[analyzer] Eval construction of non POD type arrays.

[isuckatcs]

Summary

This patch is supposed to address the issue that we don't evaluate arrays if the contain non POD types.

The idea is to record the index of the current element being constructed, and keep calling the constructor
in a loop until we construct every element.

[NoQ]

I'll need some more time to digest this but it looks awesome!

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

183–199

I think you can't avoid storing a LocationContext as part of the key (like ConstructedObjectKey does). This is because the code can potentially hit the same expression through recursion, and start processing it again, overwriting the old data while we still need it.

I also wonder if it would make sense to store the index as part of the usual ObjectsUnderConstruction map, simply as index of the ElementRegion that represents the object under construction. I suspect this is a bad idea because it can go wrong in situations like

S s[10];
new (s + 1) S[9];

where we probably don't want to construct an element of an element.

491–496

We really need to preserve this assertion in the general case. It's important as it catches missing state cleanups. Can you pattern-match the situation you're in more precisely?

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

102–108

Could you elaborate why you need this? It sounds like you're dealing with multi-dimensional arrays?

[isuckatcs]

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

102–108

Yes, it is required for multi-dimensional arrays. I just haven't added the comments here yet.

[isuckatcs]

• Resolved merge conflicts
• LocationContext is also part of the key
• Testcases in ctor.mm and ctor-array.cpp pass

[isuckatcs]

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

746

I fail to remove the element in ExprEngineCallAndReturn.cpp, and this is the only workaround I found is to put this check here, and if we shouldn't repeat the call, start the construction from the first element.

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

376–377

This line has no effect and will be removed. Also this should be inside the IF statement's true branch.

clang/test/Analysis/dtor.cpp

600

No warning here, this patch seems to be breaking malloc checker.

clang/test/Analysis/new-ctor-conservative.cpp

26–31

This testcase is breaking checkConstructorInlining() (new-ctor-conservative.cpp:12), which passes if this one is not present.

[NoQ]

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

102–108

Oh I see, so when you encounter a multi-dimensional array, your solution is to flatten it and treat it as one big single-dimensional array.

I guess the only question I have is, did you double-check that multi-dimensional array constructors are actually called in this order???

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

376–377

Cleaning up state typically has no noticeable behavior effects but it's traditionally considered to be important for performance reasons. Accessing and modifying immutable sets and maps in the program state takes up most of the analysis time according to various profilers that focus on low-level (per-instruction) profiles. Keeping these maps small usually increases access time dramatically. Hard to tell whether this specific bit will have a large impact but the overall tradition is definitely justified.

Another reason to clean up state is, it's much easier to assert() things when we know what exactly the state should be at any point. It allows us to assert() that we're not overwriting any existing state when we're entering another constructor loop.

clang/test/Analysis/new-ctor-conservative.cpp

26–31

Hmm interesting, the only reason I know for unrelated analyses (i.e., unrelated top level function analyses) to affect each other is inlining budgets. I.e., if we spend too much time inlining a function in one analysis, we may refuse to do that further in another analysis. Inlinable functions here are the constructor and destructor of S; operator new isn't inlinable because the whole point of the test is to evaluate it conservatively. Also path-sensitive analyses are performed from bottom of the file to top of the file when no call graph relations are present, so it kinda makes sense that bottom functions may affect top functions. But overall I don't see why this would happen in this specific scenario, I guess you may have to debug.

[isuckatcs]

• Evaluation now depends on maxBlockVisitOnPath.

[isuckatcs]

• Supporting heap allocated array construction
• Implemented some missing parts.
• Fixed testcases

[isuckatcs]

The resulting egraph is now linear, when it needs to be.

The correct parent-child relation was seen when N->getFirstPred() was the parent node.
The egraph was split because the node I wanted to replace was explicitly marked as a
successor of it's predecessor (see ExprEngineCallAndReturn.cpp:322) and this edge hadn't
been removed later.

[isuckatcs]

FIxed the issues which was slowing down the testcases.

I added every expression I encountered in handleConstructionContext() to a map,
but I only removed some of them later, which probably resulted in a huge tree that
was slow to manage. Now that I only store the expression and the index if it should
be repeated, the test times are the same as before.

[xazax.hun]

I will also need some more time to understand what is going on. Added some small comments inline.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

720

I think this last argument might be worth mentioning in the docstring above. E.g. could someone use this to initialize an object in a nested array like NonPod arr[3][3]? If no, we should let the potential users know. If yes, what should the Idx be in that case?

743

Could use getValueOr.

745

Could someone use handleConstructionContext for variadic length arrays in the future? Not supporting VLAs here is fine for now, I'm wondering if we want a fixme for the future.

876–878

What is the role of the index here? Should we rename this function?

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

371

Instead of always adding one and sometimes decrementing back, we could use the inverse condition to sometimes add one.

[xazax.hun]

I think it would be really useful to add something similar to printObjectsUnderConstructionJson so the indices can show up in the exploded graph. This could also help reviewers a lot to look at what is going on with small code examples :)

[NoQ]

Looks like it's all coming together!

The variable length array case is indeed a beast of its own, we shouldn't aim to handle it in this patch but we also shouldn't crash or do something really broken. So I suspect that quite a few of those dyn_casts could use some critical thinking applied: in what ways can they fail?

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

742

Before I forget, this function really should boil down to computeObjectUnderConstruction() and updateObjectsUnderConstruction(). Sometimes we call these two separately and it should be totally equivalent to calling this function, this is part of this function's contract. The new code has to be placed in one of those, because everything should still work when they're called separately.

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

1094

Ok, can we have a constant length array of variable length arrays???

[isuckatcs]

Addressed some comments.

[isuckatcs]

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

876–878

The current solution is that we loop over the same CXXConstructExpr as many times as many elements the array contains. This method is responsible for returning the memory region in which we want to construct the object. The Idx property here corresponds to the index of the memory region we need.

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

102–108

The storage allocated for an array is a continous memory region regardless of it's dimensions. In case of a multi-dimensional array, the elements are laid out in a row major order. As a result T arr[4] = {1,2,3,4} and T arr[2][2] = {{1,2},{3,4}} have the same memory layout: | 1 | 2 | 3 | 4 |, and so the constructors are also called in the same order.

[isuckatcs]

Added more testcases

I also found that in case of heap allocated (even multi-dimensional) arrays (POD/non-POD), we can't read an Undefined value (but we can read defined values).

int *arr = new int[2];
int x = arr[1]; <-- no warning

int (*arr)[2] = new int[2][2];
int x = arr[1][1]; <-- no warning

[isuckatcs]

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

1094

It seems we can't.

int arr[2][n] is modelled as:

VariableArrayType 'int[2][n]' 
|-VariableArrayType 'int[n]'

Though, the other way around int arr[n][2] is modelled as:

VariableArrayType 'int[n][2]'
|-ConstantArrayType 'int[2]'

If the variable is a constexpr e.g.:

constexpr int n = 2;
int arr[2][n];

We modell it as:

ConstantArrayType 'int[2][2]' 
`-ConstantArrayType 'int[2]'

[NoQ]

Ok at a glance this looks amazing. Are there any known issues with this patch on your side yet?

I think you should write a test for checker callback order, to see that pre-call/post-call/eval-call are all invoked in the right order for every constructor. We have test/Analysis/cxxctr-evalcall-analysis-order.cpp, you can build on it.

I'll also look into evaluating this patch on some real-world code.

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

456

Seems appropriate because the index isn't necessarily freshly added.

Could also assert that if the index is 0 then it's freshly added hmmm.

511

I think this could be made even stricter. The stricter the better (https://llvm.org/docs/CodingStandards.html#assert-liberally).

Maybe verify that there's an index tracked in the state?

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

1094

Nice!

1120–1121

Maybe have the function accept CXXConstructExpr from the start? It's clearly a misuse of this function to call it with any other type, so compile-time check would be nice.

[isuckatcs]

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

511

Maybe verify that there's an index tracked in the state?

It is possible, though that requires a lot of pattern matching.

For example the function can look like this:

ProgramStateRef
ExprEngine::addObjectUnderConstruction(ProgramStateRef State,
                                       const ConstructionContextItem &Item,
                                       const LocationContext *LC, SVal V) {
  ConstructedObjectKey Key(Item, LC->getStackFrame());
  // FIXME: Currently the state might already contain the marker due to
  // incorrect handling of temporaries bound to default parameters.
  // The state will already contain the marker if we construct elements
  // in an array, as we visit the same statement multiple times before
  // the array declaration. The marker is removed when we visit the
  // DeclStmt.

  const Expr *E = nullptr;

  // 1.) try to extract the initializer from the DeclStmt
  if(auto DS = dyn_cast_or_null<DeclStmt>(Item.getStmtOrNull()))
  {
    if(auto VD = dyn_cast_or_null<VarDecl>(DS->getSingleDecl()))
      E = dyn_cast<CXXConstructExpr>(VD->getInit());
  }

  // 2.) if that fails, try to extract the initializer from CXXCtorInitializer
  if(!E && Item.getKind() == ConstructionContextItem::InitializerKind)
  {
    auto CtorInit = Item.getCXXCtorInitializer(); //!!! CRASH if there is no initializer
    E = CtorInit->getInit();
  }

  assert(!State->get<ObjectsUnderConstruction>(Key) ||
         Key.getItem().getKind() ==
             ConstructionContextItem::TemporaryDestructorKind ||
         State->contains<IndexOfElementToConstruct>({E,LC}));
  return State->set<ObjectsUnderConstruction>(Key, V);
}

[isuckatcs]

In D127973#3609849, @NoQ wrote:

Ok at a glance this looks amazing. Are there any known issues with this patch on your side yet?

I think you should write a test for checker callback order, to see that pre-call/post-call/eval-call are all invoked in the right order for every constructor. We have test/Analysis/cxxctr-evalcall-analysis-order.cpp, you can build on it.

I don't know about any issues unique to this patch.

The problem with checking whether each callback is invoked for every constructor, is that the call evaluation itself happens in ExprEngine::defaultEvalCall(), which is not invoked if a checker evaluates the call (see CheckerManager::runCheckersForEvalCall()).
If ExprEngine::defaultEvalCall() is not invoked, we don't enter the call, and the looping won't happen either (the looping happens in ExprEngine::processCallExit()). Recursive functions also face the same issue.

One workaround is to create a dummy checker that logs when it is entered, but never "evaluates" the call, or to modify the existing checker. At the moment I can check for PreCall and PostCall evaluation order.

[isuckatcs]

Addressed comments.

• Added a function similar to printObjectsUnderConstructionJson so the indices can show up in the exploded graph.
• Wrote a test for checker callback order.

The resulting exploded node after the indices are also printed:

[isuckatcs]

addressed comments

[isuckatcs]

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

745

Technically this function is called every time a constructor is invoked regardless of it being an array, or not. As I see it, this function is only responsible for creating a region, in which the constructed object will be stored, and binding every information to the state that is necessary to know about for evaluating the constructor. You can use this function for anything being constructed, even an element of a VLA.

Though to handle VLAs in the future I don't think we have to touch this function. I would simply compute the size of the VLA in shouldInlineArrayConstruction, and inline it if I can. If inlining is not possible, conservative evaluation is used, as it used to be/as it happens now.

