[analyzer] Handle case of undefined values in performTrivialCopy

[ilya-palachev]

Summary

This patch fixes the assertion crash recently detected on some Tizen code. Since this code pattern is quite rare, it hasn't been handled yet. The patch extends the asserted statement so that to make it appropriate to possible undefined values.

[NoQ]

This seems correct. Loading from a garbage pointer should be modeled as garbage, and/or caught by a checker. performTrivialCopy is a high-level thingy that should be able to deal with any SVal input.

The checker's warning message looks really weird, hard to figure out where's the call here, s/Function/Operator/ could have been an improvement, but that's another story.

cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

void ExprEngine::performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
 
   SVal V = Call.getArgSVal(0);
 
   // If the value being copied is not unknown, load from its location to get
   // an aggregate rvalue.
   if (Optional<Loc> L = V.getAs<Loc>())
     V = Pred->getState()->getSVal(*L);
   else
-    assert(V.isUnknown());
+    assert(V.isUnknownOrUndef());
 
   const Expr *CallExpr = Call.getOriginExpr();
   evalBind(Dst, CallExpr, Pred, ThisVal, V, true);
 
   PostStmt PS(CallExpr, LCtx);
   for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end();
        I != E; ++I) {
     ProgramStateRef State = (*I)->getState();

cfe/trunk/test/Analysis/uninit-vals.cpp

+// RUN: %clang_cc1 -analyze -analyzer-checker=core.builtin -verify -DCHECK_FOR_CRASH %s
+// RUN: %clang_cc1 -analyze -analyzer-checker=core -verify %s
+
+#ifdef CHECK_FOR_CRASH
+// expected-no-diagnostics
+#endif
+
+namespace PerformTrivialCopyForUndefs {
+struct A {
+  int x;
+};
+
+struct B {
+  A a;
+};
+
+struct C {
+  B b;
+};
+
+void foo() {
+  C c1;
+  C *c2;
+#ifdef CHECK_FOR_CRASH
+  // If the value of variable is not defined and checkers that check undefined
+  // values are not enabled, performTrivialCopy should be able to handle the
+  // case with undefined values, too.
+  c1.b.a = c2->b.a;
+#else
+  c1.b.a = c2->b.a; // expected-warning{{Function call argument is an uninitialized value}}
+#endif
+}
+}
+