[clang] [analyzer] Trust base to derived casts for dynamic types (PR #69057)

[via cfe-commits]

================
@@ -392,19 +393,26 @@ void DynamicTypePropagation::checkPostCall(const CallEvent &Call,
   }
 }
 
-/// TODO: Handle explicit casts.
-///       Handle C++ casts.
-///
-/// Precondition: the cast is between ObjCObjectPointers.
 ExplodedNode *DynamicTypePropagation::dynamicTypePropagationOnCasts(
     const CastExpr *CE, ProgramStateRef &State, CheckerContext &C) const {
   // We only track type info for regions.
   const MemRegion *ToR = C.getSVal(CE).getAsRegion();
   if (!ToR)
     return C.getPredecessor();
 
-  if (isa<ExplicitCastExpr>(CE))
+  if (CE->getCastKind() == CK_BaseToDerived) {
+    bool CastSucceeds = true;
----------------
DonatNagyE wrote:

Based on a rough intuition I feel that it's suspicious that here the code blindly assumes that the cast succeeds instead of checking the previously collected knowledge and somehow reporting an error if the cast contradicts it.

However I don't understand the exact details, so this might be the correct heuristic depending on other factors.

https://github.com/llvm/llvm-project/pull/69057