[xazax.hun]

Overall, this is starting to take a really great shape :) I'm hopeful we can land this soon.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

876–878

I see. So does that mean we need to update the name and the documentation? Or does it still return the first element of the array and only use Idx to determine which array in case of multi-dimensional arrays?

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

188

I think Expr is too vague, a potential user might have a hard time to decide which Expr should this data correspond to. If it is always a CXXConstructExpr, I think we should make the type express that. I think it would be nice to have a small comment expressing in which cases will a CXXConstructExpr have an entry in a map. Is it only when a CXXConstructExpr is a descendant of an ArrayInitLoopExpr?

499

Will this getSingleDecl always be sufficient? I think this might return a nullptr when we have multiple declarations with the same declarator:

NonPod a[2][2], b[2][2];

I think it is fine to not support this scenario in the first iteration, but let's leave a FIXME if that is something we do not support at the moment.

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

230

ShouldLoopCall might not be expressive enough. How about something like ShouldInlineArrayCtors?

1079

We actually already have something like this: ASTContext::getConstantArrayElementCount

[isuckatcs]

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

876–878

It returns the Idxth element, so we have to update the documentation and the name too.

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

188

A CXXConstructExpr will be a part of this map if it is array type, regardless of it's parent. I think this Expr is always a CXXConstructExpr, so I will change the parameter type.

499

I tested your example. Even though in the AST the DeclStmt has 2 children, inside this function, the ConstructionContextItem contains a DeclStmt which only has 1 child. So your example works fine.

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

230

That technically would be incorrect. I created a method with the same name, which is called, when the analyzer decides whether to inline the call, or fall back to conservative evaluation. At this point the ctor has already been inlined.

This variable is responsible for deciding whether the analyzer increments the index when it exits the call, which results in moving to the next statement, or it doesn't increment the index, so the same statement is evaluated again instead. It's true, that at the moment only array construction desires this behaviour, but in the future this might change. As a result I wouldn't rename the variable.

[isuckatcs]

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

876–878

By the way, the definition of this function is also affected by this patch, you can find it in ExprEngineCXX.cpp:97.

[xazax.hun]

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

499

If it works, that is great news! Let's add some tests to make sure we detect it when the representation changes.

[NoQ]

Ok I don't have any further immediate concerns about this patch. I strongly recommend some testing on real-world code, there may be a lot of cornercases we missed. But other than that, I think it's good to go, great job!!

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

499

Yes, that's because we actively separate our DeclStmts while building the CFG. So they're synthetic.

511

Oh right, that's because you're tracking it by construct-expression and I never found a compelling reason to include the construct-expression in the context. This also means that there's no easy way to match objects and indices in the exploded graph dump.

clang/test/Analysis/dtor.cpp

596

At this point we might as well do an // expected-warning@-19 or something like that.

[isuckatcs]

Addressed comments

• Renamed makeZeroElementRegion() to makeElementRegion() and updated the description.
• Removed computeConstantArraySize() and using ASTContext::getConstantArrayElementCount() instead.
• The new trait store CXXConstructExpr instead of Expr. I also added a description to it.
• Added a testcase when we have multiple declarations with the same declarator.

[isuckatcs]

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

511

I needed to find a representation that can be accessed from both processCallExit() and handleConstructor() and the expression is what both of them can see.

clang/test/Analysis/dtor.cpp

596

I wouldn't change this one. I think it is easier to find the appropriate line if the line number is explicitly there.

[Szelethus]

So sorry, I know I took my sweet time -- the patch looks great, and currently I'm running some analysis with it. As soon as I have the results on my hand I'd be happy to share and accept. I added a couple nots here and there, none of them are particularly interesting, feel free to attend to them when we are sure that no meaningful changes are needed to be made.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

716

I suppose "parameter" instead of "property" would be better?

723

Please terminate sentences.

817

821

908

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

470–471

Ohhh nice! Gotta add that to my arsenal.

489–494

Maybe we should move this to the assert like before?

511

Ugh, is there a way to add an assert message as a poor man's documentation? This might only be obvious in the context of this patch.

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

230

Maybe what you just wrote here is missing from the code, because looking at only that, I find this variable a bit cryptic as well.

clang/test/Analysis/ctor-array.cpp

1

I prefer multi-line RUN: commands.

clang/test/Analysis/operator-calls.cpp

105

I suppose this function name no longer stands?

So, it seems like the original iteration variable warning is still not here (I traced this back to D1425, a fix for https://bugs.llvm.org/show_bug.cgi?id=16745), but what is assigned a garbage value is not really stated here -- can you confirm for sure that its not the iteration variable? Can we test it?

115

Same here.

[isuckatcs]

• Addressed some comments
• Added more test cases
• Handling list initialization on the heap (e.g.: Non-POD *arr = new Non-POD[2]{{1, 2}, {5, 6}};)
• Added a FIXME, as we're unable to handle member list initialization (e.g.: StructCtor() : arr{{1, 2}, {3, 4}} {})

clang/test/Analysis/ctor-array.cpp

1

I think it's easier to copy the commands if needed, when they are in a single line.
Also it's not unique to this file, we do it in several other files, like ctor.mm.

[Szelethus]

Some early results: https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=qtbase_v6.2.0_pod_array_bindings_baseline&run=protobuf_v3.13.0_pod_array_bindings_baseline&items-per-page=100&sort-by=runDate&sort-desc=true&newcheck=qtbase_v6.2.0_pod_array_bindings&newcheck=protobuf_v3.13.0_pod_array_bindings&is-unique=on&diff-type=New

These are the new reports as a result of this patch. Something stupid prevented me from getting data on LLVM+Clang, I'm trying that again now. Analyzed the following projects: memcached,tmux,curl,twin,vim,openssl,sqlite,ffmpeg,postgres,tinyxml2,libwebm,xerces,bitcoin,protobuf,qtbase,codechecker,contour,llvm-project

[isuckatcs]

In D127973#3644679, @Szelethus wrote:

Some early results: https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=qtbase_v6.2.0_pod_array_bindings_baseline&run=protobuf_v3.13.0_pod_array_bindings_baseline&items-per-page=100&sort-by=runDate&sort-desc=true&newcheck=qtbase_v6.2.0_pod_array_bindings&newcheck=protobuf_v3.13.0_pod_array_bindings&is-unique=on&diff-type=New

These are the new reports as a result of this patch. Something stupid prevented me from getting data on LLVM+Clang, I'm trying that again now. Analyzed the following projects: memcached,tmux,curl,twin,vim,openssl,sqlite,ffmpeg,postgres,tinyxml2,libwebm,xerces,bitcoin,protobuf,qtbase,codechecker,contour,llvm-project

Looking at the results, I would say the 3rd (qeglfscursor.cpp) and the 4th (qicohandler.cpp) are definitely correct.

In the 2nd (repeated_field.h) the array they are trying to access is void* elements[1];. If we assume that current_size_ is not 0, then this report is also correct.

The 1st (blake2-impl.h) one is intersteing though. It appears that sizeof(blake2b_param[1]) == 64 and sizeof(S->h[i]) == 8. So basically they create a pointer that points to the front of the
object, and increment the pointer by 8 bytes in each iteration. Then load64() reads and returns 8 bytes past that pointer. On the last iteration the said function returns the last 8 bytes of the object.
This object on which they "iterate" over has been initialized, so I think this result is a false positive. blake2b_param is a packed struct, this might has to do something with it. The value flagged as
garbage is the first parameter of uint8_t reserved[14], which is initialized by memset(P->reserved, 0, sizeof(P->reserved)).

We fail to evaluate the memset calls. The result of each call is conj_$1{uint8_t, LC1, S15740, #1}. And later we read Undefined from it.

I replaced blake2b_param P[1]; with blake2b_param tst; blake2b_param *P = &tst; and analyzed the snippet with clang 14.0 release. I get the same false positive, so this has nothing to do with my patch.

[Szelethus]

https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=llvm-project_llvmorg-12.0.0_pod_array_bindings_baseline&run=qtbase_v6.2.0_pod_array_bindings_baseline&run=protobuf_v3.13.0_pod_array_bindings_baseline&newcheck=llvm-project_llvmorg-12.0.0_pod_array_bindings&newcheck=qtbase_v6.2.0_pod_array_bindings&newcheck=protobuf_v3.13.0_pod_array_bindings&is-unique=on&diff-type=New

LLVM finished as well, with 2 new warnings! The link above is the complete evaluation of your patch on our benchmark.

[Szelethus]

I suppose enough has been said! Well done! Please attend to the rest of the inlines and commit at your convenience.

[isuckatcs]

Addressed remaining comments.

[isuckatcs]

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

230

I renamed the variable and added a comment.

clang/test/Analysis/operator-calls.cpp

105

Since core.uninitialized.Assign doesn't report which field is being assigned an undefined value, in this automatically generated copy assignment, there is no way we can tell it for sure. The best I can do is I add -analyzer-output=text to the run commands and check the output result.

[steakhal]

This patch broke the exploded-graph-rewriter.
It prints this stack-trace, when I'm using the b032e3ff6121a969b2e90ad7bf493c2d5d7ac3a2. The issue is still present at main.

Traceback (most recent call last):
  File "/home/user/git/llvm-project/clang/utils/analyzer/exploded-graph-rewriter.py", line 1054, in <module>
    main()
  File "/home/user/git/llvm-project/clang/utils/analyzer/exploded-graph-rewriter.py", line 1033, in main
    graph.add_raw_line(raw_line)
  File "/home/user/git/llvm-project/clang/utils/analyzer/exploded-graph-rewriter.py", line 395, in add_raw_line
    self.nodes[node_id].construct(node_id, json_node)
  File "/home/user/git/llvm-project/clang/utils/analyzer/exploded-graph-rewriter.py", line 322, in construct
    self.state = ProgramState(json_node['state_id'],
  File "/home/user/git/llvm-project/clang/utils/analyzer/exploded-graph-rewriter.py", line 303, in __init__
    if json_ps['index_of_element'] is not None else None
KeyError: 'index_of_element'

Unfortunately, I cannot share the egraph for reproduction, but I believe the trace should be enough for fixing this.

[steakhal]

@isuckatcs

[isuckatcs]

@steakhal

Can you send me a snippet please, which reproduces this issue? For me the egraph rewriter works fine.

[steakhal]

In D127973#3749153, @isuckatcs wrote:

@steakhal

Can you send me a snippet please, which reproduces this issue? For me the egraph rewriter works fine.

