[analyzer] Fix BindingDecl evaluation for reference types.

[isuckatcs]

Summary

The case when the bound variable is reference type in a BindingDecl wasn't handled, which lead to false positives.

[Szelethus]

clang/test/Analysis/structured_bindings.cpp

20

I wouldn't use function main unless the tests needs specifically that.

[Szelethus]

I tried poking this from a few directions, like nasty GNU extension types, ObjCObjectPointerType, but those seem orthogonal to this patch. Looks great! I'd wait for someone else's approval as well, as I try my best to pick up the thread.

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

2633

I think a few words might be nice here. It may not be obvious to everyone that the binding is never a reference (https://eel.is/c++draft/dcl.struct.bind#note-1).

[isuckatcs]

Renamed the main function

[xazax.hun]

clang/test/Analysis/structured_bindings.cpp

26

I think we could have a test case where we modify the value of i through x and check that the value of i changed to make sure they actually point to the same memory location, not just happen to have same value.

[isuckatcs]

Updated testcase

[NoQ]

LGTM!

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

if (const auto *BD = dyn_cast<BindingDecl>(D)) {
     }
     // Handle binding to tuple-like strcutures
     else if (BD->getHoldingVar()) {
       // FIXME: handle tuples
       return;
     } else
       llvm_unreachable("An unknown case of structured binding encountered!");
 
+    if (BD->getType()->isReferenceType())
+      V = state->getSVal(V.getAsRegion());
+
     Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr,
                       ProgramPoint::PostLValueKind);
 
     return;
   }
 
   llvm_unreachable("Support for this Decl not implemented.");
 }

clang/test/Analysis/structured_bindings.cpp

-// RUN: %clang_analyze_cc1 -std=c++17 -analyzer-checker=core -verify %s
+// RUN: %clang_analyze_cc1 -std=c++17 -analyzer-checker=core,debug.ExprInspection -verify %s
+
+void clang_analyzer_eval(bool);
 
 struct s { int a; };
 int foo() {
-    auto[a] = s{1}; // FIXME: proper modelling
-    if (a) {
-    }
+  auto [a] = s{1};
+  clang_analyzer_eval(a == 1); // expected-warning{{TRUE}}
 } // expected-warning{{non-void function does not return a value}}
 
+struct s2 {
+  int &x;
+};
+
+int *foo2(s2 in) {
+  auto [a] = in;
+  return &a;
+}
+
+void bar() {
+  int i = 1;
+  s2 a{i};
+
+  auto *x = foo2(a);
+
+  clang_analyzer_eval(*x == i); // expected-warning{{TRUE}}
+
+  *x = 2;
+
+  clang_analyzer_eval(*x == 2); // expected-warning{{TRUE}}
+  clang_analyzer_eval(i == 2);  // expected-warning{{TRUE}}
+}