[analyzer] Retrieve a character from StringLiteral as an initializer for constant arrays.

[ASDenysPetrov]

Summary

Assuming that values of constant arrays never change, we can retrieve values for specific position(index) right from the initializer, if presented. Retrieve a character code by index from StringLiteral which is an initializer of constant arrays in global scope.

This patch has a known issue of getting access to characters past the end of the literal. The declaration, in which the literal is used, is an implicit cast of kind array-to-pointer. The offset should be in literal length's bounds. This should be distinguished from the states in the Standard C++20 (dcl.init.string) 9.4.2.3.
Example:

const char arr[42] = "123";
char c = arr[41]; // OK
const char * const str = "123";
char c = str[41]; // NOK

[ASDenysPetrov]

TODO: add regression tests.

[vsavchenko]

That looks interesting!
Can you please add tests, though?

[ASDenysPetrov]

In D107339#2921896, @vsavchenko wrote:

That looks interesting!
Can you please add tests, though?

Yes, I'll add them soon.

[ASDenysPetrov]

Added tests.

[ASDenysPetrov]

Rebased.

[ASDenysPetrov]

Adjusted the patch according to changes in the parent revision D104285.

[steakhal]

Looks great.

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1640–1644

This seems like a huge hack. Do we really need this? I think we should account for this case at the initialization of the mentioned array...
Leave it as-is right now, but eh, ugly.

1645

You could use the uint64_t type here, and spare the subsequent explicit cast. This operation would be safe since Idx must be non-negative here.

1807–1808

So, your patch is NFC except for this part, which applies the very same logic for global initializers.
Am'I right?

clang/test/Analysis/initialization.cpp

138

Ah, it's somewhat confusing.
At first, when I looked at it, I assumed that this array has 6 elements as its name suggests.
But it has actually 5 elements.

162–163

You could inline the -42 without changing any expected behavior.
It would make the test terser IMO. The same applies to the other case.

166–172

I'm not sure if I follow. The TODO implies to me that this case is about multidimensional arrays, but it's actually not.
glob_arr6 is of type const char[5]
Could you clarify this?
BTW, at first glance, the gist of this case is the same as the glob_invalid_index7.
Why does this behave differently? I'm puzzled.

[ASDenysPetrov]

Rebased.

[martong]

@ASDenysPetrov This looks promising! Please address the nits which @steakhal found, than I think it is good to land.

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1645

+1 for using uint64_t if possible

[ASDenysPetrov]

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1645

SL->getCodeUnit returns uint32_t, so I decided to keep the result value consistent if any changes required in the future.

[ASDenysPetrov]

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1645

Oh. discard my previous reply. I mistakenly considered a wrong line.
The correct reply:
As you can see, preceding condition (Idx < 0) guarantee Idx to be non-negative. But if you suggest this to be explicitly visible, then OK, I don't mind. I've just kept it int64_t for consistency with return value as well.

[ASDenysPetrov]

clang/test/Analysis/initialization.cpp

138

6 in glob_arr6 is like a serial number. Means that there are glob_arr5 and glob_arr4 and so for above.

162–163

glob_arr6[-42] this provokes AST parser to emit a warning before reaching to CSA checks. Separate variable allows to avoid AST parser checks to let CSA be engaged.

166–172

Correct. Thanks! The consequence of copy-paste. I'll fix.

[ASDenysPetrov]

Updated according to suggestions.

[martong]

I am close to accepting this. However, D111542 should be its parent patch. I think similar issues could arise here as well, so, redecl chain tests would be really beneficial.

[ASDenysPetrov]

In D107339#3060812, @martong wrote:

I am close to accepting this. However, D111542 should be its parent patch. I think similar issues could arise here as well, so, redecl chain tests would be really beneficial.

I apologize for the delay, I'm still working on changes. I'll update it soon.

[steakhal]

Why does glob_invalid_index7() and glob_invalid_index8() differ in behavior?
I would expect that the analyzer produces the same Loc symbolic value for both cases thus, the array access should result in the same behavior regardless if glob_arr6 is used, or acquired a pointer and using that in a subsequent operation.
Could you elaborate on this?

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1646

Instead of this comment, you can put an assert(Idx.isStrictlyPositive()) here.

[ASDenysPetrov]

Rebased. Improved behavior to make glob_invalid_index8 case passed and some other cases. Added more tests. Added tests for universal characters.