I had the time for reducing it. Luckily it wasn't that bad.

digraph "Exploded Graph" {
	label="Exploded Graph";

	Node0x7fda6c098a40 [shape=record,label="{\{ \"state_id\": 0,\l  \"program_points\": [\l    \{ \"kind\": \"Edge\", \"src_id\": 20, \"dst_id\": 19, \"terminator\": null, \"term_kind\": null, \"tag\": null, \"node_id\": 1, \"is_sink\": 0, \"has_report\": 0 \},\l    \{ \"kind\": \"BlockEntrance\", \"block_id\": 19, \"tag\": null, \"node_id\": 2, \"is_sink\": 0, \"has_report\": 0 \},\l    \{ \"kind\": \"Statement\", \"stmt_kind\": \"DeclRefExpr\", \"stmt_id\": 7381222, \"pointer\": \"0x7fda78fd1e50\", \"pretty\": \"storage\", \"location\": \{ \"line\": 12, \"column\": 28, \"file\": \"/redacted/file.cc\" \}, \"stmt_point_kind\": \"PreStmtPurgeDeadSymbols\", \"tag\": \"ExprEngine : Clean Node\", \"node_id\": 3, \"is_sink\": 0, \"has_report\": 0 \}\l  ],\l  \"program_state\": \{\l    \"store\": null,\l    \"environment\": null,\l    \"constraints\": null,\l    \"equivalence_classes\": null,\l    \"disequality_info\": null,\l    \"dynamic_types\": null,\l    \"dynamic_casts\": null,\l    \"constructing_objects\": null,\l    \"checker_messages\": null\l  \}\l\}\l}"];
	Node0x7fda6c098a40 -> Node0x7fda6c098cb0;
	Node0x7fda6c098cb0 [shape=record,label="{\{ \"state_id\": 78,\l  \"program_points\": [\l    \{ \"kind\": \"Statement\", \"stmt_kind\": \"DeclRefExpr\", \"stmt_id\": 7381222, \"pointer\": \"0x7fda78fd1e50\", \"pretty\": \"storage\", \"location\": \{ \"line\": 12, \"column\": 28, \"file\": \"/redacted/file.cc\" \}, \"stmt_point_kind\": \"PostLValue\", \"tag\": null, \"node_id\": 4, \"is_sink\": 0, \"has_report\": 0 \},\l    \{ \"kind\": \"Statement\", \"stmt_kind\": \"DeclRefExpr\", \"stmt_id\": 7381222, \"pointer\": \"0x7fda78fd1e50\", \"pretty\": \"storage\", \"location\": \{ \"line\": 12, \"column\": 28, \"file\": \"/redacted/file.cc\" \}, \"stmt_point_kind\": \"PostStmt\", \"tag\": null, \"node_id\": 5, \"is_sink\": 0, \"has_report\": 0 \}\l  ],\l  \"program_state\": \{\l    \"store\": null,\l    \"environment\": \{ \"pointer\": \"0x7fda6c02e890\", \"items\": [\l      \{ \"lctx_id\": 1, \"location_context\": \"#0 Call\", \"calling\": \"redacted::Fun\", \"location\": null, \"items\": [\l        \{ \"stmt_id\": 7381222, \"pretty\": \"storage\", \"value\": \"&storage\" \}\l      ]\}\l    ]\},\l    \"constraints\": null,\l    \"equivalence_classes\": null,\l    \"disequality_info\": null,\l    \"dynamic_types\": null,\l    \"dynamic_casts\": null,\l    \"constructing_objects\": null,\l    \"checker_messages\": null\l  \}\l\}\l}"];
	Node0x7fda6c098cb0 -> Node0x7fda6c099160;
	Node0x7fda6c099160 [shape=record,label="{\{ \"state_id\": 228,\l&nbsp;&nbsp;\"program_points\": [\l&nbsp;&nbsp;&nbsp;&nbsp;\{ \"kind\": \"Statement\", \"stmt_kind\": \"MemberExpr\", \"stmt_id\": 7381229, \"pointer\": \"0x7fda78fd1e88\", \"pretty\": \"storage-\>Comp\", \"location\": \{ \"line\": 12, \"column\": 28, \"file\": \"/redacted/file.cc\" \}, \"stmt_point_kind\": \"PostStmt\", \"tag\": null, \"node_id\": 8, \"is_sink\": 0, \"has_report\": 0 \}\l&nbsp;&nbsp;],\l&nbsp;&nbsp;\"program_state\": \{\l&nbsp;&nbsp;&nbsp;&nbsp;\"store\": null,\l&nbsp;&nbsp;&nbsp;&nbsp;\"environment\": \{ \"pointer\": \"0x7fda6c02e890\", \"items\": [\l&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\{ \"lctx_id\": 1, \"location_context\": \"#0 Call\", \"calling\": \"redacted::Fun\", \"location\": null, \"items\": [\l&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\{ \"stmt_id\": 7381222, \"pretty\": \"storage\", \"value\": \"&storage\" \},\l&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\{ \"stmt_id\": 7381226, \"pretty\": \"storage\", \"value\": \"&SymRegion\{reg_$0\<class redacted::mfun * storage\>\}\" \},\l&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\{ \"stmt_id\": 7381229, \"pretty\": \"storage-\>Comp\", \"value\": \"&code\{Comp\}\" \}\l&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;]\}\l&nbsp;&nbsp;&nbsp;&nbsp;]\},\l&nbsp;&nbsp;&nbsp;&nbsp;\"constraints\": null,\l&nbsp;&nbsp;&nbsp;&nbsp;\"equivalence_classes\": null,\l&nbsp;&nbsp;&nbsp;&nbsp;\"disequality_info\": null,\l&nbsp;&nbsp;&nbsp;&nbsp;\"dynamic_types\": null,\l&nbsp;&nbsp;&nbsp;&nbsp;\"dynamic_casts\": null,\l&nbsp;&nbsp;&nbsp;&nbsp;\"constructing_objects\": null,\l&nbsp;&nbsp;&nbsp;&nbsp;\"checker_messages\": null\l&nbsp;&nbsp;\}\l\}\l}"];
}

[isuckatcs]

I had the time for reducing it. Luckily it wasn't that bad.

This egraph doesn't contain an entry with key "index_of_element", which is strange.

I still feel like I need a code snippet, which generates such egraph.

[steakhal]

In D127973#3751119, @isuckatcs wrote:

I had the time for reducing it. Luckily it wasn't that bad.

This egraph doesn't contain an entry with key "index_of_element", which is strange.

I still feel like I need a code snippet, which generates such egraph.

Oh, now I see why. The problem is probably because the version of clang I'm using is not the same as the rewrite script. For the latter I believe I'm using the latest one, hence it hes this change. Unlike with the clang I'm using, which doesn't emit this metadata.
I'm wondering if we should have a window for backward compatibility; There are a couple of places already where we check for the presence of some metadata and display it only if it exists.
Do you think it would be useful for this change as well?
Anyway, my bad for not recognizing the situation sooner. So, I'll just use the matching version of the rewriter. Problem solved for me.

[isuckatcs]

I'm wondering if we should have a window for backward compatibility; There are a couple of places already where we check for the presence of some metadata and display it only if it exists.
Do you think it would be useful for this change as well?

It has been fixed in D131187 as a part of another change.

[xazax.hun]

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

493

Hmm, when we are building our Cfgs, we explode DeclStatements with multiple declarations into separate DeclStatements, I'd expect getSingleDecl to never return nullptr. Maybe we can remove the or_null.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

void handleUOExtension(ExplodedNodeSet::iterator I,
                          StmtNodeBuilder &Bldr);
 
 public:
   SVal evalBinOp(ProgramStateRef ST, BinaryOperator::Opcode Op,
                  SVal LHS, SVal RHS, QualType T) {
     return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T);
   }
 
+  /// Retreives which element is being constructed in a non POD type array.
+  static Optional<unsigned>
+  getIndexOfElementToConstruct(ProgramStateRef State, const CXXConstructExpr *E,
+                               const LocationContext *LCtx);
+
   /// By looking at a certain item that may be potentially part of an object's
   /// ConstructionContext, retrieve such object's location. A particular
   /// statement can be transparently passed as \p Item in most cases.
   static Optional<SVal>
   getObjectUnderConstruction(ProgramStateRef State,
                              const ConstructionContextItem &Item,
                              const LocationContext *LC);
 
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred,
                        const CallEvent &Call,
                        const EvalCallOptions &CallOpts = {});
 
   /// Find location of the object that is being constructed by a given
   /// constructor. This should ideally always succeed but due to not being
   /// fully implemented it sometimes indicates that it failed via its
   /// out-parameter CallOpts; in such cases a fake temporary region is
   /// returned, which is better than nothing but does not represent
-  /// the actual behavior of the program.
-  SVal computeObjectUnderConstruction(
-      const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
-      const ConstructionContext *CC, EvalCallOptions &CallOpts);
+  /// the actual behavior of the program. The Idx property is used if we
+  /// construct an array of objects. In that case it points to the index
+  /// of the continous memory region.
+  /// E.g.:
+  /// For `int arr[4]` this index can be 0,1,2,3.
+  /// For `int arr2[3][3]` this index can be 0,1,...,7,8.
+  /// A multi-dimensional array is also a continous memory location in a
+  /// row major order, so for arr[0][0] Idx is 0 and for arr[2][2] Idx is 8
+  SVal computeObjectUnderConstruction(const Expr *E, ProgramStateRef State,
+                                      const LocationContext *LCtx,
+                                      const ConstructionContext *CC,
+                                      EvalCallOptions &CallOpts,
+                                      unsigned Idx = 0);
 
   /// Update the program state with all the path-sensitive information
   /// that's necessary to perform construction of an object with a given
   /// syntactic construction context. V and CallOpts have to be obtained from
   /// computeObjectUnderConstruction() invoked with the same set of
   /// the remaining arguments (E, State, LCtx, CC).
   ProgramStateRef updateObjectsUnderConstruction(
       SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
       const ConstructionContext *CC, const EvalCallOptions &CallOpts);
 
   /// A convenient wrapper around computeObjectUnderConstruction
   /// and updateObjectsUnderConstruction.
-  std::pair<ProgramStateRef, SVal> handleConstructionContext(
-      const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
-      const ConstructionContext *CC, EvalCallOptions &CallOpts) {
-    SVal V = computeObjectUnderConstruction(E, State, LCtx, CC, CallOpts);
-    return std::make_pair(
-        updateObjectsUnderConstruction(V, E, State, LCtx, CC, CallOpts), V);
+  std::pair<ProgramStateRef, SVal>
+  handleConstructionContext(const Expr *E, ProgramStateRef State,
+                            const LocationContext *LCtx,
+                            const ConstructionContext *CC,
+                            EvalCallOptions &CallOpts, unsigned Idx = 0) {
+
+    SVal V = computeObjectUnderConstruction(E, State, LCtx, CC, CallOpts, Idx);
+    State = updateObjectsUnderConstruction(V, E, State, LCtx, CC, CallOpts);
+
+    return std::make_pair(State, V);
   }
 
 private:
   ProgramStateRef finishArgumentConstruction(ProgramStateRef State,
                                              const CallEvent &Call);
   void finishArgumentConstruction(ExplodedNodeSet &Dst, ExplodedNode *Pred,
                                   const CallEvent &Call);
 
private:
   /// should inline, just by looking at the declaration of the function.
   bool mayInlineDecl(AnalysisDeclContext *ADC) const;
 
   /// Checks our policies and decides weither the given call should be inlined.
   bool shouldInlineCall(const CallEvent &Call, const Decl *D,
                         const ExplodedNode *Pred,
                         const EvalCallOptions &CallOpts = {});
 
