[analyzer] Retrieve a character from CompoundLiteralExpr as an initializer for constant arrays.

[ASDenysPetrov]

Summary

Add support of handling CompoundLiteralExpr in RegionStoreManager::getBindingForFieldOrElementCommon. Retrieve a value from CompoundLiteralExpr which is an initializer of constant arrays in a global scope.

Example:

const int arr[8] = (const int[8]){1, 2, 3, 4}; // compound literal
auto x1 = arr[2]; // 3
auto x2 = arr[4]; // 0
auto x3 = arr[8]; // undef

[ASDenysPetrov]

Rebased.

[ASDenysPetrov]

Paused for a while.

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

if (VD->getType().isConstQualified() ||
         (B.isMainAnalysis() && VD->hasGlobalStorage())) {
       if (const Expr *Init = VD->getAnyInitializer()) {
         if (const auto *SL = dyn_cast<StringLiteral>(Init)) {
           if (auto CI = R->getIndex().getAs<nonloc::ConcreteInt>()) {
             const llvm::APSInt &Idx = CI->getValue();
             QualType ElemT = R->getElementType();
             return getSValFromStringLiteralByIndex(SL, Idx, ElemT);
           }
-        } else if (const auto *InitList = dyn_cast<InitListExpr>(Init)) {
+        } else {
+          const InitListExpr *InitList = dyn_cast<InitListExpr>(Init);
+          if (!InitList) {
+            if (const auto *CLE = dyn_cast<CompoundLiteralExpr>(Init)) {
+              const Expr *Init = CLE->getInitializer();
+              if (const auto *ILE = dyn_cast<InitListExpr>(Init))
+                InitList = ILE;
+            }
+          }
+          if (InitList) {
             // The array index has to be known.
             if (auto CI = R->getIndex().getAs<nonloc::ConcreteInt>()) {
               // If it is not an array, return Undef.
               QualType T = VD->getType();
               const ConstantArrayType *CAT = Ctx.getAsConstantArrayType(T);
               if (!CAT)
                 return UndefinedVal();
 
               // Support one-dimensional array.
               // C++20 [expr.add] 7.6.6.4 (excerpt):
               //   If P points to an array element i of an array object x with n
               //   elements, where i < 0 or i > n, the behavior is undefined.
               //   Dereferencing is not allowed on the "one past the last
               //   element", when i == n.
               // Example:
               //   const int arr[4] = {1, 2};
               //   const int *ptr = arr;
               //   int x0 = ptr[0]; // 1
               //   int x1 = ptr[1]; // 2
               //   int x2 = ptr[2]; // 0
               //   int x3 = ptr[3]; // 0
               //   int x4 = ptr[4]; // UB
               // TODO: Support multidimensional array.
               if (!isa<ConstantArrayType>(CAT->getElementType())) {
                 // One-dimensional array.
                 const llvm::APSInt &Idx = CI->getValue();
                 const auto I = static_cast<uint64_t>(Idx.getExtValue());
                 // Use `getZExtValue` because array extent can not be negative.
                 const uint64_t Extent = CAT->getSize().getZExtValue();
                 // Check for `Idx < 0`, NOT for `I < 0`, because `Idx` CAN be
                 // negative, but `I` can NOT.
                 if (Idx < 0 || I >= Extent)
                   return UndefinedVal();
 
                 // C++20 [expr.add] 9.4.17.5 (excerpt):
                 //   i-th array element is value-initialized for each k < i ≤ n,
-              //   where k is an expression-list size and n is an array extent.
+                //   where k is an expression-list size and n is an array
+                //   extent.
                 if (I >= InitList->getNumInits())
                   return svalBuilder.makeZeroVal(R->getElementType());
 
                 // Return a constant value, if it is presented.
                 // FIXME: Support other SVals.
                 const Expr *E = InitList->getInit(I);
                 if (Optional<SVal> V = svalBuilder.getConstantVal(E))
                   return *V;
               }
             }
           }
         }
       }
     }
+  }
 
