[analyzer] Fix a crash on copy elided initialized lambda captures

[isuckatcs]

Summary

struct S {
  S(int) {}
};

void foo(int x) {
  [s = S(x)] {};
}

Before C++17 the AST of s = S(x) is

|-CXXConstructExpr 'S':'S' 'void (S &&) noexcept' elidable
| `-MaterializeTemporaryExpr 'S':'S' xvalue
|   `-CXXFunctionalCastExpr 'S':'S' functional cast to S <ConstructorConversion>
|     `-CXXConstructExpr 'S':'S' 'void (int)'
|       `-ImplicitCastExpr 'int' <LValueToRValue>
|         `-DeclRefExpr 'int' lvalue ParmVar 'x' 'int'

With C++17 copy elision the AST of the same expression is

|-CXXFunctionalCastExpr 0x564d0bbcdfa8 <col:8, col:11> 'S':'S' functional cast to S <ConstructorConversion>
| `-CXXConstructExpr 0x564d0bbcde40 <col:8, col:11> 'S':'S' 'void (int)'
|   `-ImplicitCastExpr 0x564d0bbcdd28 <col:10> 'int' <LValueToRValue>
|     `-DeclRefExpr 0x564d0bbcd990 <col:10> 'int' lvalue ParmVar 0x564d0bbcd7d0 'x' 'int'

The copy elided version wasn't handled, which lead to a crash later.

[NoQ]

Oh right, functional casts *sigh* Thanks!!

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

void ExprEngine::VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
   for (LambdaExpr::const_capture_init_iterator i = LE->capture_init_begin(),
                                                e = LE->capture_init_end();
        i != e; ++i, ++CurField, ++Idx) {
     FieldDecl *FieldForCapture = *CurField;
     SVal FieldLoc = State->getLValue(FieldForCapture, V);
 
     SVal InitVal;
     if (!FieldForCapture->hasCapturedVLAType()) {
-      Expr *InitExpr = *i;
+      const Expr *InitExpr = *i;
+
+      assert(InitExpr && "Capture missing initialization expression");
 
       if (const auto AILE = dyn_cast<ArrayInitLoopExpr>(InitExpr)) {
         // If the AILE initializes a POD array, we need to keep it as the
         // InitExpr.
         if (dyn_cast<CXXConstructExpr>(AILE->getSubExpr()))
           InitExpr = AILE->getSubExpr();
       }
 
-      assert(InitExpr && "Capture missing initialization expression");
+      // With C++17 copy elision this can happen.
+      if (const auto *FC = dyn_cast<CXXFunctionalCastExpr>(InitExpr))
+        InitExpr = FC->getSubExpr();
+
+      assert(InitExpr &&
+             "Extracted capture initialization expression is missing");
 
       if (dyn_cast<CXXConstructExpr>(InitExpr)) {
         InitVal = *getObjectUnderConstruction(State, {LE, Idx}, LocCtxt);
         InitVal = State->getSVal(InitVal.getAsRegion());
 
         State = finishObjectConstruction(State, {LE, Idx}, LocCtxt);
       } else
         InitVal = State->getSVal(InitExpr, LocCtxt);

clang/test/Analysis/lambdas.cpp

void testVariableLengthArrayCaptured() {
 
   int i = [&]{
     return array[0];
   }();
 
   clang_analyzer_eval(i == 7); // expected-warning{{TRUE}}
 }
 
+#if __cplusplus >= 201402L
+// Capture copy elided object.
+
+struct Elided{
+  int x = 0;
+  Elided(int) {}
+};
+
+void testCopyElidedObjectCaptured(int x) {
+  [e = Elided(x)] {
+    clang_analyzer_eval(e.x == 0); // expected-warning{{TRUE}}
+  }();
+}
+
+#endif
+
 // Test inline defensive checks
 int getNum();
 
 void inlineDefensiveChecks() {
   int i = getNum();
   [=]() {
     if (i == 0)
       ;