[ASDenysPetrov]

In D107339#3075306, @steakhal wrote:

Why does glob_invalid_index7() and glob_invalid_index8() differ in behavior?
I would expect that the analyzer produces the same Loc symbolic value for both cases thus, the array access should result in the same behavior regardless if glob_arr6 is used, or acquired a pointer and using that in a subsequent operation.
Could you elaborate on this?

You're right about the same Loc. There were just limitations of the previous implementation. I've fixed it.

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1646

I reworked this case and we don't need it anymore.

[ASDenysPetrov]

@martong

I am close to accepting this. However, D111542 should be its parent patch. I think similar issues could arise here as well, so, redecl chain tests would be really beneficial.

I think I'm done. You can proceed the review.

[martong]

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1711–1716

I am wondering why this hunk is needed? getSValFromInitListExpr is handling this case at L1725, isn't it?

[ASDenysPetrov]

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1711–1716

L1710 handles const char x[] = "abc";
L1725 handles const char x[] = {"abc"};
I think I should give an example in comments.

[martong]

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1711–1716

Okay, thanks for the explanation.

I think I should give an example in comments.

Yes, that's a good idea!

[ASDenysPetrov]

Fixed test unpassing in array-struct-region.c. Added examples in comments according to suggestions.

[martong]

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1758–1761

Thanks for updating the patch! However, this FIXME makes me worried. Do you think you could pass the Decl itself to getSValFromInitListExpr in order to be able to check whether the type is a pointer or an array?

[ASDenysPetrov]

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1758–1761

This worried me as well. Currently I can't find a way to get the Decl for SL.

[ASDenysPetrov]

@martong (inline)

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1758–1761

We can load this as is for now with mentioning the known issue.

[martong]

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1758–1761

This might cause some itchy false positives. Perhaps, we could address this in a follow-up patch and then commit them together?

[steakhal]

It looks good to me. I don't mind that FIXME. That being said, I'm not even sure it's a FIXME.
Check my comment inline about this.

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1758–1761

Currently I can't find a way to get the Decl for SL.

Why do you need a Decl? The SVal's gotta be an Element{"123",41 S64b,char} for the example in the comment (*).

(*) With a minor modification: https://godbolt.org/z/7zhGMnf7P

template <class T> void clang_analyzer_dump(T);
const char * const str = "123";
const char * str2 = "123";
void top() {
  clang_analyzer_dump(&str[41]);  // &Element{"123",41 S64b,char}
  clang_analyzer_dump(&str2[41]); // &Element{SymRegion{reg_$0<const char * str2>},41 S64b,char}
}

1803–1805

I think it would be better to have the check before we calculate the Offset. At least that way I find it easier to follow.

[ASDenysPetrov]

I'm gonna add docs to getSValFromStringLiteral and update the patch. And of course will fix your nits.

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1758–1761

Because only Decl can tell us whether it is a const char str[42] or const char * const str. We can't say anything just looking at SVal.

1758–1761

This might cause some itchy false positives. Perhaps, we could address this in a follow-up patch and then commit them together?

This will produce not more FP as before, even less. I didn't change the behavior specifically here. I just found the issue point to it.

1803–1805

Yes, it's just my omission.

[ASDenysPetrov]

Added doc comment to getSValFromStringLiteral function.
Fixed minor code defects.

[steakhal]

I'm still worried about regressions.
Please split the patch into two by separating the tests into an NFC patch, on which you would apply the behavioral change.
That way it would be clear what and why changed. It would also help us to see what previously had defects you plan to preserve and annotate with FIXMEs.

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1758–1761

I probably still miss the point. https://godbolt.org/z/EMhbq3745
Since the case you mention is actually represented by a NonParamVarRegion which holds a pointer to its decl.

const char str3[43] = "123";
void top() {
  clang_analyzer_dump(&str3[41]); // &Element{str3,41 S64b,char}
  //                    NonParamVarRegion  ---^^^^ (it can print the name of the *decl*)
}

---

What I wanted to highlight is, that it's a non-issue. In your example you had a non-const global variable, thus we could not infer any meaningful initial value for it, and that is actually the expected behavior. As soon as I marked the str pointer const (along with its pointee), suddenly the analyzer can infer its initial value.