+  /// Chekcs whether out policies allow us to inline a non POD type array
+  /// construction.
+  bool shouldInlineArrayConstruction(const ArrayType *Type);
+
+  /// Checks whether we construct an array of non POD type, and decides if the
+  /// constructor should be inkoved once again.
+  bool shouldRepeatCtorCall(ProgramStateRef State, const CXXConstructExpr *E,
+                            const LocationContext *LCtx);
+
   void inlineCall(WorkList *WList, const CallEvent &Call, const Decl *D,
                   NodeBuilder &Bldr, ExplodedNode *Pred, ProgramStateRef State);
 
   void ctuBifurcate(const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
                     ExplodedNode *Pred, ProgramStateRef State);
 
   /// Returns true if the CTU analysis is running its second phase.
   bool isSecondPhaseCTU() { return IsCTUEnabled && !Engine.getCTUWorkList(); }
private:
   /// Returns the temporary region with adjustments into the optional
   /// OutRegionWithAdjustments out-parameter if a new region was indeed needed,
   /// otherwise sets it to nullptr.
   ProgramStateRef createTemporaryRegionIfNeeded(
       ProgramStateRef State, const LocationContext *LC,
       const Expr *InitWithAdjustments, const Expr *Result = nullptr,
       const SubRegion **OutRegionWithAdjustments = nullptr);
 
-  /// Returns a region representing the first element of a (possibly
+  /// Returns a region representing the `Idx`th element of a (possibly
   /// multi-dimensional) array, for the purposes of element construction or
   /// destruction.
   ///
   /// On return, \p Ty will be set to the base type of the array.
   ///
   /// If the type is not an array type at all, the original value is returned.
   /// Otherwise the "IsArray" flag is set.
-  static SVal makeZeroElementRegion(ProgramStateRef State, SVal LValue,
-                                    QualType &Ty, bool &IsArray);
+  static SVal makeElementRegion(ProgramStateRef State, SVal LValue,
+                                QualType &Ty, bool &IsArray, unsigned Idx = 0);
 
   /// For a DeclStmt or CXXInitCtorInitializer, walk backward in the current CFG
   /// block to find the constructor expression that directly constructed into
   /// the storage for this statement. Returns null if the constructor for this
   /// statement created a temporary object region rather than directly
   /// constructing into an existing region.
   const CXXConstructExpr *findDirectConstructorForCurrentCFGElement();
 
   /// Common code that handles either a CXXConstructExpr or a
public:
   LLVM_NODISCARD static ProgramStateRef
   removeIterationState(ProgramStateRef State, const ObjCForCollectionStmt *O,
                        const LocationContext *LC);
 
   LLVM_NODISCARD static bool hasMoreIteration(ProgramStateRef State,
                                               const ObjCForCollectionStmt *O,
                                               const LocationContext *LC);
 private:
+  /// Assuming we construct an array of non POD types, this method allows us
+  /// to store which element is to be constructed next.
+  static ProgramStateRef
+  setIndexOfElementToConstruct(ProgramStateRef State, const CXXConstructExpr *E,
+                               const LocationContext *LCtx, unsigned Idx);
+
+  static ProgramStateRef
+  removeIndexOfElementToConstruct(ProgramStateRef State,
+                                  const CXXConstructExpr *E,
+                                  const LocationContext *LCtx);
+
   /// Store the location of a C++ object corresponding to a statement
   /// until the statement is actually encountered. For example, if a DeclStmt
   /// has CXXConstructExpr as its initializer, the object would be considered
   /// to be "under construction" between CXXConstructExpr and DeclStmt.
   /// This allows, among other things, to keep bindings to variable's fields
   /// made within the constructor alive until its declaration actually
   /// goes into scope.
   static ProgramStateRef

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

public:
   }
 
   bool operator<(const ConstructedObjectKey &RHS) const {
     return Impl < RHS.Impl;
   }
 };
 } // namespace
 
 typedef llvm::ImmutableMap<ConstructedObjectKey, SVal>
     ObjectsUnderConstructionMap;
 REGISTER_TRAIT_WITH_PROGRAMSTATE(ObjectsUnderConstruction,
                                  ObjectsUnderConstructionMap)
 
+// This trait is responsible for storing the index of the element that is to be
+// constructed in the next iteration. As a result a CXXConstructExpr is only
+// stored if it is array type. Also the index is the index of the continous
+// memory region, which is important for multi-dimensional arrays. E.g:: int
+// arr[2][2]; assume arr[1][1] will be the next element under construction, so
+// the index is 3.
+typedef llvm::ImmutableMap<
+    std::pair<const CXXConstructExpr *, const LocationContext *>, unsigned>
+    IndexOfElementToConstructMap;
+REGISTER_TRAIT_WITH_PROGRAMSTATE(IndexOfElementToConstruct,
+                                 IndexOfElementToConstructMap)
 //===----------------------------------------------------------------------===//
 // Engine construction and deletion.
 //===----------------------------------------------------------------------===//
 
 static const char* TagProviderName = "ExprEngine";
 
 ExprEngine::ExprEngine(cross_tu::CrossTranslationUnitContext &CTU,
                        AnalysisManager &mgr, SetOfConstDecls *VisitedCalleesIn,
                        FunctionSummariesTy *FS, InliningModes HowToInlineIn)
ProgramStateRef ExprEngine::createTemporaryRegionIfNeeded(
   // Notify checkers once for two bindLoc()s.
   State = processRegionChange(State, TR, LC);
 
   if (OutRegionWithAdjustments)
     *OutRegionWithAdjustments = cast<SubRegion>(Reg.getAsRegion());
   return State;
 }
 
+ProgramStateRef ExprEngine::setIndexOfElementToConstruct(
+    ProgramStateRef State, const CXXConstructExpr *E,
+    const LocationContext *LCtx, unsigned Idx) {
+  auto Key = std::make_pair(E, LCtx->getStackFrame());
+
+  assert(!State->contains<IndexOfElementToConstruct>(Key) || Idx > 0);
+
+  return State->set<IndexOfElementToConstruct>(Key, Idx);
+}
+
+Optional<unsigned>
+ExprEngine::getIndexOfElementToConstruct(ProgramStateRef State,
+                                         const CXXConstructExpr *E,
+                                         const LocationContext *LCtx) {
+
+  return Optional<unsigned>::create(
+      State->get<IndexOfElementToConstruct>({E, LCtx->getStackFrame()}));
+}
+
+ProgramStateRef
+ExprEngine::removeIndexOfElementToConstruct(ProgramStateRef State,
+                                            const CXXConstructExpr *E,
+                                            const LocationContext *LCtx) {
+  auto Key = std::make_pair(E, LCtx->getStackFrame());
+
+  assert(E && State->contains<IndexOfElementToConstruct>(Key));
+  return State->remove<IndexOfElementToConstruct>(Key);
+}
+
 ProgramStateRef
 ExprEngine::addObjectUnderConstruction(ProgramStateRef State,
                                        const ConstructionContextItem &Item,
                                        const LocationContext *LC, SVal V) {
   ConstructedObjectKey Key(Item, LC->getStackFrame());
   // FIXME: Currently the state might already contain the marker due to
   // incorrect handling of temporaries bound to default parameters.
+  // The state will already contain the marker if we construct elements
+  // in an array, as we visit the same statement multiple times before
+  // the array declaration. The marker is removed when we visit the
+  // DeclStmt.
+
+  const CXXConstructExpr *E = nullptr;
+
+  if (auto DS = dyn_cast_or_null<DeclStmt>(Item.getStmtOrNull())) {
+    if (auto VD = dyn_cast_or_null<VarDecl>(DS->getSingleDecl()))
+      E = dyn_cast<CXXConstructExpr>(VD->getInit());
+  }
+
+  if (!E && !Item.getStmtOrNull()) {
+    auto CtorInit = Item.getCXXCtorInitializer();
+    E = dyn_cast<CXXConstructExpr>(CtorInit->getInit());
+  }
+
   assert(!State->get<ObjectsUnderConstruction>(Key) ||
          Key.getItem().getKind() ==
-             ConstructionContextItem::TemporaryDestructorKind);
+             ConstructionContextItem::TemporaryDestructorKind ||
+         State->contains<IndexOfElementToConstruct>({E, LC}));
   return State->set<ObjectsUnderConstruction>(Key, V);
 }
 
 Optional<SVal>
 ExprEngine::getObjectUnderConstruction(ProgramStateRef State,
                                        const ConstructionContextItem &Item,
                                        const LocationContext *LC) {
   ConstructedObjectKey Key(Item, LC->getStackFrame());
printObjectsUnderConstructionJson(raw_ostream &Out, ProgramStateRef State,
 
   if (HasItem)
     Indent(Out, --Space, IsDot) << ']'; // End of "location_context".
   else {
     Out << "null ";
   }
 }
 
+static void printIndicesOfElementsToConstructJson(
+    raw_ostream &Out, ProgramStateRef State, const char *NL,
+    const LocationContext *LCtx, const ASTContext &Context,
+    unsigned int Space = 0, bool IsDot = false) {
+  using KeyT = std::pair<const Expr *, const LocationContext *>;
+
+  PrintingPolicy PP =
+      LCtx->getAnalysisDeclContext()->getASTContext().getPrintingPolicy();
+
+  ++Space;
+  bool HasItem = false;
+
+  // Store the last key.
+  KeyT LastKey;
+  for (const auto &I : State->get<IndexOfElementToConstruct>()) {
+    const KeyT &Key = I.first;
+    if (Key.second != LCtx)
+      continue;
+
+    if (!HasItem) {
+      Out << "[" << NL;
+      HasItem = true;
+    }
+
+    LastKey = Key;
+  }
+
+  for (const auto &I : State->get<IndexOfElementToConstruct>()) {
+    const KeyT &Key = I.first;
+    unsigned Value = I.second;
+    if (Key.second != LCtx)
+      continue;
+
+    Indent(Out, Space, IsDot) << "{ ";
+
+    // Expr
+    const Expr *E = Key.first;
+    Out << "\"stmt_id\": " << E->getID(Context);
+
+    // Kind - hack to display the current index
+    Out << ", \"kind\": \"Cur: " << Value - 1 << "\"";
+
+    // Pretty-print
+    Out << ", \"pretty\": ";
+    Out << "\"" << E->getStmtClassName() << " "
+        << E->getSourceRange().printToString(Context.getSourceManager()) << " '"
+        << QualType::getAsString(E->getType().split(), PP);
+    Out << "'\"";
+
+    Out << ", \"value\": \"Next: " << Value << "\" }";
+
+    if (Key != LastKey)
+      Out << ',';
+    Out << NL;
+  }
+
+  if (HasItem)
+    Indent(Out, --Space, IsDot) << ']'; // End of "location_context".
+  else {
+    Out << "null ";
+  }
+}
+
 void ExprEngine::printJson(raw_ostream &Out, ProgramStateRef State,
                            const LocationContext *LCtx, const char *NL,
                            unsigned int Space, bool IsDot) const {
   Indent(Out, Space, IsDot) << "\"constructing_objects\": ";
 
   if (LCtx && !State->get<ObjectsUnderConstruction>().isEmpty()) {
     ++Space;
     Out << '[' << NL;
     LCtx->printJson(Out, NL, Space, IsDot, [&](const LocationContext *LC) {
       printObjectsUnderConstructionJson(Out, State, NL, LC, Space, IsDot);
     });
 
