[analyzer] Don't dereference the array bound to a reference.

[NoQ]

Summary

An attempt to fix pr31592 (https://llvm.org/bugs/show_bug.cgi?id=31592), more sensible than what i did in the hot pre-4.0-release fix in r291754 (http://lists.llvm.org/pipermail/cfe-commits/Week-of-Mon-20170109/182399.html), which this patch reverts.

That's the place where we model member array initializers, and i'm adding a special case for reference-to-array initializers.

lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp

void DereferenceChecker::checkBind(SVal L, SVal V, const Stmt *S,
   const MemRegion *MR = L.getAsRegion();
   const TypedValueRegion *TVR = dyn_cast_or_null<TypedValueRegion>(MR);
   if (!TVR)
     return;
 
   if (!TVR->getValueType()->isReferenceType())
     return;
 
-  // FIXME: This is a hotfix for https://llvm.org/bugs/show_bug.cgi?id=31592
-  // A proper fix is very much necessary. Otherwise we would never normally bind
-  // a NonLoc to a reference.
-  if (V.getAs<NonLoc>())
-    return;
-
   ProgramStateRef State = C.getState();
 
   ProgramStateRef StNonNull, StNull;
   std::tie(StNonNull, StNull) = State->assume(V.castAs<DefinedOrUnknownSVal>());
 
   if (StNull) {
     if (!StNonNull) {
       const Expr *expr = getDereferenceExpr(S, /*IsBind=*/true);

lib/StaticAnalyzer/Core/ExprEngine.cpp

if (auto *CtorExpr = findDirectConstructorForCurrentCFGElement()) {
       if (Init->getType()->isArrayType()) {
         // Handle arrays of trivial type. We can represent this with a
         // primitive load/copy from the base array region.
         const ArraySubscriptExpr *ASE;
         while ((ASE = dyn_cast<ArraySubscriptExpr>(Init)))
           Init = ASE->getBase()->IgnoreImplicit();
 
         SVal LValue = State->getSVal(Init, stackFrame);
+        if (!Field->getType()->isReferenceType())
           if (Optional<Loc> LValueLoc = LValue.getAs<Loc>())
             InitVal = State->getSVal(*LValueLoc);
 
         // If we fail to get the value for some reason, use a symbolic value.
         if (InitVal.isUnknownOrUndef()) {
           SValBuilder &SVB = getSValBuilder();
           InitVal = SVB.conjureSymbolVal(BMI->getInit(), stackFrame,
                                          Field->getType(),
                                          currBldrCtx->blockCount());
         }