[martong]

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1758–1761

But @steakhal, we have this case in the test file with a FIXME that is not aligned with your observation.

char const *const glob_ptr8 = "123";
void glob_ptr_index4() {
  clang_analyzer_eval(glob_ptr8[0] == '1');  // expected-warning{{TRUE}}
  clang_analyzer_eval(glob_ptr8[1] == '2');  // expected-warning{{TRUE}}
  clang_analyzer_eval(glob_ptr8[2] == '3');  // expected-warning{{TRUE}}
  clang_analyzer_eval(glob_ptr8[3] == '\0'); // expected-warning{{TRUE}}
  // FIXME: Should be UNDEFINED.
  // We should take into account a declaration in which the literal is used.
  clang_analyzer_eval(glob_ptr8[4] == '\0'); // expected-warning{{TRUE}}
}

1758–1761

This might cause some itchy false positives. Perhaps, we could address this in a follow-up patch and then commit them together?

This will produce not more FP as before, even less. I didn't change the behavior specifically here. I just found the issue point to it.

Would it be a FP introduced by this patch? Or we would report the "bug" in the baseline too?

char const *const glob_ptr8 = "123";
int glob_ptr_index4(int x) {
  return x/glob_ptr8[4]; // Div by zero 
}

Actually, we should report "accessing garbage or undefined" instead of div zero.

[steakhal]

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1758–1761

Actually, separating the tests into a parent patch would highlight these differences.

[ASDenysPetrov]

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

1758–1761

In your example you had a non-const global variable

Yes, because my example is about offsets and const-ness has no meaning in it. It was omitted for lower verbosity.

What I wanted to highlight is, that it's a non-issue.

@martong is right. Please, pay attention to the NOTE. It says that there is no problem with the array declration, but it is with the pointer one. We can't get a Decl from StringRegion: https://godbolt.org/z/hhvasM8dh

const char * const str = "123";
void top() {
  clang_analyzer_dump(&str[41]);  // &Element{"123",41 S64b,char}
                                  // StringRegion^
}

Would it be a FP introduced by this patch? Or we would report the "bug" in the baseline too?
Actually, we should report "accessing garbage or undefined" instead of div zero.

Yes, It should warn "accessing garbage or undefined". The problem exists right now in the baseline: https://godbolt.org/z/6Exejd149
As I said I didn't change the behavior here. The root of the problem is the same as I described above. FP will still be presented after the patch. I just found and pointed to the particular bug.

Actually, separating the tests into a parent patch would highlight these differences.

I don't see strong reasons for splitting the patch after you get the point. The solution is quite coherent, so I prefer not to do so.

Lastly, I update the comment in the NOTE to make it clearer.

[steakhal]

There is no need to do anything with this. You can commit as-is.
I've done it myself, and it seems like your patch only turns TRUE for the cases where it was UNKNOWN or FALSE previously.
So these test cases were changed by your test, and the rest of them were preserved in your patch:
glob_array_index5(), glob_ptr_index3(), glob_array_index6(), glob_ptr_index5(), glob_ptr_index6(), glob_ptr_index7()

Next time I would rather have two patches, one of which adds tests to document the existing behavior and a follow-up changing the behavior.

[ASDenysPetrov]

Updated comments briefly explaining the root of the existing issue.

Thanks, @steakhal and @martong. I appreciate your efforts!

[ASDenysPetrov]

In D107339#3093207, @steakhal wrote:

Next time I would rather have two patches, one of which adds tests to document the existing behavior and a follow-up changing the behavior.

It makes sense. I will take this into account with the following changes.

[martong]

Nice work! Thanks!

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

bool scanReachableSymbols(Store S, const MemRegion *R,
                             ScanReachableSymbols &Callbacks) override;
 
   RegionBindingsRef removeSubRegionBindings(RegionBindingsConstRef B,
                                             const SubRegion *R);
   Optional<SVal> getConstantValFromConstArrayInitializer(
       RegionBindingsConstRef B, const VarRegion *VR, const ElementRegion *R);
   Optional<SVal> getSValFromInitListExpr(const InitListExpr *ILE,
                                          uint64_t Offset, QualType ElemT);
+  SVal getSValFromStringLiteral(const StringLiteral *SL, uint64_t Offset,
+                                QualType ElemT);
 
 public: // Part of public interface to class.
 
