[analyzer] Remove pattern matching of lambda capture initializers

[isuckatcs]

Summary

Prior to this patch we handled lambda captures based on their
initializer expression, which resulted in a pattern matching. With
C++17 copy elision the initializer expression can be anything,
and this approach proved to be fragile and a source of crashes.

[steakhal]

clang/test/Analysis/lambdas.cpp

226

It should have said REACHABLE.
How does this pass? @isuckatcs

[isuckatcs]

clang/test/Analysis/lambdas.cpp

226

Oh, it's a nice catch. Yes, it should say REACHABLE indeed.

Also it seems we didn't get a failing test case because this statement is not checked at all. It is inside a block that only runs if the standard is at least c++14, however the tests are only executed with an -std=c++11 flag.

I moved these test cases into their own test file in D135965.

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

for (LambdaExpr::const_capture_init_iterator i = LE->capture_init_begin(),
     SVal FieldLoc = State->getLValue(FieldForCapture, V);
 
     SVal InitVal;
     if (!FieldForCapture->hasCapturedVLAType()) {
       const Expr *InitExpr = *i;
 
       assert(InitExpr && "Capture missing initialization expression");
 
-      if (const auto AILE = dyn_cast<ArrayInitLoopExpr>(InitExpr)) {
-        // If the AILE initializes a POD array, we need to keep it as the
-        // InitExpr.
-        if (dyn_cast<CXXConstructExpr>(AILE->getSubExpr()))
-          InitExpr = AILE->getSubExpr();
-      }
-
-      // With C++17 copy elision this can happen.
-      if (const auto *FC = dyn_cast<CXXFunctionalCastExpr>(InitExpr))
-        InitExpr = FC->getSubExpr();
-
-      assert(InitExpr &&
-             "Extracted capture initialization expression is missing");
-
-      if (dyn_cast<CXXConstructExpr>(InitExpr)) {
-        InitVal = *getObjectUnderConstruction(State, {LE, Idx}, LocCtxt);
-        InitVal = State->getSVal(InitVal.getAsRegion());
+      // With C++17 copy elision the InitExpr can be anything, so instead of
+      // pattern matching all cases, we simple check if the current field is
+      // under construction or not, regardless what it's InitExpr is.
+      if (const auto OUC =
+              getObjectUnderConstruction(State, {LE, Idx}, LocCtxt)) {
+        InitVal = State->getSVal(OUC->getAsRegion());
 
         State = finishObjectConstruction(State, {LE, Idx}, LocCtxt);
       } else
         InitVal = State->getSVal(InitExpr, LocCtxt);
 
     } else {
 
       assert(!getObjectUnderConstruction(State, {LE, Idx}, LocCtxt) &&

clang/test/Analysis/lambdas.cpp

 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,deadcode,debug.ExprInspection -analyzer-config inline-lambdas=true -verify %s
 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core -analyzer-config inline-lambdas=false -DNO_INLINING=1 -verify %s
 // RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,debug.DumpCFG -analyzer-config inline-lambdas=true %s > %t 2>&1
 // RUN: FileCheck --input-file=%t %s
 
+#include "Inputs/system-header-simulator-cxx.h"
+
 void clang_analyzer_warnIfReached();
 void clang_analyzer_eval(int);
 
 #ifdef NO_INLINING
 
 // expected-no-diagnostics
 
 int& invalidate_static_on_unknown_lambda() {

 };
 
 void testCopyElidedObjectCaptured(int x) {
   [e = Elided(x)] {
     clang_analyzer_eval(e.x == 0); // expected-warning{{TRUE}}
   }();
 }
 
+static auto MakeUniquePtr() { return std::make_unique<std::vector<int>>(); }
+
+void testCopyElidedUniquePtr() {
+  [uniquePtr = MakeUniquePtr()] {}();
+  clang_analyzer_warnIfReached(); // expected-warning{{TRUE}}
+}
+
 #endif
 
 // Test inline defensive checks
 int getNum();
 
 void inlineDefensiveChecks() {
   int i = getNum();
   [=]() {