::ExprEngine::defaultEvalCall(clang::ento::NodeBuilder&amp;, clang::ento::ExplodedNode*, clang::ento::CallEvent const&amp;, clang::ento::EvalCallOptions const&amp;) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x65bf857)
#<!-- -->12 0x0000000006541756 clang::ento::CheckerManager::runCheckersForEvalCall(clang::ento::ExplodedNodeSet&amp;, clang::ento::ExplodedNodeSet const&amp;, clang::ento::CallEvent const&amp;, clang::ento::ExprEngine&amp;, clang::ento::EvalCallOptions const&amp;) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6541756)
#<!-- -->13 0x00000000065bc0d2 clang::ento::ExprEngine::evalCall(clang::ento::ExplodedNodeSet&amp;, clang::ento::ExplodedNode*, clang::ento::CallEvent const&amp;) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x65bc0d2)
#<!-- -->14 0x00000000065bd047 clang::ento::ExprEngine::VisitCallExpr(clang::CallExpr const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&amp;) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x65bd047)
#<!-- -->15 0x00000000065946d1 clang::ento::ExprEngine::Visit(clang::Stmt const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&amp;) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x65946d1)
#<!-- -->16 0x000000000659572d clang::ento::ExprEngine::ProcessStmt(clang::Stmt const*, clang::ento::ExplodedNode*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x659572d)
#<!-- -->17 0x000000000654a47b clang::ento::CoreEngine::HandlePostStmt(clang::CFGBlock const*, unsigned int, clang::ento::ExplodedNode*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x654a47b)
#<!-- -->18 0x000000000654ab68 clang::ento::CoreEngine::dispatchWorkItem(clang::ento::ExplodedNode*, clang::ProgramPoint, clang::ento::WorkListUnit const&amp;) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x654ab68)
#<!-- -->19 0x000000000654aed1 clang::ento::CoreEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int, llvm::IntrusiveRefCntPtr&lt;clang::ento::ProgramState const&gt;) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x654aed1)
#<!-- -->20 0x000000000611cc97 (anonymous namespace)::AnalysisConsumer::HandleCode(clang::Decl*, unsigned int, clang::ento::ExprEngine::InliningModes, llvm::DenseSet&lt;clang::Decl const*, llvm::DenseMapInfo&lt;clang::Decl const*, void&gt;&gt;*) AnalysisConsumer.cpp:0:0
#<!-- -->21 0x000000000611e8d6 (anonymous namespace)::AnalysisConsumer::HandleDeclsCallGraph(unsigned int) AnalysisConsumer.cpp:0:0
#<!-- -->22 0x00000000061202e3 (anonymous namespace)::AnalysisConsumer::HandleTranslationUnit(clang::ASTContext&amp;) AnalysisConsumer.cpp:0:0
#<!-- -->23 0x00000000066cba0c clang::ParseAST(clang::Sema&amp;, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x66cba0c)
#<!-- -->24 0x0000000004ca6b95 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4ca6b95)
#<!-- -->25 0x0000000004c22d3e clang::CompilerInstance::ExecuteAction(clang::FrontendAction&amp;) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4c22d3e)
#<!-- -->26 0x0000000004d98bc1 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4d98bc1)
#<!-- -->27 0x0000000000db3c5f cc1_main(llvm::ArrayRef&lt;char const*&gt;, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xdb3c5f)
#<!-- -->28 0x0000000000daa90a ExecuteCC1Tool(llvm::SmallVectorImpl&lt;char const*&gt;&amp;, llvm::ToolContext const&amp;) driver.cpp:0:0
#<!-- -->29 0x0000000004a186d9 void llvm::function_ref&lt;void ()&gt;::callback_fn&lt;clang::driver::CC1Command::Execute(llvm::ArrayRef&lt;std::optional&lt;llvm::StringRef&gt;&gt;, std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt;&gt;*, bool*) const::'lambda'()&gt;(long) Job.cpp:0:0
#<!-- -->30 0x0000000003f7e9b4 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref&lt;void ()&gt;) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3f7e9b4)
#<!-- -->31 0x0000000004a18cef clang::driver::CC1Command::Execute(llvm::ArrayRef&lt;std::optional&lt;llvm::StringRef&gt;&gt;, std::__cxx11::basic_string&lt;char, std::char_traits&lt;char&gt;, std::allocator&lt;char&gt;&gt;*, bool*) const (.part.0) Job.cpp:0:0
#<!-- -->32 0x00000000049da9ad clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&amp;, clang::driver::Command const*&amp;, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x49da9ad)
#<!-- -->33 0x00000000049dba3e clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&amp;, llvm::SmallVectorImpl&lt;std::pair&lt;int, clang::driver::Command const*&gt;&gt;&amp;, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x49dba3e)
#<!-- -->34 0x00000000049e3675 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&amp;, llvm::SmallVectorImpl&lt;std::pair&lt;int, clang::driver::Command const*&gt;&gt;&amp;) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x49e3675)
#<!-- -->35 0x0000000000db0115 clang_main(int, char**, llvm::ToolContext const&amp;) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xdb0115)
#<!-- -->36 0x0000000000c63a44 main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xc63a44)
#<!-- -->37 0x00007f3162e29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#<!-- -->38 0x00007f3162e29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#<!-- -->39 0x0000000000daa3b5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xdaa3b5)
clang++: error: clang frontend command failed with exit code 134 (use -v to see invocation)
Compiler returned: 134

[k-arrows]

Goes back to clang-10.0.0:
https://godbolt.org/z/G5163re6E

[keinflue]

The implementation of CXXInstanceCall::getRuntimeDefinition uses CXXMethodDecl::getCorrespondingMethodInClass to attempt to retrieve the final overrider for a virtual function call. It then asserts that this overrider is found where expected.

This method does only provide a result though if the final overrider is the same for all base class subobjects of the current class type in the most derived type. Generally that is not the case (as here for D when considering A::v) and it matters which base class subobject this refers to (in this case whether it is the B::A or the C::A base class subobject, which will produce different final overriders for A::v in D).

Unfortunately I don't know how to retrieve the information on which subobject of the most derived object this refers to from the analyzer state.

Before clang 10.0.0 it seems that the assertion was not present.

[steakhal]

Thank you for the analysis.
I have patches in the subject reworking this particular function, probably also fixing the crash as a side effect.