diff --git a/clang/lib/StaticAnalyzer/Core/RegionStore.cpp b/clang/lib/StaticAnalyzer/Core/RegionStore.cpp --- a/clang/lib/StaticAnalyzer/Core/RegionStore.cpp +++ b/clang/lib/StaticAnalyzer/Core/RegionStore.cpp @@ -2153,8 +2153,13 @@ return UnknownVal(); // Additionally allow introspection of a block's internal layout. - if (!hasPartialLazyBinding && !isa(R->getBaseRegion())) + // Try to get direct binding if all other attempts failed thus far. + // Else, return UndefinedVal() + if (!hasPartialLazyBinding && !isa(R->getBaseRegion())) { + if (const Optional &V = B.getDefaultBinding(R)) + return *V; return UndefinedVal(); + } } // All other values are symbolic. diff --git a/clang/test/Analysis/array-struct-region.c b/clang/test/Analysis/array-struct-region.c --- a/clang/test/Analysis/array-struct-region.c +++ b/clang/test/Analysis/array-struct-region.c @@ -353,3 +353,21 @@ // FIXME: Should be TRUE. clang_analyzer_eval(vals[index].a[0].x == 42); // expected-warning{{UNKNOWN}} } + +typedef struct { + int a:1; + int b[2]; +} BITFIELD_CAST; + +int array_struct_bitfield_1() { + BITFIELD_CAST ff = {0}; + BITFIELD_CAST* pff = &ff; + return *((int*)pff + 1); +} + +int array_struct_bitfield_2() { + BITFIELD_CAST ff = {0}; + BITFIELD_CAST* pff = &ff; + int a = *((int*)pff + 2); // expected-warning{{Assigned value is garbage or undefined [core.uninitialized.Assign]}} + return a; +}