   StoreRef Bind(Store store, Loc LV, SVal V) override {
     return StoreRef(bind(getRegionBindings(store), LV, V).asStore(), *this);
   }
 
   RegionBindingsRef bind(RegionBindingsConstRef B, Loc LV, SVal V);

 }
 
 Optional<SVal> RegionStoreManager::getConstantValFromConstArrayInitializer(
     RegionBindingsConstRef B, const VarRegion *VR, const ElementRegion *R) {
   assert(R && VR && "Regions should not be null");
 
   // Check if the containing array has an initialized value that we can trust.
   // We can trust a const value or a value of a global initializer in main().
   const VarDecl *VD = VR->getDecl();
   if (!VD->getType().isConstQualified() &&
       !R->getElementType().isConstQualified() &&
       (!B.isMainAnalysis() || !VD->hasGlobalStorage()))
     return None;
 
   // Array's declaration should have `ConstantArrayType` type, because only this
   // type contains an array extent. It may happen that array type can be of
   // `IncompleteArrayType` type. To get the declaration of `ConstantArrayType`
   // type, we should find the declaration in the redeclarations chain that has
   // the initialization expression.
   // NOTE: `getAnyInitializer` has an out-parameter, which returns a new `VD`
   // from which an initializer is obtained. We replace current `VD` with the new
   // `VD`. If the return value of the function is null than `VD` won't be
   // replaced.
Optional<SVal> RegionStoreManager::getConstantValFromConstArrayInitializer(
   const uint64_t Extent = CAT->getSize().getZExtValue();
   // Check for `OffsetInt < 0` but NOT for `Offset < 0`, because `OffsetInt`
   // CAN be negative, but `Offset` can NOT, because `Offset` is an uint64_t.
   if (OffsetInt < 0 || Offset >= Extent)
     return UndefinedVal();
   // From here `Offset` is in the bounds.
 
   // Handle InitListExpr.
+  // Example:
+  //   const char arr[] = { 1, 2, 3 };
   if (const auto *ILE = dyn_cast<InitListExpr>(Init))
     return getSValFromInitListExpr(ILE, Offset, R->getElementType());
 
-  // FIXME: Handle StringLiteral.
+  // Handle StringLiteral.
+  // Example:
+  //   const char arr[] = "abc";
+  if (const auto *SL = dyn_cast<StringLiteral>(Init))
+    return getSValFromStringLiteral(SL, Offset, R->getElementType());
 
   // FIXME: Handle CompoundLiteralExpr.
 
   return None;
 }
 
 Optional<SVal>
 RegionStoreManager::getSValFromInitListExpr(const InitListExpr *ILE,
                                             uint64_t Offset, QualType ElemT) {
   assert(ILE && "InitListExpr should not be null");
 
+  // C++20 [dcl.init.string] 9.4.2.1:
+  //   An array of ordinary character type [...] can be initialized by [...]
+  //   an appropriately-typed string-literal enclosed in braces.
+  // Example:
+  //   const char arr[] = { "abc" };
+  if (ILE->isStringLiteralInit())
+    if (const auto *SL = dyn_cast<StringLiteral>(ILE->getInit(0)))
+      return getSValFromStringLiteral(SL, Offset, ElemT);
+
   // C++20 [expr.add] 9.4.17.5 (excerpt):
   //   i-th array element is value-initialized for each k < i ≤ n,
   //   where k is an expression-list size and n is an array extent.
   if (Offset >= ILE->getNumInits())
     return svalBuilder.makeZeroVal(ElemT);
 
   // Return a constant value, if it is presented.
   // FIXME: Support other SVals.
   const Expr *E = ILE->getInit(Offset);
   return svalBuilder.getConstantVal(E);
 }
 