   // Check for loads from a code text region.  For such loads, just give up.
   if (isa<CodeTextRegion>(superR))
     return UnknownVal();
 
   // Handle the case where we are indexing into a larger scalar object.
   // For example, this handles:
   //   int x = ...

clang/test/Analysis/compound-literals.c

 // RUN: %clang_cc1 -triple=i386-apple-darwin10 -verify %s -analyze \
-// RUN:   -analyzer-checker=debug.ExprInspection
+// RUN:   -analyzer-checker=debug.ExprInspection,core.uninitialized.Assign
 
 #define NULL 0
 void clang_analyzer_eval(int);
 
 // pr28449: Used to crash.
 void foo(void) {
   static const unsigned short array[] = (const unsigned short[]){0x0F00};
   clang_analyzer_eval(array[0] == 0x0F00); // expected-warning{{TRUE}}
 }
 
 // check that we propagate info through compound literal regions
 void bar() {
   int *integers = (int[]){1, 2, 3};
   clang_analyzer_eval(integers[0] == 1); // expected-warning{{TRUE}}
   clang_analyzer_eval(integers[1] == 2); // expected-warning{{TRUE}}
   clang_analyzer_eval(integers[2] == 3); // expected-warning{{TRUE}}
 
   int **pointers = (int *[]){&integers[0], NULL};
   clang_analyzer_eval(pointers[0] == NULL); // expected-warning{{FALSE}}
   clang_analyzer_eval(pointers[1] == NULL); // expected-warning{{TRUE}}
 }
+
+const int glob_arr1[8] = (const int[8]){[2] = 3, [0] = 1, [1] = 2, [3] = 4};
+void glob_arr_index1() {
+  clang_analyzer_eval(glob_arr1[0] == 1); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr1[1] == 2); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr1[2] == 3); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr1[3] == 4); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr1[4] == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr1[5] == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr1[6] == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr1[7] == 0); // expected-warning{{TRUE}}
+}
+
+void glob_invalid_index1() {
+  int x = -42;
+  int res = glob_arr1[x]; // expected-warning{{garbage or undefined}}
+}
+
+void glob_invalid_index2() {
+  int x = 42;
+  int res = glob_arr1[x]; // expected-warning{{garbage or undefined}}
+}
+
+const int glob_arr2[8] = (const int[8]){1, 2, 3, 4};
+void glob_arr_index2() {
+  clang_analyzer_eval(glob_arr2[0] == 1); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr2[1] == 2); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr2[2] == 3); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr2[3] == 4); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr2[4] == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr2[5] == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr2[6] == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(glob_arr2[7] == 0); // expected-warning{{TRUE}}
+}
+
+void glob_ptr_index1() {
+  int const *ptr = glob_arr2;
+  clang_analyzer_eval(ptr[0] == 1); // expected-warning{{TRUE}}
+  clang_analyzer_eval(ptr[1] == 2); // expected-warning{{TRUE}}
+  clang_analyzer_eval(ptr[2] == 3); // expected-warning{{TRUE}}
+  clang_analyzer_eval(ptr[3] == 4); // expected-warning{{TRUE}}
+  clang_analyzer_eval(ptr[4] == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(ptr[5] == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(ptr[6] == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(ptr[7] == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(ptr[8] == 0); // expected-warning{{UNDEFINED}}
+  clang_analyzer_eval(ptr[9] == 0); // expected-warning{{UNDEFINED}}
+}
+
+void glob_invalid_index3() {
+  int const *ptr = glob_arr2;
+  int idx = -42;
+  int res = ptr[idx]; // expected-warning{{garbage or undefined}}
+}
+
+void glob_invalid_index4() {
+  int const *ptr = glob_arr2;
+  int idx = 42;
+  int res = ptr[idx]; // expected-warning{{garbage or undefined}}
+}