[analyzer] Don't crash when the code tries to construct an Objective-C object in AllocaRegion.

[NoQ]

Summary

The analyzer crashes when the user tries to allocate stack memory through alloca() and then construct an Objective-C object in it. The alloca() function is handled in the analyzer by its own concrete untyped memory region, AllocaRegion, which doesn't contain any clues on what type it might carry (because there are none). getDynamicTypeInfo() therefore ignores it unless a specific type info is already available.

To think: maybe we could pickup some dynamic type info from the implicit cast. We don't always have an implicit cast though.

[NoQ]

Turn the comment into an assertion.

cfe/trunk/lib/StaticAnalyzer/Core/CallEvent.cpp

if (!SupersType.isNull()) {
       // where the call occurs.
       ReceiverT = cast<ObjCObjectPointerType>(SupersType);
     } else {
       Receiver = getReceiverSVal().getAsRegion();
       if (!Receiver)
         return RuntimeDefinition();
 
       DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
+      if (!DTI.isValid()) {
+        assert(isa<AllocaRegion>(Receiver) &&
+               "Unhandled untyped region class!");
+        return RuntimeDefinition();
+      }
+
       QualType DynType = DTI.getType();
       CanBeSubClassed = DTI.canBeASubClass();
       ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
 
       if (ReceiverT && CanBeSubClassed)
         if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
           if (!canBeOverridenInSubclass(IDecl, Sel))
             CanBeSubClassed = false;

cfe/trunk/test/Analysis/DynamicTypePropagation.m

 // RUN: %clang_analyze_cc1 -analyzer-checker=core,osx.cocoa.ObjCGenerics -verify %s
 
 #if !__has_feature(objc_generics)
 #  error Compiler does not support Objective-C generics?
 #endif
 
+typedef __typeof(sizeof(int)) size_t;
+void *memset(void *, int, size_t);
+
 #define nil 0
 typedef unsigned long NSUInteger;
 typedef int BOOL;
 
 @protocol NSCopying
 @end
 
 __attribute__((objc_root_class))
 @interface NSObject
 - (void) myFunction:(int*)p myParam:(int) n;
 @end
 
 @interface MyType : NSObject <NSCopying>
 - (void) myFunction:(int*)p myParam:(int) n;
 @end
 
 @interface NSArray<ObjectType> : NSObject
+- (void) init;
 - (BOOL)contains:(ObjectType)obj;
 - (ObjectType)getObjAtIndex:(NSUInteger)idx;
 - (ObjectType)objectAtIndexedSubscript:(NSUInteger)idx;
 @property(readonly) ObjectType firstObject;
 @end
 
 @implementation NSObject
 - (void) myFunction:(int*)p myParam:(int) n {

 
 void testArgument(NSArray<MyType *> *arr, id element) {
   NSArray *erased = arr;
   [erased contains: element];
   // TODO: myFunction currently is not dispatched to MyType. Make it dispatch to
   // MyType!
   [element myFunction:0 myParam:0 ];
 }
+
+// Do not try this at home! The analyzer shouldn't crash though when it
+// tries to figure out the dynamic type behind the alloca's return value.
+void testAlloca(size_t NSArrayClassSizeWeKnowSomehow) {
+  NSArray *arr = __builtin_alloca(NSArrayClassSizeWeKnowSomehow);
+  memset(arr, 0, NSArrayClassSizeWeKnowSomehow);
+  [arr init]; // no-crash
+}