Ignore control flow due to NullPointerExceptions in Called Methods Checker

[msridhar]

Fixes #4843

The Called Methods Checker assumes that the checked code is free of NullPointerExceptions (this property should be verified by the Nullness Checker). This PR enhances the Called Methods Checker's type inference to ignore control flow due to NullPointerExceptions, enabling it to verify more code. See #4843 (comment) for more context.

The change is implemented by enhancing the dataflow framework to allow for ignoring exceptional control flow for particular exception types.

We may want to ignore more exception types in the future; we can add that in a follow-up PR.

[kelloggm]

Thanks for this work!

I'm not sure whether we should override the new method in the Called Methods Checker or in the Resource Leak Checker (which is a Called Methods Checker subclass). I would be inclined to override it in the RLC rather than in the CMC as you've done here, since I don't see a pressing need for the CMC to make this assumption (but I think making the assumption in the CMC is sound, so it shouldn't make much of a difference).

I pulled this branch into the branch I've been using to try to resolve the RLC soundness bug related to exceptional exits from destructors, and this dramatically improves the code there. There are a few remaining new FPs that I can't currently explain, but given the error messages look non-sensical I suspect there is a bug in my new code. I can confirm that this change gets rid of most of the new FPs of the kind we discussed before.

Someone else with more knowledge of the dataflow framework should review this PR before it is merged. Maybe @mernst or @smillst?

[msridhar]

I'm not sure whether we should override the new method in the Called Methods Checker or in the Resource Leak Checker (which is a Called Methods Checker subclass). I would be inclined to override it in the RLC rather than in the CMC as you've done here, since I don't see a pressing need for the CMC to make this assumption (but I think making the assumption in the CMC is sound, so it shouldn't make much of a difference).

Fair enough. The main motivation for this change is the RLC, so we can make the change there if desired, to narrow the scope. I'm ok either way, so let's leave it for now and get an opinion from another reviewer.