     --Space;
-    Indent(Out, Space, IsDot) << "]," << NL; // End of "constructing_objects".
+    Indent(Out, Space, IsDot) << "],"; // End of "constructing_objects".
+  } else {
+    Out << "null,";
+  }
+
+  Indent(Out, Space, IsDot) << "\"index_of_element\": ";
+  if (LCtx && !State->get<IndexOfElementToConstruct>().isEmpty()) {
+    ++Space;
+
+    auto &Context = getContext();
+    Out << '[' << NL;
+    LCtx->printJson(Out, NL, Space, IsDot, [&](const LocationContext *LC) {
+      printIndicesOfElementsToConstructJson(Out, State, NL, LC, Context, Space,
+                                            IsDot);
+    });
+
+    --Space;
+    Indent(Out, Space, IsDot) << "]," << NL; // End of "index_of_element".
   } else {
     Out << "null," << NL;
   }
 
   getCheckerManager().runCheckersForPrintStateJson(Out, State, NL, Space,
                                                    IsDot);
 }
 
if (varType->isReferenceType()) {
     Region = ValueRegion->getBaseRegion();
     varType = cast<TypedValueRegion>(Region)->getValueType();
   }
 
   // FIXME: We need to run the same destructor on every element of the array.
   // This workaround will just run the first destructor (which will still
   // invalidate the entire array).
   EvalCallOptions CallOpts;
-  Region = makeZeroElementRegion(state, loc::MemRegionVal(Region), varType,
-                                 CallOpts.IsArrayCtorOrDtor).getAsRegion();
+  Region = makeElementRegion(state, loc::MemRegionVal(Region), varType,
+                             CallOpts.IsArrayCtorOrDtor)
+               .getAsRegion();
 
   VisitCXXDestructor(varType, Region, Dtor.getTriggerStmt(),
                      /*IsBase=*/false, Pred, Dst, CallOpts);
 }
 
 void ExprEngine::ProcessDeleteDtor(const CFGDeleteDtor Dtor,
                                    ExplodedNode *Pred,
                                    ExplodedNodeSet &Dst) {
Loc ThisStorageLoc =
       getSValBuilder().getCXXThis(CurDtor, LCtx->getStackFrame());
   Loc ThisLoc = State->getSVal(ThisStorageLoc).castAs<Loc>();
   SVal FieldVal = State->getLValue(Member, ThisLoc);
 
   // FIXME: We need to run the same destructor on every element of the array.
   // This workaround will just run the first destructor (which will still
   // invalidate the entire array).
   EvalCallOptions CallOpts;
-  FieldVal = makeZeroElementRegion(State, FieldVal, T,
-                                   CallOpts.IsArrayCtorOrDtor);
+  FieldVal = makeElementRegion(State, FieldVal, T, CallOpts.IsArrayCtorOrDtor);
 
   VisitCXXDestructor(T, FieldVal.getAsRegion(), CurDtor->getBody(),
                      /*IsBase=*/false, Pred, Dst, CallOpts);
 }
 
 void ExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D,
                                       ExplodedNode *Pred,
                                       ExplodedNodeSet &Dst) {
if (!MR) {
     // If we have no MR, we still need to unwrap the array to avoid destroying
     // the whole array at once. Regardless, we'd eventually need to model array
     // destructors properly, element-by-element.
     while (const ArrayType *AT = getContext().getAsArrayType(T)) {
       T = AT->getElementType();
       CallOpts.IsArrayCtorOrDtor = true;
     }
   } else {
-    // We'd eventually need to makeZeroElementRegion() trick here,
+    // We'd eventually need to makeElementRegion() trick here,
     // but for now we don't have the respective construction contexts,
     // so MR would always be null in this case. Do nothing for now.
   }
   VisitCXXDestructor(T, MR, D.getBindTemporaryExpr(),
                      /*IsBase=*/false, CleanPred, Dst, CallOpts);
 }
 
 void ExprEngine::processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end();
     if (AlwaysReturnsLValue)
       State = State->BindExpr(CallExpr, LCtx, ThisVal);
     else
       State = bindReturnValue(Call, LCtx, State);
     Bldr.generateNode(PS, State, *I);
   }
 }
 
-
-SVal ExprEngine::makeZeroElementRegion(ProgramStateRef State, SVal LValue,
-                                       QualType &Ty, bool &IsArray) {
+SVal ExprEngine::makeElementRegion(ProgramStateRef State, SVal LValue,
+                                   QualType &Ty, bool &IsArray, unsigned Idx) {
   SValBuilder &SVB = State->getStateManager().getSValBuilder();
   ASTContext &Ctx = SVB.getContext();
 
-  while (const ArrayType *AT = Ctx.getAsArrayType(Ty)) {
+  if (const ArrayType *AT = Ctx.getAsArrayType(Ty)) {
+    while (AT) {
       Ty = AT->getElementType();
-    LValue = State->getLValue(Ty, SVB.makeZeroArrayIndex(), LValue);
+      AT = dyn_cast<ArrayType>(AT->getElementType());
+    }
+    LValue = State->getLValue(Ty, SVB.makeArrayIndex(Idx), LValue);
     IsArray = true;
   }
 
   return LValue;
 }
 
 SVal ExprEngine::computeObjectUnderConstruction(
     const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
-    const ConstructionContext *CC, EvalCallOptions &CallOpts) {
+    const ConstructionContext *CC, EvalCallOptions &CallOpts, unsigned Idx) {
   SValBuilder &SVB = getSValBuilder();
   MemRegionManager &MRMgr = SVB.getRegionManager();
   ASTContext &ACtx = SVB.getContext();
 
   // Compute the target region by exploring the construction context.
   if (CC) {
     switch (CC->getKind()) {
     case ConstructionContext::CXX17ElidedCopyVariableKind:
     case ConstructionContext::SimpleVariableKind: {
       const auto *DSCC = cast<VariableConstructionContext>(CC);
       const auto *DS = DSCC->getDeclStmt();
       const auto *Var = cast<VarDecl>(DS->getSingleDecl());
       QualType Ty = Var->getType();
-      return makeZeroElementRegion(State, State->getLValue(Var, LCtx), Ty,
-                                   CallOpts.IsArrayCtorOrDtor);
+      return makeElementRegion(State, State->getLValue(Var, LCtx), Ty,
+                               CallOpts.IsArrayCtorOrDtor, Idx);
     }
     case ConstructionContext::CXX17ElidedCopyConstructorInitializerKind:
     case ConstructionContext::SimpleConstructorInitializerKind: {
       const auto *ICC = cast<ConstructorInitializerConstructionContext>(CC);
       const auto *Init = ICC->getCXXCtorInitializer();
       const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
       Loc ThisPtr = SVB.getCXXThis(CurCtor, LCtx->getStackFrame());
       SVal ThisVal = State->getSVal(ThisPtr);
case ConstructionContext::SimpleConstructorInitializerKind: {
         Field = Init->getIndirectMember();
         FieldVal = State->getLValue(Init->getIndirectMember(), ThisVal);
       } else {
         Field = Init->getMember();
         FieldVal = State->getLValue(Init->getMember(), ThisVal);
       }
 
       QualType Ty = Field->getType();
-      return makeZeroElementRegion(State, FieldVal, Ty,
-                                   CallOpts.IsArrayCtorOrDtor);
+      return makeElementRegion(State, FieldVal, Ty, CallOpts.IsArrayCtorOrDtor,
+                               Idx);
     }
     case ConstructionContext::NewAllocatedObjectKind: {
       if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
         const auto *NECC = cast<NewAllocatedObjectConstructionContext>(CC);
         const auto *NE = NECC->getCXXNewExpr();
         SVal V = *getObjectUnderConstruction(State, NE, LCtx);
         if (const SubRegion *MR =
                 dyn_cast_or_null<SubRegion>(V.getAsRegion())) {
           if (NE->isArray()) {
             // TODO: In fact, we need to call the constructor for every
             // allocated element, not just the first one!
             CallOpts.IsArrayCtorOrDtor = true;
-            return loc::MemRegionVal(getStoreManager().GetElementZeroRegion(
-                MR, NE->getType()->getPointeeType()));
+
+            auto R = MRMgr.getElementRegion(NE->getType()->getPointeeType(),
+                                            svalBuilder.makeArrayIndex(Idx), MR,
+                                            SVB.getContext());
+
+            return loc::MemRegionVal(R);
           }
           return  V;
         }
         // TODO: Detect when the allocator returns a null pointer.
         // Constructor shall not be called in this case.
       }
       break;
     }
if (Optional<SVal> ElidedTarget =
       State = finishObjectConstruction(State, CE, LCtx);
       if (auto L = Target.getAs<Loc>())
         State = State->BindExpr(CE, LCtx, State->getSVal(*L, CE->getType()));
       Bldr.generateNode(CE, Pred, State);
       return;
     }
   }
 
-  // FIXME: Handle arrays, which run the same constructor for every element.
-  // For now, we just run the first constructor (which should still invalidate
-  // the entire array).
-
   EvalCallOptions CallOpts;
   auto C = getCurrentCFGElement().getAs<CFGConstructor>();
   assert(C || getCurrentCFGElement().getAs<CFGStmt>());
   const ConstructionContext *CC = C ? C->getConstructionContext() : nullptr;
 
   const CXXConstructExpr::ConstructionKind CK =
       CE ? CE->getConstructionKind() : CIE->getConstructionKind();
   switch (CK) {
   case CXXConstructExpr::CK_Complete: {
     // Inherited constructors are always base class constructors.
     assert(CE && !CIE && "A complete constructor is inherited?!");
 
+    unsigned Idx = 0;
+    if (CE->getType()->isArrayType()) {
+      Idx = getIndexOfElementToConstruct(State, CE, LCtx).getValueOr(0u);
+      State = setIndexOfElementToConstruct(State, CE, LCtx, Idx + 1);
+    }
+
     // The target region is found from construction context.
     std::tie(State, Target) =
-        handleConstructionContext(CE, State, LCtx, CC, CallOpts);
+        handleConstructionContext(CE, State, LCtx, CC, CallOpts, Idx);
     break;
   }
   case CXXConstructExpr::CK_VirtualBase: {
     // Make sure we are not calling virtual base class initializers twice.
     // Only the most-derived object should initialize virtual base classes.
     const auto *OuterCtor = dyn_cast_or_null<CXXConstructExpr>(
         LCtx->getStackFrame()->getCallSite());
     assert(
if (const auto *ProtoType = FD->getType()->getAs<FunctionProtoType>())
           State = State->assume(*dSymVal, true);
   }
 
   StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
 
   SVal Result = symVal;
 
   if (CNE->isArray()) {
-    // FIXME: allocating an array requires simulating the constructors.
-    // For now, just return a symbolicated region.
+
     if (const auto *NewReg = cast_or_null<SubRegion>(symVal.getAsRegion())) {
       QualType ObjTy = CNE->getType()->getPointeeType();
       const ElementRegion *EleReg =
-          getStoreManager().GetElementZeroRegion(NewReg, ObjTy);
+          MRMgr.getElementRegion(ObjTy, svalBuilder.makeArrayIndex(0), NewReg,
+                                 svalBuilder.getContext());
       Result = loc::MemRegionVal(EleReg);
     }
+
     State = State->BindExpr(CNE, Pred->getLocationContext(), Result);
     Bldr.generateNode(CNE, Pred, State);
     return;
   }
 
   // FIXME: Once we have proper support for CXXConstructExprs inside
   // CXXNewExpr, we need to make sure that the constructed object is not
   // immediately invalidated here. (The placement call should happen before

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

void ExprEngine::processCallExit(ExplodedNode *CEBNode) {
 
   // Generate a CallEvent /before/ cleaning the state, so that we can get the
   // correct value for 'this' (if necessary).
   CallEventManager &CEMgr = getStateManager().getCallEventManager();
   CallEventRef<> Call = CEMgr.getCaller(calleeCtx, state);
 
   // Step 2: generate node with bound return value: CEBNode -> BindedRetNode.
 
