Index: clang/lib/Analysis/CFG.cpp =================================================================== --- clang/lib/Analysis/CFG.cpp +++ clang/lib/Analysis/CFG.cpp @@ -1662,11 +1662,15 @@ if (Init) { // If the initializer is an ArrayInitLoopExpr, we want to extract the // initializer, that's used for each element. - const auto *AILE = dyn_cast_or_null(Init); + // If the array is multidimensional, we have nested AILEs and we want + // to extract the initializer from the deepest. + auto *AILEInit = Init; + while (const auto *AILE = dyn_cast_or_null(AILEInit)) + AILEInit = AILE->getSubExpr(); findConstructionContexts( ConstructionContextLayer::create(cfg->getBumpVectorContext(), I), - AILE ? AILE->getSubExpr() : Init); + AILEInit ? AILEInit : Init); if (HasTemporaries) { // For expression with temporaries go directly to subexpression to omit @@ -3370,12 +3374,16 @@ it != et; ++it, ++Idx) { if (Expr *Init = *it) { // If the initializer is an ArrayInitLoopExpr, we want to extract the - // initializer, that's used for each element. - const auto *AILE = dyn_cast_or_null(Init); + // initializer, that's used for each element. + // If the array is multidimensional, we have nested AILEs and we want + // to extract the initializer from the deepest. + auto *AILEInit = Init; + while(const auto *AILE = dyn_cast_or_null(AILEInit)) + AILEInit = AILE->getSubExpr(); findConstructionContexts(ConstructionContextLayer::create( cfg->getBumpVectorContext(), {E, Idx}), - AILE ? AILE->getSubExpr() : Init); + AILEInit ? AILEInit : Init); CFGBlock *Tmp = Visit(Init); if (Tmp) Index: clang/lib/StaticAnalyzer/Core/ExprEngine.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/ExprEngine.cpp +++ clang/lib/StaticAnalyzer/Core/ExprEngine.cpp @@ -537,8 +537,9 @@ Init = Item.getCXXCtorInitializer()->getInit(); // In an ArrayInitLoopExpr the real initializer is returned by - // getSubExpr(). - if (const auto *AILE = dyn_cast_or_null(Init)) + // getSubExpr(). Note that AILEs can be nested in case of + // multidimesnional arrays. + while (const auto *AILE = dyn_cast_or_null(Init)) Init = AILE->getSubExpr(); // FIXME: Currently the state might already contain the marker due to Index: clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp +++ clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp @@ -524,16 +524,35 @@ // | `-DeclRefExpr // `-ArrayInitIndexExpr // + // The resulting expression for a multidimensional array. + // ArrayInitLoopExpr <-- we're here + // |-OpaqueValueExpr + // | `-DeclRefExpr <-- match this + // `-ArrayInitLoopExpr + // |-OpaqueValueExpr + // | `-ArraySubscriptExpr + // | |-ImplicitCastExpr + // | | `-OpaqueValueExpr + // | | `-DeclRefExpr + // | `-ArrayInitIndexExpr + // `-CXXConstructExpr <-- extract this + // ` ... + + const auto *OVESrc = AILE->getCommonExpr()->getSourceExpr(); + + // The array can even be multidimensional. + while(const auto *E = dyn_cast(AILE->getSubExpr())) + AILE = E; + // HACK: There is no way we can put the index of the array element into the // CFG unless we unroll the loop, so we manually select and bind the required // parameter to the environment. const auto *CE = cast(AILE->getSubExpr()); - const auto *OVESrc = AILE->getCommonExpr()->getSourceExpr(); SVal Base = UnknownVal(); if (const auto *ME = dyn_cast(OVESrc)) Base = State->getSVal(ME, LCtx); - else if (const auto *DRE = cast(OVESrc)) + else if (const auto *DRE = dyn_cast(OVESrc)) Base = State->getLValue(cast(DRE->getDecl()), LCtx); else llvm_unreachable("ArrayInitLoopExpr contains unexpected source expression"); @@ -543,6 +562,26 @@ return State->BindExpr(CE->getArg(0), LCtx, NthElem); } +static uint64_t getArrayInitLoopExprSize(const ArrayInitLoopExpr *AILE){ + uint64_t Size = 0; + + // If the array is multidimensional there are nested ArrayInitLoopExprs + // generated for it. We want to loop over them and add the