[analyzer] Fix crashing getSValFromInitListExpr for nested initlists

[steakhal]

Summary

In the following example, we will end up hitting the llvm_unreachable():
https://godbolt.org/z/5sccc95Ec

enum class E {};
const E glob[] = {{}};
void initlistWithinInitlist() {
  clang_analyzer_dump(glob[0]); // crashes at loading from `glob[0]`
}

We should just return std::nullopt instead for these cases. It's better than crashing.

[steakhal]

I think this one also deserves backporting to clang-16.0.1 @xazax.hun

[xazax.hun]

Ugh :/

I wonder if we should also open tickets on GitHub to reduce the chance of forgetting addressing the root cause for these. What do you think?

[steakhal]

In D146538#4210037, @xazax.hun wrote:

Ugh :/

I wonder if we should also open tickets on GitHub to reduce the chance of forgetting addressing the root cause for these. What do you think?

Thanks for the quick review!

I think it would be valuable to track these FIXMEs as issues indeed. However, I don't have the time right now to file them.
Good tickets would require a bit more effort than I could invest now.

[steakhal]

Speaking of issue tracking, I think it would be much more valuable to our users if we had a proper release notes section for CSA. Right now it is so ad-hoc.
That is also true for crash fixes and backports. Maybe we should put more emphasis on that part for the next major release.
I'm not sure how to enforce it though.

[steakhal]

This has been backported to clang-16.0.1 as 1172ed57d8234990b277281b3084969fcdb38602

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

for (uint64_t Offset : Offsets) {
     if (!IL)
       // Return a constant value, if it is presented.
       // FIXME: Support other SVals.
       return svalBuilder.getConstantVal(E);
 
     // Go to the nested initializer list.
     ILE = IL;
   }
-  llvm_unreachable(
-      "Unhandled InitListExpr sub-expressions or invalid offsets.");
+
+  assert(ILE);
+
+  // FIXME: Unhandeled InitListExpr sub-expression, possibly constructing an
+  //        enum?
+  return std::nullopt;
 }
 
 /// Returns an SVal, if possible, for the specified position in a string
 /// literal.
 ///
 /// \param SL The given string literal.
 /// \param Offset The unsigned offset. E.g. for the expression
 ///   `char x = str[42];` an offset should be 42.

clang/test/Analysis/initialization.cpp

void glob_array_parentheses1() {
   clang_analyzer_eval(glob_arr9[0][1] == 2); // expected-warning{{TRUE}}
   clang_analyzer_eval(glob_arr9[0][2] == 3); // expected-warning{{TRUE}}
   clang_analyzer_eval(glob_arr9[0][3] == 4); // expected-warning{{TRUE}}
   clang_analyzer_eval(glob_arr9[1][0] == 5); // expected-warning{{TRUE}}
   clang_analyzer_eval(glob_arr9[1][1] == 6); // expected-warning{{TRUE}}
   clang_analyzer_eval(glob_arr9[1][2] == 7); // expected-warning{{TRUE}}
   clang_analyzer_eval(glob_arr9[1][3] == 0); // expected-warning{{TRUE}}
 }
+
+enum class E {};
+const E glob[] = {{}};
+void initlistWithinInitlist() {
+  // no-crash
+  clang_analyzer_dump(glob[0]); // expected-warning-re {{reg_${{[0-9]+}}<enum E Element{glob,0 S64b,enum E}>}}
+}