[analyzer] pr32088: Don't destroy the temporary if its initializer causes return.

[NoQ]

Summary

In the following code involving GNU statement-expression extension:

struct S {
  ~S();
};

void foo() {
  const S &x = ({ return; S(); });
}

function foo() returns before reference x is initialized. We shouldn't call the destructor for the temporary object lifetime-exteneded by x in this case, because the object never gets constructed in the first place.

The real problem is probably in the CFG somewhere, so this is a quick-and-dirty hotfix rather than the perfect solution.

[dcoughlin]

Seems like a safe quick fix for the crash. Looks good to me!

lib/StaticAnalyzer/Core/ExprEngine.cpp

void ExprEngine::ProcessAutomaticObjDtor(const CFGAutomaticObjDtor Dtor,
   const VarDecl *varDecl = Dtor.getVarDecl();
   QualType varType = varDecl->getType();
 
   ProgramStateRef state = Pred->getState();
   SVal dest = state->getLValue(varDecl, Pred->getLocationContext());
   const MemRegion *Region = dest.castAs<loc::MemRegionVal>().getRegion();
 
   if (varType->isReferenceType()) {
-    Region = state->getSVal(Region).getAsRegion()->getBaseRegion();
+    const MemRegion *ValueRegion = state->getSVal(Region).getAsRegion();
+    if (!ValueRegion) {
+      // FIXME: This should not happen. The language guarantees a presence
+      // of a valid initializer here, so the reference shall not be undefined.
+      // It seems that we're calling destructors over variables that
+      // were not initialized yet.
+      return;
+    }
+    Region = ValueRegion->getBaseRegion();
     varType = cast<TypedValueRegion>(Region)->getValueType();
   }
 
   VisitCXXDestructor(varType, Region, Dtor.getTriggerStmt(), /*IsBase=*/ false,
                      Pred, Dst);
 }
 
 void ExprEngine::ProcessDeleteDtor(const CFGDeleteDtor Dtor,

test/Analysis/temporaries.cpp

namespace PR16629 {
   }
 
   void testConsistency() {
     int x;
     callSet(A(&x));
     clang_analyzer_eval(x == 47); // expected-warning{{TRUE}}
   }
 }
+
+namespace PR32088 {
+  void testReturnFromStmtExprInitializer() {
+    // We shouldn't try to destroy the object pointed to by `obj' upon return.
+    const NonTrivial &obj = ({
+      return; // no-crash
+      NonTrivial(42);
+    });
+  }
+}