[analyzer] Cleanup some artifacts from non-POD array evaluation

[isuckatcs]

Summary

Most of the state traits used for non-POD array evaluation were
only cleaned up if the ctors/dtors were inlined, since the cleanup
happened in ExprEngine::processCallExit(). This patch makes sure
they are removed even if said functions are not inlined.

[isuckatcs]

Updated

[NoQ]

Ohh great thanks!!

I wish we had asserts to catch this but that's not urgent I suppose.

[isuckatcs]

I wish we had asserts to catch this but that's not urgent I suppose.

You mean asserts that check whether the states are empty before they are cleaned up or some specific asserts regarding this patch?

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

if (const auto *CAT = dyn_cast<ConstantArrayType>(CE->getType())) {
     // if the constructors of the array elements are inlined, the destructors
     // can also be inlined and if the destructors can be inline, it's safe to
     // inline the constructors.
     return shouldInlineArrayDestruction(ArrSize);
   }
 
   // Check if we're inside an ArrayInitLoopExpr, and it's sufficiently small.
   if (auto Size = getPendingInitLoop(State, CE, LCtx))
-    return *Size <= AMgr.options.maxBlockVisitOnPath;
+    return shouldInlineArrayDestruction(*Size);
 
   return false;
 }
 
 bool ExprEngine::shouldInlineArrayDestruction(uint64_t Size) {
 
   uint64_t maxAllowedSize = AMgr.options.maxBlockVisitOnPath;
 
if (shouldInlineCall(*Call, D, Pred, CallOpts)) {
           return;
         }
       }
       ctuBifurcate(*Call, D, Bldr, Pred, State);
       return;
     }
   }
 
-  // If we can't inline it, handle the return value and invalidate the regions.
+  // If we can't inline it, clean up the state traits used only if the function
+  // is inlined.
+  if (const auto *CE = dyn_cast_or_null<CXXConstructExpr>(E)) {
+    const auto *LCtx = Call->getLocationContext();
+    if (getPendingInitLoop(State, CE, LCtx))
+      State = removePendingInitLoop(State, CE, LCtx);
+
+    if (getIndexOfElementToConstruct(State, CE, LCtx))
+      State = removeIndexOfElementToConstruct(State, CE, LCtx);
+
+    if (getPendingArrayDestruction(State, LCtx))
+      State = removePendingArrayDestruction(State, LCtx);
+  }
+
+  // Also handle the return value and invalidate the regions.
   conservativeEvalCall(*Call, Bldr, Pred, State);
 }
 
 void ExprEngine::BifurcateCall(const MemRegion *BifurReg,
                                const CallEvent &Call, const Decl *D,
                                NodeBuilder &Bldr, ExplodedNode *Pred) {
   assert(BifurReg);
   BifurReg = BifurReg->StripCasts();