+/// Returns an SVal, if possible, for the specified position in a string
+/// literal.
+///
+/// \param SL The given string literal.
+/// \param Offset The unsigned offset. E.g. for the expression
+///   `char x = str[42];` an offset should be 42.
+///   E.g. for the string "abc" offset:
+///   - 1 returns SVal{b}, because it's the second position in the string.
+///   - 42 returns SVal{0}, because there's no explicit value at this
+///     position in the string.
+/// \param ElemT The type of the result SVal expression.
+///
+/// NOTE: We return `0` for every offset >= the literal length for array
+/// declarations, like:
+///   const char str[42] = "123"; // Literal length is 4.
+///   char c = str[41];           // Offset is 41.
+/// FIXME: Nevertheless, we can't do the same for pointer declaraions, like:
+///   const char * const str = "123"; // Literal length is 4.
+///   char c = str[41];               // Offset is 41. Returns `0`, but Undef
+///                                   // expected.
+/// It should be properly handled before reaching this point.
+/// The main problem is that we can't distinguish between these declarations,
+/// because in case of array we can get the Decl from VarRegion, but in case
+/// of pointer the region is a StringRegion, which doesn't contain a Decl.
+/// Possible solution could be passing an array extent along with the offset.
+SVal RegionStoreManager::getSValFromStringLiteral(const StringLiteral *SL,
+                                                  uint64_t Offset,
+                                                  QualType ElemT) {
+  assert(SL && "StringLiteral should not be null");
+  // C++20 [dcl.init.string] 9.4.2.3:
+  //   If there are fewer initializers than there are array elements, each
+  //   element not explicitly initialized shall be zero-initialized [dcl.init].
+  uint32_t Code = (Offset >= SL->getLength()) ? 0 : SL->getCodeUnit(Offset);
+  return svalBuilder.makeIntVal(Code, ElemT);
+}
+
 SVal RegionStoreManager::getBindingForElement(RegionBindingsConstRef B,
                                               const ElementRegion* R) {
   // Check if the region has a binding.
   if (const Optional<SVal> &V = B.getDirectBinding(R))
     return *V;
 
   const MemRegion* superR = R->getSuperRegion();
 
   // Check if the region is an element region of a string literal.
   if (const StringRegion *StrR = dyn_cast<StringRegion>(superR)) {
     // FIXME: Handle loads from strings where the literal is treated as
-    // an integer, e.g., *((unsigned int*)"hello")
+    // an integer, e.g., *((unsigned int*)"hello"). Such loads are UB according
+    // to C++20 7.2.1.11 [basic.lval].
     QualType T = Ctx.getAsArrayType(StrR->getValueType())->getElementType();
     if (!Ctx.hasSameUnqualifiedType(T, R->getElementType()))
       return UnknownVal();
-
-    const StringLiteral *Str = StrR->getStringLiteral();
-    SVal Idx = R->getIndex();
-    if (Optional<nonloc::ConcreteInt> CI = Idx.getAs<nonloc::ConcreteInt>()) {
-      int64_t i = CI->getValue().getSExtValue();
-      // Abort on string underrun.  This can be possible by arbitrary
-      // clients of getBindingForElement().
-      if (i < 0)
+    if (const auto CI = R->getIndex().getAs<nonloc::ConcreteInt>()) {
+      const llvm::APSInt &Idx = CI->getValue();
+      if (Idx < 0)
         return UndefinedVal();
-      int64_t length = Str->getLength();
-      // Technically, only i == length is guaranteed to be null.
-      // However, such overflows should be caught before reaching this point;
-      // the only time such an access would be made is if a string literal was
-      // used to initialize a larger array.
-      char c = (i >= length) ? '\0' : Str->getCodeUnit(i);
-      return svalBuilder.makeIntVal(c, T);
+      const StringLiteral *SL = StrR->getStringLiteral();
+      return getSValFromStringLiteral(SL, Idx.getZExtValue(), T);
     }
   } else if (const VarRegion *VR = dyn_cast<VarRegion>(superR)) {
     if (Optional<SVal> V = getConstantValFromConstArrayInitializer(B, VR, R))
       return *V;
   }
 
   // Check for loads from a code text region.  For such loads, just give up.
   if (isa<CodeTextRegion>(superR))
     return UnknownVal();
 
   // Handle the case where we are indexing into a larger scalar object.

clang/test/Analysis/initialization.cpp

 // TODO: Support multidimensional array.
 void glob_invalid_index6() {
   int const *ptr = &glob_arr5[1][0];
   int idx = 42;
   // FIXME: Should warn {{garbage or undefined}}.
   auto x = ptr[idx]; // // no-warning
 }
 
 extern const int glob_arr_no_init[10];
 void glob_array_index4() {
   clang_analyzer_eval(glob_arr_no_init[2]); // expected-warning{{UNKNOWN}}
 }
 
