[analyzer] Fix crash in GenericTaintChecker when propagatig taint to AllocaRegion

[tomasz-kaminski-sonarsource]

Summary

The GenericTaintChecker checker was crashing, when the taint
was propagated to AllocaRegion region in following code:

int x;
void* p = alloca(10);
mempcy(p, &x, sizeof(x));

This crash was caused by the fact that determining type of
AllocaRegion returns a null QualType.

This patch makes AllocaRegion expose its type as void,
making them consistent with results of malloc or new
that produce SymRegion with void* symbol.

[tomasz-kaminski-sonarsource]

I belive this fix to be the correct approach, as it reduces the number of edge cases to deal with.
We are using it on internal fork for over a year now, and haven't found any negative impact.

[steakhal]

Makes sense to me. Please, someone else also have a look.

[xazax.hun]

LGTM!

clang/lib/StaticAnalyzer/Core/SVals.cpp

QualType VisitNonLocLazyCompoundVal(nonloc::LazyCompoundVal LCV) {
     return LCV.getRegion()->getValueType();
   }
   QualType VisitNonLocSymbolVal(nonloc::SymbolVal SV) {
     return Visit(SV.getSymbol());
   }
   QualType VisitSymbolicRegion(const SymbolicRegion *SR) {
     return Visit(SR->getSymbol());
   }
+  QualType VisitAllocaRegion(const AllocaRegion *) {
+    return QualType{Context.VoidPtrTy};
+  }
   QualType VisitTypedRegion(const TypedRegion *TR) {
     return TR->getLocationType();
   }
   QualType VisitSymExpr(const SymExpr *SE) { return SE->getType(); }
 };
 } // end anonymous namespace
 
 QualType SVal::getType(const ASTContext &Context) const {

clang/test/Analysis/taint-generic.c

 
 // Zero-sized VLAs.
 void testTaintedVLASize(void) {
   int x;
   scanf("%d", &x);
   int vla[x]; // expected-warning{{Declared variable-length array (VLA) has tainted size}}
 }
 
+int testTaintedAllocaMem() {
+  char x;
+  void * p;
+  scanf("%c", &x);
+  p = __builtin_alloca(1);
+  __builtin_memcpy(p, &x, 1);
+  return 5 / *(char*)p; // expected-warning {{Division by a tainted value, possibly zero}}
+}
+
+int testTaintedMallocMem() {
+  char x;
+  void * p;
+  scanf("%c", &x);
+  p = malloc(1);
+  __builtin_memcpy(p, &x, 1);
+  return 5 / *(char*)p; // expected-warning {{Division by a tainted value, possibly zero}}
+}
+
+
 // This computation used to take a very long time.
 #define longcmp(a,b,c) { \
   a -= c;  a ^= c;  c += b; b -= a;  b ^= (a<<6) | (a >> (32-b));  a += c; c -= b;  c ^= b;  b += a; \
   a -= c;  a ^= c;  c += b; b -= a;  b ^= a;  a += c; c -= b;  c ^= b;  b += a; }
 
 unsigned radar11369570_hanging(const unsigned char *arr, int l) {
   unsigned a, b, c;
   a = b = c = 0x9899e3 + l;