Check casts of function names to checked function pointer types.

[dtarditi]

We added new rules to the Checked C specification that allow a function name to be cast from its unchecked function pointer type to the corresponding checked function pointer type, where the two function types are compatible

The support for casting from an unchecked function pointer type to the corresponding checked function pointer type should already be there, but we do need to add tests for that.

We need to implement a separate test that ensures that the source is actually a function name and not just a variable with an unchecked function pointer type.

[dtarditi]

Tests of casts from function names with unchecked pointers to checked function pointer types were added as part of pull request #91. We still need to implement a check in the compiler that the source operand for the cast is actually a function name.

[lenary]

From an email from David:

The main motivation for the work is that C converts values with function types to pointers to function types. By default, these are unchecked pointers to function types. We need some way to create checked pointers to function types. Checked C allows implicit conversions from unchecked pointer types to checked pointer types, so we have a way of doing this in the extension already. However, Checked C relies on determining the actual bounds for the unchecked value. Of course, for function types, there is no bounds and no way to determine “the actual bounds”. We need some check to prevent implicit conversion of an unchecked function pointer value that does not match its declared “bounds” for arguments or the return value to a checked function pointer value. The check is to just to make sure that the actual source of the unchecked function pointer is a function name.

In other words, we want to prevent things like:

int bad_convert(int (*f)(int a)) {
  ptr<int (int)> safe_f = f;
}

If the programmer wants to do that, we want to require an explicit (unsafe) cast, not have this conversion happen implicitly.

[lenary]

So, by staring at some dumped ASTs, we need to do the following:

• check any ImplicitCasts (specifically, Bitcasts)
• if they contain another implicitcast (specifically a function to pointer decay) and that contains a declref to a function, then we're all good. This is really the only kind of assignment that's allowed.
• otherwise, they likely contain an implicitcast (specifically a LValue to RValue cast) and that contains a DeclRef of a ParmVar (or similar, I'm not sure what the ref is like of a local variable), which is explicitly not allowed.

We'll pick this back up when we have a centralized place for doing our bounds checking analysis, which should be in a day or two.