[analyzer] Fix handling of labels in getLValueElement

[alexander-shaposhnikov]

Summary

In getLValueElement Base may represent the address of a label (as in the newly-added test case),
in this case it's not a loc::MemRegionVal and Base.castAs<loc::MemRegionVal>() triggers an assert.

P.S. It also fixes the old bug reported here https://bugs.llvm.org/show_bug.cgi?id=11611

Test plan: make check-all

[NoQ]

Great. Probably one more reason to turn all Locs into regions.

cfe/trunk/lib/StaticAnalyzer/Core/Store.cpp

SVal StoreManager::getLValueElement(QualType elementType, NonLoc Offset,
                                     SVal Base) {
 
   // If the base is an unknown or undefined value, just return it back.
   // FIXME: For absolute pointer addresses, we just return that value back as
   //  well, although in reality we should return the offset added to that
   //  value. See also the similar FIXME in getLValueFieldOrIvar().
   if (Base.isUnknownOrUndef() || Base.getAs<loc::ConcreteInt>())
     return Base;
   
+  if (Base.getAs<loc::GotoLabel>())
+    return UnknownVal();
+  
   const SubRegion *BaseRegion =
       Base.castAs<loc::MemRegionVal>().getRegionAs<SubRegion>();
 
   // Pointer of any type can be cast and used as array base.
   const ElementRegion *ElemR = dyn_cast<ElementRegion>(BaseRegion);
 
   // Convert the offset to the appropriate size and signedness.
   Offset = svalBuilder.convertToArrayIndex(Offset).castAs<NonLoc>();

cfe/trunk/test/Analysis/ptr-arith.c

void negativeIndex(char *str) {
   ptr2 -= 1;
   clang_analyzer_eval(*ptr2 == 'a'); // expected-warning{{UNKNOWN}}
 
   char *ptr3 = str;
   --ptr3;
   clang_analyzer_eval(*ptr3 == 'a'); // expected-warning{{UNKNOWN}}
 }
 
+void test_no_crash_on_pointer_to_label() {
+  char *a = &&label;
+  a[0] = 0;
+label:;
+}