 struct S2 {
   static const int arr_no_init[10];
 };
 void struct_arr_index1() {
   clang_analyzer_eval(S2::arr_no_init[2]); // expected-warning{{UNKNOWN}}
 }
+
+char const glob_arr6[5] = "123";
+void glob_array_index5() {
+  clang_analyzer_eval(glob_arr6[0] == '1');  // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr6[1] == '2');  // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr6[2] == '3');  // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr6[3] == '\0'); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr6[4] == '\0'); // expected-warning{{TRUE}}
+}
+
+void glob_ptr_index3() {
+  char const *ptr = glob_arr6;
+  clang_analyzer_eval(ptr[-42] == '\0'); // expected-warning{{UNDEFINED}}
+  clang_analyzer_eval(ptr[0] == '1');    // expected-warning{{TRUE}}
+  clang_analyzer_eval(ptr[1] == '2');    // expected-warning{{TRUE}}
+  clang_analyzer_eval(ptr[2] == '3');    // expected-warning{{TRUE}}
+  clang_analyzer_eval(ptr[3] == '\0');   // expected-warning{{TRUE}}
+  clang_analyzer_eval(ptr[4] == '\0');   // expected-warning{{TRUE}}
+  clang_analyzer_eval(ptr[5] == '\0');   // expected-warning{{UNDEFINED}}
+  clang_analyzer_eval(ptr[6] == '\0');   // expected-warning{{UNDEFINED}}
+}
+
+void glob_invalid_index7() {
+  int idx = -42;
+  auto x = glob_arr6[idx]; // expected-warning{{garbage or undefined}}
+}
+
+void glob_invalid_index8() {
+  const char *ptr = glob_arr6;
+  int idx = 42;
+  auto x = ptr[idx]; // expected-warning{{garbage or undefined}}
+}
+
+char const glob_arr7[5] = {"123"};
+void glob_array_index6() {
+  clang_analyzer_eval(glob_arr7[0] == '1');  // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr7[1] == '2');  // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr7[2] == '3');  // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr7[3] == '\0'); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr7[4] == '\0'); // expected-warning{{TRUE}}
+}
+
+void glob_invalid_index9() {
+  int idx = -42;
+  auto x = glob_arr7[idx]; // expected-warning{{garbage or undefined}}
+}
+
+void glob_invalid_index10() {
+  const char *ptr = glob_arr7;
+  int idx = 42;
+  auto x = ptr[idx]; // expected-warning{{garbage or undefined}}
+}
+
+char const *const glob_ptr8 = "123";
+void glob_ptr_index4() {
+  clang_analyzer_eval(glob_ptr8[0] == '1');  // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr8[1] == '2');  // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr8[2] == '3');  // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr8[3] == '\0'); // expected-warning{{TRUE}}
+  // FIXME: Should be UNDEFINED.
+  // We should take into account a declaration in which the literal is used.
+  clang_analyzer_eval(glob_ptr8[4] == '\0'); // expected-warning{{TRUE}}
+}
+
+void glob_invalid_index11() {
+  int idx = -42;
+  auto x = glob_ptr8[idx]; // expected-warning{{garbage or undefined}}
+}
+
+void glob_invalid_index12() {
+  int idx = 42;
+  // FIXME: Should warn {{garbage or undefined}}
+  // We should take into account a declaration in which the literal is used.
+  auto x = glob_ptr8[idx]; // no-warning
+}
+
+const char16_t *const glob_ptr9 = u"абв";
+void glob_ptr_index5() {
+  clang_analyzer_eval(glob_ptr9[0] == u'а'); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr9[1] == u'б'); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr9[2] == u'в'); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr9[3] == '\0'); // expected-warning{{TRUE}}
+}
+
+const char32_t *const glob_ptr10 = U"\U0001F607\U0001F608\U0001F609";
+void glob_ptr_index6() {
+  clang_analyzer_eval(glob_ptr10[0] == U'\U0001F607'); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr10[1] == U'\U0001F608'); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr10[2] == U'\U0001F609'); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr10[3] == '\0');          // expected-warning{{TRUE}}
+}
+
+const wchar_t *const glob_ptr11 = L"\123\u0041\xFF";
+void glob_ptr_index7() {
+  clang_analyzer_eval(glob_ptr11[0] == L'\123');   // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr11[1] == L'\u0041'); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr11[2] == L'\xFF');   // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr11[3] == L'\0');     // expected-warning{{TRUE}}
+}
+
+const char *const glob_ptr12 = u8"abc";
+void glob_ptr_index8() {
+  clang_analyzer_eval(glob_ptr12[0] == 'a');  // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr12[1] == 'b');  // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr12[2] == 'c');  // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_ptr12[3] == '\0'); // expected-warning{{TRUE}}
+}