+  bool ShouldLoopCall = false;
   // If the callee returns an expression, bind its value to CallExpr.
   if (CE) {
     if (const ReturnStmt *RS = dyn_cast_or_null<ReturnStmt>(LastSt)) {
       const LocationContext *LCtx = CEBNode->getLocationContext();
       SVal V = state->getSVal(RS, LCtx);
 
       // Ensure that the return type matches the type of the returned Expr.
       if (wasDifferentDeclUsedForInlining(Call, calleeCtx)) {
if (CE) {
 
     // Bind the constructed object value to CXXConstructExpr.
     if (const CXXConstructExpr *CCE = dyn_cast<CXXConstructExpr>(CE)) {
       loc::MemRegionVal This =
         svalBuilder.getCXXThis(CCE->getConstructor()->getParent(), calleeCtx);
       SVal ThisV = state->getSVal(This);
       ThisV = state->getSVal(ThisV.castAs<Loc>());
       state = state->BindExpr(CCE, callerCtx, ThisV);
+
+      ShouldLoopCall = shouldRepeatCtorCall(state, CCE, callerCtx);
+
+      if (!ShouldLoopCall &&
+          getIndexOfElementToConstruct(state, CCE, callerCtx))
+        state = removeIndexOfElementToConstruct(state, CCE, callerCtx);
     }
 
     if (const auto *CNE = dyn_cast<CXXNewExpr>(CE)) {
       // We are currently evaluating a CXXNewAllocator CFGElement. It takes a
       // while to reach the actual CXXNewExpr element from here, so keep the
       // region for later use.
       // Additionally cast the return value of the inlined operator new
       // (which is of type 'void *') to the correct object type.
if (const ObjCMethodCall *Msg = dyn_cast<ObjCMethodCall>(Call)) {
       getCheckerManager().runCheckersForPostStmt(Dst, DstPostCall, CE,
                                                  *this, /*wasInlined=*/true);
     } else {
       Dst.insert(DstPostCall);
     }
 
     // Enqueue the next element in the block.
     for (ExplodedNodeSet::iterator PSI = Dst.begin(), PSE = Dst.end();
-                                   PSI != PSE; ++PSI) {
-      Engine.getWorkList()->enqueue(*PSI, calleeCtx->getCallSiteBlock(),
-                                    calleeCtx->getIndex()+1);
+      unsigned Idx = calleeCtx->getIndex() + (ShouldLoopCall ? 0 : 1);
+
+      Engine.getWorkList()->enqueue(*PSI, calleeCtx->getCallSiteBlock(), Idx);
     }
   }
 }
 
 bool ExprEngine::isSmall(AnalysisDeclContext *ADC) const {
   // When there are no branches in the function, it means that there's no
   // exponential complexity introduced by inlining such function.
   // Such functions also don't trigger various fundamental problems
   // with our inlining mechanism, such as the problem of
   // inlined defensive checks. Hence isLinear().
   const CFG *Cfg = ADC->getCFG();
   return Cfg->isLinear() || Cfg->size() <= AMgr.options.AlwaysInlineSize;
 }
 
if (llvm::isa_and_nonnull<NewAllocatedObjectConstructionContext>(CC) &&
         !Opts.MayInlineCXXAllocator)
       return CIP_DisallowedOnce;
 
     // FIXME: We don't handle constructors or destructors for arrays properly.
     // Even once we do, we still need to be careful about implicitly-generated
     // initializers for array fields in default move/copy constructors.
     // We still allow construction into ElementRegion targets when they don't
     // represent array elements.
-    if (CallOpts.IsArrayCtorOrDtor)
+    if (CallOpts.IsArrayCtorOrDtor) {
+      if (!shouldInlineArrayConstruction(
+              dyn_cast<ArrayType>(CtorExpr->getType())))
         return CIP_DisallowedOnce;
+    }
 
     // Inlining constructors requires including initializers in the CFG.
     const AnalysisDeclContext *ADC = CallerSFC->getAnalysisDeclContext();
     assert(ADC->getCFGBuildOptions().AddInitializers && "No CFG initializers");
     (void)ADC;
 
     // If the destructor is trivial, it's always safe to inline the constructor.
     if (Ctor.getDecl()->getParent()->hasTrivialDestructor())
case CE_CXXDestructor: {
     if (!Opts.mayInlineCXXMemberFunction(CIMK_Destructors))
       return CIP_DisallowedAlways;
 
     // Inlining destructors requires building the CFG correctly.
     const AnalysisDeclContext *ADC = CallerSFC->getAnalysisDeclContext();
     assert(ADC->getCFGBuildOptions().AddImplicitDtors && "No CFG destructors");
     (void)ADC;
 
-    // FIXME: We don't handle constructors or destructors for arrays properly.
+    // FIXME: We don't handle destructors for arrays properly.
     if (CallOpts.IsArrayCtorOrDtor)
       return CIP_DisallowedOnce;
 
     // Allow disabling temporary destructor inlining with a separate option.
     if (CallOpts.IsTemporaryCtorOrDtor &&
         !Opts.MayInlineCXXTemporaryDtors)
       return CIP_DisallowedOnce;
 
bool ExprEngine::shouldInlineCall(const CallEvent &Call, const Decl *D,
   }
 
   if (HowToInline == Inline_Minimal && (!isSmall(CalleeADC) || IsRecursive))
     return false;
 
   return true;
 }
 
+bool ExprEngine::shouldInlineArrayConstruction(const ArrayType *Type) {
+  if (!Type)
+    return false;
+
+  // FIXME: Handle other arrays types.
+  if (const auto *CAT = dyn_cast<ConstantArrayType>(Type)) {
+    unsigned Size = getContext().getConstantArrayElementCount(CAT);
+
+    return Size <= AMgr.options.maxBlockVisitOnPath;
+  }
+
+  return false;
+}
+
+bool ExprEngine::shouldRepeatCtorCall(ProgramStateRef State,
+                                      const CXXConstructExpr *E,
+                                      const LocationContext *LCtx) {
+
+  if (!E)
+    return false;
+
+  auto Ty = E->getType();
+
+  // FIXME: Handle non constant array types
+  if (const auto *CAT = dyn_cast<ConstantArrayType>(Ty)) {
+    unsigned Size = getContext().getConstantArrayElementCount(CAT);
+    return Size > getIndexOfElementToConstruct(State, E, LCtx);
+  }
+
+  return false;
+}
+
 static bool isTrivialObjectAssignment(const CallEvent &Call) {
   const CXXInstanceCall *ICall = dyn_cast<CXXInstanceCall>(&Call);
   if (!ICall)
     return false;
 
   const CXXMethodDecl *MD = dyn_cast_or_null<CXXMethodDecl>(ICall->getDecl());
   if (!MD)
     return false;
   if (!(MD->isCopyAssignmentOperator() || MD->isMoveAssignmentOperator()))
     return false;
 
   return MD->isTrivial();
 }
 
 void ExprEngine::defaultEvalCall(NodeBuilder &Bldr, ExplodedNode *Pred,
                                  const CallEvent &CallTemplate,
                                  const EvalCallOptions &CallOpts) {
   // Make sure we have the most recent state attached to the call.
   ProgramStateRef State = Pred->getState();

clang/test/Analysis/ctor-array.cpp

+// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -analyzer-disable-checker=cplusplus -analyzer-config c++-inlining=constructors -verify %s
+
+#include "Inputs/system-header-simulator-cxx.h"
+
+void clang_analyzer_eval(bool);
+
+struct s {
+  int x;
+  int y;
+};
+
+void a1(void) {
+  s arr[3];
+  int x = arr[0].x;
+  // expected-warning@-1{{Assigned value is garbage or undefined}}
+}
+
+void a2(void) {
+  s arr[3];
+  int x = arr[1].x;
+  // expected-warning@-1{{Assigned value is garbage or undefined}}
+}
+
+void a3(void) {
+  s arr[3];
+  int x = arr[2].x;
+  // expected-warning@-1{{Assigned value is garbage or undefined}}
+}
+
+struct s2 {
+  int x;
+  int y = 2;
+};
+
+void b1(void) {
+  s2 arr[3];
+
+  clang_analyzer_eval(arr[0].y == 2); // expected-warning{{TRUE}}
+  int x = arr[0].x;
+  // expected-warning@-1{{Assigned value is garbage or undefined}}
+}
+
+void b2(void) {
+  s2 arr[3];
+
+  clang_analyzer_eval(arr[1].y == 2); // expected-warning{{TRUE}}
+  int x = arr[1].x;
+  // expected-warning@-1{{Assigned value is garbage or undefined}}
+}
+
+void b3(void) {
+  s2 arr[3];
+
+  clang_analyzer_eval(arr[2].y == 2); // expected-warning{{TRUE}}
+  int x = arr[2].x;
+  // expected-warning@-1{{Assigned value is garbage or undefined}}
+}
+
+void c1(void) {
+  {
+    s2 arr[2];
+    arr[1].x = 3;
+
+    clang_analyzer_eval(arr[1].y == 2); // expected-warning{{TRUE}}
+    clang_analyzer_eval(arr[1].x == 3); // expected-warning{{TRUE}}
+  }
+
+  {
+    s2 arr[2];
+
+    clang_analyzer_eval(arr[1].y == 2); // expected-warning{{TRUE}}
+    int x = arr[1].x;
+    // expected-warning@-1{{Assigned value is garbage or undefined}}
+  }
+}
+
+struct s3 {
+  int x = 1;
+  int y = 2;
+};
+
+struct s4 {
+  s3 arr[2];
+  s sarr[2];
+};
+
+void e1(void) {
+  s4 arr[2];
+
+  clang_analyzer_eval(arr[0].arr[0].x == 1); // expected-warning{{TRUE}}
+  clang_analyzer_eval(arr[0].arr[0].y == 2); // expected-warning{{TRUE}}
+
+  clang_analyzer_eval(arr[0].arr[1].x == 1); // expected-warning{{TRUE}}
+  clang_analyzer_eval(arr[0].arr[1].y == 2); // expected-warning{{TRUE}}
+
+  clang_analyzer_eval(arr[1].arr[0].x == 1); // expected-warning{{TRUE}}
+  clang_analyzer_eval(arr[1].arr[0].y == 2); // expected-warning{{TRUE}}
+
+  clang_analyzer_eval(arr[1].arr[1].x == 1); // expected-warning{{TRUE}}
+  clang_analyzer_eval(arr[1].arr[1].y == 2); // expected-warning{{TRUE}}
+
+  int x = arr[1].sarr[1].x;
+  // expected-warning@-1{{Assigned value is garbage or undefined}}
+}
+
+void f1(void) {
+  s2 arr[2][2];
+
+  clang_analyzer_eval(arr[1][1].y == 2); // expected-warning{{TRUE}}
+  int x = arr[1][1].x;
+  // expected-warning@-1{{Assigned value is garbage or undefined}}
+}
+
+struct s5 {
+  static int c;
+  int x;
+
+  s5() : x(c++) {}
+};
+
+void g1(void) {
+  // FIXME: This test requires -analyzer-disable-checker=cplusplus,
+  // because of the checker's weird behaviour in case of arrays.
+  // E.g.:
+  //        s3 *arr = new s3[4];
+  //        s3 *arr2 = new (arr + 1) s3[1];
+  //                   ^~~~~~~~~~~~~~~~~~~
+  //                   warning: 12 bytes is possibly not enough
+  //                            for array allocation which requires
+  //                            4 bytes.
+
+  s5::c = 0;
+  s5 *arr = new s5[4];
+  new (arr + 1) s5[3];
+
+  clang_analyzer_eval(arr[0].x == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(arr[1].x == 4); // expected-warning{{TRUE}}
+  clang_analyzer_eval(arr[2].x == 5); // expected-warning{{TRUE}}
+  clang_analyzer_eval(arr[3].x == 6); // expected-warning{{TRUE}}
+}
+
+void g2(void) {
+  s5::c = 0;
+  s5 arr[4];
+
+  clang_analyzer_eval(arr[0].x == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(arr[1].x == 1); // expected-warning{{TRUE}}
+  clang_analyzer_eval(arr[2].x == 2); // expected-warning{{TRUE}}
+  clang_analyzer_eval(arr[3].x == 3); // expected-warning{{TRUE}}
+}
+
+void g3(void) {
+  s5::c = 0;
+  s5 arr[2][2];
+
+  clang_analyzer_eval(arr[0][0].x == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(arr[0][1].x == 1); // expected-warning{{TRUE}}
+  clang_analyzer_eval(arr[1][0].x == 2); // expected-warning{{TRUE}}
+  clang_analyzer_eval(arr[1][1].x == 3); // expected-warning{{TRUE}}
+}
+
+void h1(void) {
+  s5::c = 0;
+  s5 a[2][2], b[2][2];
+
+  clang_analyzer_eval(a[0][0].x == 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(a[0][1].x == 1); // expected-warning{{TRUE}}
+  clang_analyzer_eval(a[1][0].x == 2); // expected-warning{{TRUE}}
+  clang_analyzer_eval(a[1][1].x == 3); // expected-warning{{TRUE}}
+
+  clang_analyzer_eval(b[0][0].x == 4); // expected-warning{{TRUE}}
+  clang_analyzer_eval(b[0][1].x == 5); // expected-warning{{TRUE}}
+  clang_analyzer_eval(b[1][0].x == 6); // expected-warning{{TRUE}}
+  clang_analyzer_eval(b[1][1].x == 7); // expected-warning{{TRUE}}
+}
+
+void h2(void) {
+  s a[2][2], b[2][2];
+
+  int x = a[1][1].x;
+  // expected-warning@-1{{Assigned value is garbage or undefined}}
+}
+
+void h3(void) {
+  s a[2][2], b[2][2];
+
+  int x = b[1][1].y;
+  // expected-warning@-1{{Assigned value is garbage or undefined}}
+}