sizes to get + // the size of the whole array. If one sub-array is 0 length, the whole + // array's length is also 0. + while(const auto *E = dyn_cast_or_null(AILE)) + { + auto CurSize = E->getArraySize().getLimitedValue(); + if(CurSize == 0) + return 0; + + Size += CurSize; + AILE = dyn_cast(E->getSubExpr()); + } + + return Size; +} + void ExprEngine::handleConstructor(const Expr *E, ExplodedNode *Pred, ExplodedNodeSet &destNodes) { @@ -597,7 +636,7 @@ // Only set this once even though we loop through it multiple times. if (!getPendingInitLoop(State, CE, LCtx)) State = setPendingInitLoop(State, CE, LCtx, - AILE->getArraySize().getLimitedValue()); + getArrayInitLoopExprSize(AILE)); State = bindRequiredArrayElementToEnvironment( State, AILE, LCtx, svalBuilder.makeArrayIndex(Idx)); @@ -1150,8 +1189,14 @@ if (const auto AILE = dyn_cast(InitExpr)) { // If the AILE initializes a POD array, we need to keep it as the // InitExpr. - if (dyn_cast(AILE->getSubExpr())) - InitExpr = AILE->getSubExpr(); + + // It can even be a multidimensional array. + const auto *AILEInit = InitExpr; + while(const auto *E = dyn_cast(AILEInit)) + AILEInit = E->getSubExpr(); + + if (dyn_cast(AILEInit)) + InitExpr = AILEInit; } // With C++17 copy elision this can happen. Index: clang/test/Analysis/array-init-loop.cpp =================================================================== --- clang/test/Analysis/array-init-loop.cpp +++ clang/test/Analysis/array-init-loop.cpp @@ -223,3 +223,86 @@ clang_analyzer_eval(moved.arr[2].i == 5); // expected-warning{{TRUE}} clang_analyzer_eval(moved.arr[3].i == 6); // expected-warning{{TRUE}} } + +//Note: This is the only solution I could find to check the values without +// crashing clang. For more details on the crash see Issue #57135. +void lambda_capture_multi_array() { + S3 arr[2][2] = {1,2,3,4}; + + { + int x = [arr] { return arr[0][0].i; }(); + clang_analyzer_eval(x == 1); // expected-warning{{TRUE}} + } + + { + int x = [arr] { return arr[0][1].i; }(); + clang_analyzer_eval(x == 2); // expected-warning{{TRUE}} + } + + { + int x = [arr] { return arr[1][0].i; }(); + clang_analyzer_eval(x == 3); // expected-warning{{TRUE}} + } + + { + int x = [arr] { return arr[1][1].i; }(); + clang_analyzer_eval(x == 4); // expected-warning{{TRUE}} + } +} + +// This struct will force constructor inlining in MultiWrapper. +struct UserDefinedCtor { + int i; + UserDefinedCtor() {} + UserDefinedCtor(const UserDefinedCtor ©) { + int j = 1; + i = copy.i; + } +}; + +struct MultiWrapper { + UserDefinedCtor arr[2][2]; +}; + +void copy_ctor_multi() { + MultiWrapper MW; + + MW.arr[0][0].i = 0; + MW.arr[0][1].i = 1; + MW.arr[1][0].i = 2; + MW.arr[1][1].i = 3; + + MultiWrapper MWCopy = MW; + + clang_analyzer_eval(MWCopy.arr[0][0].i == 0); // expected-warning{{TRUE}} + clang_analyzer_eval(MWCopy.arr[0][1].i == 1); // expected-warning{{TRUE}} + clang_analyzer_eval(MWCopy.arr[1][0].i == 2); // expected-warning{{TRUE}} + clang_analyzer_eval(MWCopy.arr[1][1].i == 3); // expected-warning{{TRUE}} +} + +void move_ctor_multi() { + MultiWrapper MW; + + MW.arr[0][0].i = 0; + MW.arr[0][1].i = 1; + MW.arr[1][0].i = 2; + MW.arr[1][1].i = 3; + + MultiWrapper MWMove = (MultiWrapper &&) MW; + + clang_analyzer_eval(MWMove.arr[0][0].i == 0); // expected-warning{{TRUE}} + clang_analyzer_eval(MWMove.arr[0][1].i == 1); // expected-warning{{TRUE}} + clang_analyzer_eval(MWMove.arr[1][0].i == 2); // expected-warning{{TRUE}} + clang_analyzer_eval(MWMove.arr[1][1].i == 3); // expected-warning{{TRUE}} +} + +void structured_binding_multi() { + S3 arr[2][2] = {1,2,3,4}; + + auto [a,b] = arr; + + clang_analyzer_eval(a[0].i == 1); // expected-warning{{TRUE}} + clang_analyzer_eval(a[1].i == 2); // expected-warning{{TRUE}} + clang_analyzer_eval(b[0].i == 3); // expected-warning{{TRUE}} + clang_analyzer_eval(b[1].i == 4); // expected-warning{{TRUE}} +}