[clang] [analyzer] Suppress optin.cplusplus.VirtualCall warnings in system headers (PR #184183)

[Tarun Thammisetty via cfe-commits]

https://github.com/tarun-t updated https://github.com/llvm/llvm-project/pull/184183

>From fc65de11aba774f70327841a3852539227f82000 Mon Sep 17 00:00:00 2001
From: tarun <thammisettytarun at gmail.com>
Date: Mon, 2 Mar 2026 22:55:40 +0530
Subject: [PATCH 1/3] [analyzer] Suppress VirtualCall warnings in system
 headers

The optin.cplusplus.VirtualCall checker reports warnings for virtual
method calls during construction/destruction even when the call site
is in a system header (included via -isystem). Users cannot fix such
code and must resort to NOLINT suppressions.

Add a system header check in checkPreCall before emitting the report,
consistent with how other checkers (e.g. MallocChecker) handle this.
---
 .../StaticAnalyzer/Checkers/VirtualCallChecker.cpp    |  5 +++++
 .../test/Analysis/Inputs/virtualcall-system-header.h  | 11 +++++++++++
 clang/test/Analysis/virtualcall.cpp                   |  6 ++++++
 3 files changed, 22 insertions(+)
 create mode 100644 clang/test/Analysis/Inputs/virtualcall-system-header.h

diff --git a/clang/lib/StaticAnalyzer/Checkers/VirtualCallChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/VirtualCallChecker.cpp
index 6c27f58d308aa..160fc2596e485 100644
--- a/clang/lib/StaticAnalyzer/Checkers/VirtualCallChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/VirtualCallChecker.cpp
@@ -118,6 +118,11 @@ void VirtualCallChecker::checkPreCall(const CallEvent &Call,
   if (!isVirtualCall(CE))
     return;
 
+  // Don't warn about virtual calls in system headers (e.g. libraries included
+  // via -isystem), as the user has no control over such code.
+  if (C.getSourceManager().isInSystemHeader(CE->getBeginLoc()))
+    return;
+
   const MemRegion *Reg = MC->getCXXThisVal().getAsRegion();
   const ObjectState *ObState = State->get<CtorDtorMap>(Reg);
   if (!ObState)
diff --git a/clang/test/Analysis/Inputs/virtualcall-system-header.h b/clang/test/Analysis/Inputs/virtualcall-system-header.h
new file mode 100644
index 0000000000000..2cdde63677364
--- /dev/null
+++ b/clang/test/Analysis/Inputs/virtualcall-system-header.h
@@ -0,0 +1,11 @@
+#pragma clang system_header
+
+struct SysBase {
+  virtual void shutdown() = 0;
+  virtual ~SysBase() = default;
+};
+
+struct SysService : SysBase {
+  void shutdown() override {}
+  ~SysService() override { shutdown(); } // no-warning
+};
diff --git a/clang/test/Analysis/virtualcall.cpp b/clang/test/Analysis/virtualcall.cpp
index 82285b6d12844..e403d6ddfc181 100644
--- a/clang/test/Analysis/virtualcall.cpp
+++ b/clang/test/Analysis/virtualcall.cpp
@@ -11,7 +11,13 @@
 // RUN:                    -analyzer-checker=debug.ExprInspection \
 // RUN:                    -std=c++11 -verify=pure,impure -std=c++11 %s
 
+// Verify no warnings for virtual calls in system headers.
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,optin.cplusplus.VirtualCall \
+// RUN:                    -std=c++11 -verify=system %s
+// system-no-diagnostics
+
 #include "virtualcall.h"
+#include "Inputs/virtualcall-system-header.h"
 
 void clang_analyzer_warnIfReached();
 

>From ebb260e2a6ec8d9fdbf4bf5100ca1e28f22dc3ad Mon Sep 17 00:00:00 2001
From: tarun <thammisettytarun at gmail.com>
Date: Wed, 4 Mar 2026 17:19:49 +0530
Subject: [PATCH 2/3] fix: add impure verify prefix to system header test RUN
 line

The 4th RUN line enables optin.cplusplus.VirtualCall but only
recognizes the 'system' verify prefix. The checker still fires on
non-system-header code annotated with 'impure-warning', causing
11 unexpected diagnostic errors. Adding 'impure' to the verify
prefix list lets those annotations match.
---
 clang/test/Analysis/virtualcall.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang/test/Analysis/virtualcall.cpp b/clang/test/Analysis/virtualcall.cpp
index e403d6ddfc181..bb0ebe56de1c4 100644
--- a/clang/test/Analysis/virtualcall.cpp
+++ b/clang/test/Analysis/virtualcall.cpp
@@ -13,7 +13,7 @@
 
 // Verify no warnings for virtual calls in system headers.
 // RUN: %clang_analyze_cc1 -analyzer-checker=core,optin.cplusplus.VirtualCall \
-// RUN:                    -std=c++11 -verify=system %s
+// RUN:                    -std=c++11 -verify=system,impure %s
 // system-no-diagnostics
 
 #include "virtualcall.h"

>From 20bffaa9d82f05d05db919cf6aef0c2b555e25e7 Mon Sep 17 00:00:00 2001
From: tarun <thammisettytarun at gmail.com>
Date: Wed, 4 Mar 2026 18:00:04 +0530
Subject: [PATCH 3/3] fix: remove system-no-diagnostics conflicting with
 impure-warning directives

---
 clang/test/Analysis/virtualcall.cpp | 1 -
 1 file changed, 1 deletion(-)

diff --git a/clang/test/Analysis/virtualcall.cpp b/clang/test/Analysis/virtualcall.cpp
index bb0ebe56de1c4..ebbfe3c1f9d90 100644
--- a/clang/test/Analysis/virtualcall.cpp
+++ b/clang/test/Analysis/virtualcall.cpp
@@ -14,7 +14,6 @@
 // Verify no warnings for virtual calls in system headers.
 // RUN: %clang_analyze_cc1 -analyzer-checker=core,optin.cplusplus.VirtualCall \
 // RUN:                    -std=c++11 -verify=system,impure %s
-// system-no-diagnostics
 
 #include "virtualcall.h"
 #include "Inputs/virtualcall-system-header.h"