clang/test/Analysis/ctor.mm

namespace ZeroInitialization {
 
   void testNew() {
     raw_pair *pp = new raw_pair();
     clang_analyzer_eval(pp->p1 == 0); // expected-warning{{TRUE}}
     clang_analyzer_eval(pp->p2 == 0); // expected-warning{{TRUE}}
   }
 
   void testArrayNew() {
-    // FIXME: Pending proper implementation of constructors for 'new[]'.
     raw_pair *p = new raw_pair[2]();
-    clang_analyzer_eval(p[0].p1 == 0); // expected-warning{{UNKNOWN}}
-    clang_analyzer_eval(p[0].p2 == 0); // expected-warning{{UNKNOWN}}
-    clang_analyzer_eval(p[1].p1 == 0); // expected-warning{{UNKNOWN}}
-    clang_analyzer_eval(p[1].p2 == 0); // expected-warning{{UNKNOWN}}
+    clang_analyzer_eval(p[0].p1 == 0); // expected-warning{{TRUE}}
+    clang_analyzer_eval(p[0].p2 == 0); // expected-warning{{TRUE}}
+    clang_analyzer_eval(p[1].p1 == 0); // expected-warning{{TRUE}}
+    clang_analyzer_eval(p[1].p2 == 0); // expected-warning{{TRUE}}
   }
 
   struct initializing_pair {
   public:
     int x;
     raw_pair y;
     initializing_pair() : x(), y() {}
   };

clang/test/Analysis/cxxctr-array-evalcall-analysis-order.cpp

+// RUN: %clang_analyze_cc1 %s \
+// RUN:  -analyzer-checker=debug.AnalysisOrder \
+// RUN:  -analyzer-config debug.AnalysisOrder:PreCall=true \
+// RUN:  -analyzer-config debug.AnalysisOrder:PostCall=true \
+// RUN:  2>&1 | FileCheck %s
+
+// This test ensures that eval::Call event will be triggered for constructors.
+
+class C {
+public:
+  C(){};
+};
+
+void stack() {
+  C arr[4];
+  C *arr2 = new C[4];
+  C arr3[2][2];
+}
+
+// C arr[4];
+// CHECK:  PreCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PostCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PreCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PostCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PreCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PostCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PreCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PostCall (C::C) [CXXConstructorCall]
+//
+// C *arr2 = new C[4];
+// CHECK-NEXT:  PreCall (operator new[]) [CXXAllocatorCall]
+// CHECK-NEXT:  PostCall (operator new[]) [CXXAllocatorCall]
+// CHECK-NEXT:  PreCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PostCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PreCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PostCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PreCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PostCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PreCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PostCall (C::C) [CXXConstructorCall]
+//
+// C arr3[2][2];
+// CHECK-NEXT:  PreCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PostCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PreCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PostCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PreCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PostCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PreCall (C::C) [CXXConstructorCall]
+// CHECK-NEXT:  PostCall (C::C) [CXXConstructorCall]

clang/test/Analysis/dtor.cpp

 void testArrayInvalidation() {
   int i = 42;
   int j = 42;
 
   {
     IntWrapper arr[2];
 
     // There should be no undefined value warnings here.
-    // Eventually these should be TRUE as well, but right now
-    // we can't handle array constructors.
-    clang_analyzer_eval(arr[0].x == 0); // expected-warning{{UNKNOWN}}
-    clang_analyzer_eval(arr[1].x == 0); // expected-warning{{UNKNOWN}}
+    clang_analyzer_eval(arr[0].x == 0); // expected-warning{{TRUE}}
+    clang_analyzer_eval(arr[1].x == 0); // expected-warning{{TRUE}}
 
     arr[0].x = &i;
     arr[1].x = &j;
     clang_analyzer_eval(*arr[0].x == 42); // expected-warning{{TRUE}}
     clang_analyzer_eval(*arr[1].x == 42); // expected-warning{{TRUE}}
   }
 
   // The destructors should have invalidated i and j.
namespace MultidimensionalArrays {
   void testArrayInvalidation() {
     int i = 42;
     int j = 42;
 
     {
       IntWrapper arr[2][2];
 
       // There should be no undefined value warnings here.
-      // Eventually these should be TRUE as well, but right now
-      // we can't handle array constructors.
-      clang_analyzer_eval(arr[0][0].x == 0); // expected-warning{{UNKNOWN}}
-      clang_analyzer_eval(arr[1][1].x == 0); // expected-warning{{UNKNOWN}}
+      clang_analyzer_eval(arr[0][0].x == 0); // expected-warning{{TRUE}}
+      clang_analyzer_eval(arr[1][1].x == 0); // expected-warning{{TRUE}}
 
       arr[0][0].x = &i;
       arr[1][1].x = &j;
       clang_analyzer_eval(*arr[0][0].x == 42); // expected-warning{{TRUE}}
       clang_analyzer_eval(*arr[1][1].x == 42); // expected-warning{{TRUE}}
     }
 
     // The destructors should have invalidated i and j.

 
 void overrideLeak() {
   auto *a = new CustomOperators();
 } // expected-warning{{Potential leak of memory pointed to by 'a'}}
 
 void overrideDoubleDelete() {
   auto *a = new CustomOperators();
   delete a;
-  delete a; // expected-warning@581 {{Attempt to free released memory}}
+  delete a; // expected-warning@577 {{Attempt to free released memory}}
 }

clang/test/Analysis/exploded-graph-rewriter/checker_messages.dot

"{
           "has_report": 0, "is_sink": 0
         }
       ],
       "program_state": {
         "store": null,
         "constraints": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "environment": null,
         "checker_messages": [
           { "checker": "alpha.core.FooChecker", "messages": [
             "Foo stuff:",
             "Foo: Bar"
           ]}
         ]
       }
     }
 \l}"];

clang/test/Analysis/exploded-graph-rewriter/checker_messages_diff.dot

"{
         }
       ],
       "program_state": {
         "environment": null,
         "store": null,
         "constraints": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": [
           { "checker": "FooChecker", "messages": [
             "Foo: Bar"
           ]},
           { "checker": "BarChecker", "messages": [
             "Bar: Foo"
           ]}
         ]
"{
         }
       ],
       "program_state": {
         "environment": null,
         "store": null,
         "constraints": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": [
           { "checker": "FooChecker", "messages": [
             "Foo: Bar",
             "Bar: Foo"
           ]},
           { "checker": "DunnoWhateverSomeOtherChecker", "messages": [
             "Dunno, some other message."
           ]}

clang/test/Analysis/exploded-graph-rewriter/constraints.dot

"{
           "has_report": 0, "is_sink": 0
         }
       ],
       "program_state": {
         "store": null,
         "environment": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": null,
         "constraints": [
           { "symbol": "reg_$0<x>", "range": "{ [0, 0] }" }
         ]
       }
     }
 \l}"];

clang/test/Analysis/exploded-graph-rewriter/constraints_diff.dot

"{
           "has_report": 0, "is_sink": 0
         }
       ],
       "program_state": {
         "store": null,
         "environment": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": null,
         "constraints": [
           { "symbol": "reg_$0<x>", "range": "{ [0, 10] }" }
         ]
       }
     }
 \l}"];
 
"{
           "has_report": 0, "is_sink": 0
         }
       ],
       "program_state": {
         "store": null,
         "environment": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": null,
         "constraints": [
           { "symbol": "reg_$0<x>", "range": "{ [0, 5] }" }
         ]
       }
     }
 \l}"];
 
