[RF][HS3] Fix unsafe downcasts in importers

- Drop the pointless static_cast<RooSimultaneous*> around workspace.pdf()
  in importAnalysis: the result is stored as RooAbsPdf* anyway, and the
  cast is undefined behaviour when the pdf is not a RooSimultaneous.
- Use dynamic_cast with a null check instead of an unchecked cast + deref
  in importDecay (resolutionModel) and importBinWidthFunction (histogram),
  so malformed input raises a clear error instead of crashing.

Author: guitargeek

roofit/hs3/src/JSONFactories_RooFitCore.cxx

@@ -232,7 +232,10 @@ template <bool DivideByBinWidth>
 bool importBinWidthFunction(RooJSONFactoryWSTool *tool, const JSONNode &p)
 {
    std::string name(RooJSONFactoryWSTool::name(p));
-   RooHistFunc *hf = static_cast<RooHistFunc *>(tool->request<RooAbsReal>(p["histogram"].val(), name));
+   RooHistFunc *hf = dynamic_cast<RooHistFunc *>(tool->request<RooAbsReal>(p["histogram"].val(), name));
+   if (!hf) {
+      RooJSONFactoryWSTool::error("histogram '" + p["histogram"].val() + "' of '" + name + "' is not a RooHistFunc");
+   }
    tool->wsEmplace<RooBinWidthFunction>(name, *hf, DivideByBinWidth);
    return true;
 }
@@ -325,6 +328,9 @@ bool importDecay(RooJSONFactoryWSTool *tool, const JSONNode &p)
    RooRealVar *t = tool->requestArg<RooRealVar>(p, "t");
    RooAbsReal *tau = tool->requestArg<RooAbsReal>(p, "tau");
    RooResolutionModel *model = dynamic_cast<RooResolutionModel *>(tool->requestArg<RooAbsPdf>(p, "resolutionModel"));
+   if (!model) {
+      RooJSONFactoryWSTool::error("resolutionModel of '" + name + "' is not a RooResolutionModel");
+   }
    RooDecay::DecayType decayType = static_cast<RooDecay::DecayType>(p["decayType"].val_int());
    tool->wsEmplace<RooDecay>(name, *t, *tau, *model, decayType);
    return true;

roofit/hs3/src/RooJSONFactoryWSTool.cxx

@@ -667,7 +667,7 @@ void importAnalysis(const JSONNode &rootnode, const JSONNode &analysisNode, cons
    JSONNode const *pdfNameNode = mcAuxNode ? mcAuxNode->find("pdfName") : nullptr;
    std::string const pdfName = pdfNameNode ? pdfNameNode->val() : "simPdf";
 
-   RooAbsPdf *pdf = static_cast<RooSimultaneous *>(workspace.pdf(pdfName));
+   RooAbsPdf *pdf = workspace.pdf(pdfName);
 
    if (!pdf) {
       // if there is no simultaneous pdf, we can check whether there is only one pdf in the list
@@ -686,7 +686,7 @@ void importAnalysis(const JSONNode &rootnode, const JSONNode &analysisNode, cons
          }
          RooSimultaneous simPdf{simPdfName.c_str(), simPdfName.c_str(), pdfMap, indexCat};
          workspace.import(simPdf, RooFit::RecycleConflictNodes(true), RooFit::Silence(true));
-         pdf = static_cast<RooSimultaneous *>(workspace.pdf(simPdfName));
+         pdf = workspace.pdf(simPdfName);
       }
    }