"{
         }
       ],
       "program_state": {
         "store": null,
         "environment": null,
         "constraints": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": null
       }
     }
 \l}"];

clang/test/Analysis/exploded-graph-rewriter/environment.dot

"{
           "has_report": 0, "is_sink": 0
         }
       ],
       "program_state": {
         "store": null,
         "constraints": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": null,
         "environment": {
           "pointer": "0x2",
           "items": [
             {
               "location_context": "#0 Call",
               "lctx_id": 3,
               "calling": "foo",

clang/test/Analysis/exploded-graph-rewriter/environment_diff.dot

"{
           "has_report": 0, "is_sink": 0
         }
       ],
       "program_state": {
         "store": null,
         "constraints": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": null,
         "environment": {
           "pointer": "0x2",
           "items": [
             {
               "location_context": "#0 Call",
               "lctx_id": 3,
               "calling": "foo",
"{
           "has_report": 0, "is_sink": 0
         }
       ],
       "program_state": {
         "store": null,
         "constraints": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": null,
         "environment": {
           "pointer": "0x2",
           "items": [
             {
               "location_context": "#0 Call",
               "lctx_id": 3,
               "calling": "foo",
"{
           "has_report": 0, "is_sink": 0
         }
       ],
       "program_state": {
         "store": null,
         "constraints": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": null,
         "environment": {
           "pointer": "0x2",
           "items": [
             {
               "location_context": "#0 Call",
               "lctx_id": 3,
               "calling": "foo",

clang/test/Analysis/exploded-graph-rewriter/store.dot

"{
           "has_report": 0, "is_sink": 0
         }
       ],
       "program_state": {
         "environment": null,
         "constraints": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": null,
         "store": {
           "pointer": "0x2",
           "items": [
             {
               "cluster": "x",
               "pointer": "0x3",
               "items": [

clang/test/Analysis/exploded-graph-rewriter/store_diff.dot

"{
           "has_report": 0, "is_sink": 0
         }
       ],
       "program_state": {
         "environment": null,
         "constraints": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": null,
         "store": {
           "pointer": "0x2",
           "items": [
             {
               "cluster": "x",
               "pointer": "0x3",
               "items": [
"{
           "has_report": 0, "is_sink": 0
         }
       ],
       "program_state": {
         "environment": null,
         "constraints": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": null,
         "store": {
           "pointer": "0x5",
           "items": [
             {
               "cluster": "x",
               "pointer": "0x3",
               "items": [

clang/test/Analysis/exploded-graph-rewriter/topology.dot

"{
           "has_report": 0, "is_sink": 0
         }
       ],
       "program_state": {
         "environment": null,
         "constraints": null,
         "dynamic_types": null,
         "constructing_objects": null,
+        "index_of_element": null,
         "checker_messages": [
           { "checker": "foo", "messages": ["bar"] }
         ],
         "store": null
       }
     }
 \l}"];

clang/test/Analysis/handle_constructors_with_new_array.cpp

 }
 
 void test_automatic_aggregate() {
 
   init_with_list a1[1];
   init_in_body a2[1];
   init_default_member a3[1];
 
-  // FIXME: Should be TRUE, not FALSE.
-  clang_analyzer_eval(a1[0].a == 1); // expected-warning {{TRUE}} expected-warning {{FALSE}}
-  // FIXME: Should be TRUE, not FALSE.
-  clang_analyzer_eval(a2[0].a == 1); // expected-warning {{TRUE}} expected-warning {{FALSE}}
-  // FIXME: Should be TRUE, not FALSE.
-  clang_analyzer_eval(a3[0].a == 1); // expected-warning {{TRUE}} expected-warning {{FALSE}}
+  clang_analyzer_eval(a1[0].a == 1); // expected-warning {{TRUE}}
+  clang_analyzer_eval(a2[0].a == 1); // expected-warning {{TRUE}}
+  clang_analyzer_eval(a3[0].a == 1); // expected-warning {{TRUE}}
 }
 
 void test_dynamic_aggregate() {
 
   auto *a1 = new init_with_list[1];
   auto *a2 = new init_in_body[1];
   auto *a3 = new init_default_member[1];
 
-  // FIXME: Should be TRUE, not FALSE.
-  clang_analyzer_eval(a1[0].a == 1); // expected-warning {{TRUE}} expected-warning {{FALSE}}
-  // FIXME: Should be TRUE, not FALSE.
-  clang_analyzer_eval(a2[0].a == 1); // expected-warning {{TRUE}} expected-warning {{FALSE}}
-  // FIXME: Should be TRUE, not FALSE.
-  clang_analyzer_eval(a3[0].a == 1); // expected-warning {{TRUE}} expected-warning {{FALSE}}
+  clang_analyzer_eval(a1[0].a == 1); // expected-warning {{TRUE}}
+  clang_analyzer_eval(a2[0].a == 1); // expected-warning {{TRUE}}
+  clang_analyzer_eval(a3[0].a == 1); // expected-warning {{TRUE}}
 
   delete[] a1;
   delete[] a2;
   delete[] a3;
 }

clang/test/Analysis/new-ctor-conservative.cpp

void checkNewPOD() {
   int *i = new int;
   clang_analyzer_eval(*i == 0); // expected-warning{{UNKNOWN}}
   int *j = new int();
   clang_analyzer_eval(*j == 0); // expected-warning{{TRUE}}
   int *k = new int(5);
   clang_analyzer_eval(*k == 5); // expected-warning{{TRUE}}
 }
 
 void checkNewArray() {
   S *s = new S[10];
-  // FIXME: Should be true once we inline array constructors.
+
+  // FIXME: Handle big array construction
   clang_analyzer_eval(s[0].x == 1); // expected-warning{{UNKNOWN}}
   clang_analyzer_eval(s[1].x == 1); // expected-warning{{UNKNOWN}}
+
+  s = new S[4];
+  clang_analyzer_eval(s[0].x == 1); // expected-warning{{TRUE}}
+  clang_analyzer_eval(s[1].x == 1); // expected-warning{{TRUE}}
 }
 
 struct NullS {
   NullS() {
     if (this) {}
   }
   NullS(int x) {
     if (!this) {
       clang_analyzer_warnIfReached(); // no-warning
     }
   }
 };
 
 void checkNullThis() {
   NullS *nulls = new NullS(); // no-crash
   NullS *nulls2 = new NullS(0);
 }

clang/test/Analysis/new.cpp

 void testArrayNull() {
   NoReturnDtor *fooArray = 0;
   delete[] fooArray; // should not call destructor, checked below
   clang_analyzer_eval(true); // expected-warning{{TRUE}}
 }
 
 void testArrayDestr() {
   NoReturnDtor *p = new NoReturnDtor[2];
-  delete[] p; // Calls the base destructor which aborts, checked below
-   //TODO: clang_analyzer_eval should not be called
+  delete[] p;                // Calls the base destructor which aborts, checked below
+                             // TODO: clang_analyzer_eval should not be called
   clang_analyzer_eval(true); // expected-warning{{TRUE}}
 }
 
 // Invalidate Region even in case of default destructor
 class InvalidateDestTest {
 public:
   int x;
   int *y;

clang/test/Analysis/operator-calls.cpp

struct B {
     int x;
     A a[3];
     B& operator=(B&) = default;
     B& operator=(B&&) = default;
   };
 
   // This used to produce a warning about the iteration variable in the
   // synthesized assignment operator being undefined.
   void testNoWarning() {
     B v, u;
-    u = v;
+
+    v.a[0].a = 0;
+    v.a[1].a = 0;
+    v.a[2].a = 0;
+
+    u = v; // expected-warning@99 {{Assigned value is garbage or undefined}}
   }
 
   void testNoWarningMove() {
     B v, u;
-    u = static_cast<B &&>(v);
+
+    v.a[0].a = 0;
+    v.a[1].a = 0;
+    v.a[2].a = 0;
+
+    u = static_cast<B &&>(v); // expected-warning@100 {{Assigned value is garbage or undefined}}
   }
 
   void testConsistency() {
     B v, u;
+    v.x = 0;
+    v.a[0].a = 24;
     v.a[1].a = 47;
     v.a[2].a = 42;
     u = v;
+    clang_analyzer_eval(u.a[0].a == -24); // expected-warning{{TRUE}}
     clang_analyzer_eval(u.a[1].a == -47); // expected-warning{{TRUE}}
     clang_analyzer_eval(u.a[2].a == -42); // expected-warning{{TRUE}}
   }
 
   void testConsistencyMove() {
     B v, u;
+    v.x = 0;
+    v.a[0].a = 24;
     v.a[1].a = 47;
     v.a[2].a = 42;
     u = static_cast<B &&>(v);
+    clang_analyzer_eval(u.a[0].a == 25); // expected-warning{{TRUE}}
     clang_analyzer_eval(u.a[1].a == 48); // expected-warning{{TRUE}}
     clang_analyzer_eval(u.a[2].a == 43); // expected-warning{{TRUE}}
   }
 }

clang/utils/analyzer/exploded-graph-rewriter.py

def diff_bindings(self, prev):
         return diff_dicts(self.bindings, prev.bindings)
 
     def is_different(self, prev):
         removed, added = self.diff_bindings(prev)
         return len(removed) != 0 or len(added) != 0
 
 
 # A deserialized Environment. This class can also hold other entities that
-# are similar to Environment, such as Objects Under Construction.
+# are similar to Environment, such as Objects Under Construction or 
+# Indices Of Elements Under Construction.
 class GenericEnvironment:
     def __init__(self, json_e):
         self.frames = [EnvironmentFrame(f) for f in json_e]
 
     def diff_frames(self, prev):
         # TODO: It's difficult to display a good diff when frame numbers shift.
         if len(self.frames) != len(prev.frames):
             return None
def __init__(self, state_id, json_ps):
 
         if json_ps is None:
             json_ps = {
                 'store': None,
                 'environment': None,
                 'constraints': None,
                 'dynamic_types': None,
                 'constructing_objects': None,
+                'index_of_element': None,
                 'checker_messages': None
             }
 
         self.state_id = state_id
 
         self.store = Store(json_ps['store']) \
             if json_ps['store'] is not None else None
 
def __init__(self, state_id, json_ps):
                                         if t['sub_classable'] else ''))
                 for t in json_ps['dynamic_types']]) \
             if json_ps['dynamic_types'] is not None else None
 
         self.constructing_objects = \
             GenericEnvironment(json_ps['constructing_objects']) \
             if json_ps['constructing_objects'] is not None else None
 
+        self.index_of_element = \
+            GenericEnvironment(json_ps['index_of_element']) \
+            if json_ps['index_of_element'] is not None else None
+
         self.checker_messages = CheckerMessages(json_ps['checker_messages']) \
             if json_ps['checker_messages'] is not None else None
 
 
 # A deserialized exploded graph node. Has a default constructor because it
 # may be referenced as part of an edge before its contents are deserialized,
 # and in this moment we already need a room for predecessors and successors.
 class ExplodedNode:
def visit_state(self, s, prev_s):
                                         s, prev_s)
         self.visit_generic_map_in_state('constraints', 'Ranges',
                                         s, prev_s)
         self.visit_generic_map_in_state('dynamic_types', 'Dynamic Types',
                                         s, prev_s)
         self.visit_environment_in_state('constructing_objects',
                                         'Objects Under Construction',
                                         s, prev_s)
+        self.visit_environment_in_state('index_of_element',
+                                        'Indices Of Elements Under Construction',
+                                        s, prev_s)
         self.visit_checker_messages_in_state(s, prev_s)
 
     def visit_node(self, node):
         self._dump('%s [shape=record,'
                    % (node.node_name()))
         if self._dark_mode:
             self._dump('color="white",fontcolor="gray80",')
         self._dump('label=<<table border="0">')