[analyzer] add range check for InitList lookup

[r.stahl]

Summary

Fixes issue introduced by rC331556.

Closes bug: https://bugs.llvm.org/show_bug.cgi?id=37357

[alexfh]

Thank you for the fix!
LG

The fix looks trivial and I'll commit your patch to unblock our internal release. If there are comments from other reviewers, they can be resolved post-commit.

[george.karpenkov]

Looks good, thanks!

lib/StaticAnalyzer/Core/RegionStore.cpp

if (const Expr *Init = FD->getInClassInitializer())
       if (Optional<SVal> V = svalBuilder.getConstantVal(Init))
         return *V;
 
   // If the containing record was initialized, try to get its constant value.
   const MemRegion* superR = R->getSuperRegion();
   if (const auto *VR = dyn_cast<VarRegion>(superR)) {
     const VarDecl *VD = VR->getDecl();
     QualType RecordVarTy = VD->getType();
+    unsigned Index = FD->getFieldIndex();
     // Either the record variable or the field has to be const qualified.
     if (RecordVarTy.isConstQualified() || Ty.isConstQualified())
       if (const Expr *Init = VD->getInit())
         if (const auto *InitList = dyn_cast<InitListExpr>(Init))
-          if (const Expr *FieldInit = InitList->getInit(FD->getFieldIndex()))
+          if (Index < InitList->getNumInits())
+            if (const Expr *FieldInit = InitList->getInit(Index))
               if (Optional<SVal> V = svalBuilder.getConstantVal(FieldInit))
                 return *V;
   }
 
   return getBindingForFieldOrElementCommon(B, R, Ty);
 }
 
 Optional<SVal>
 RegionStoreManager::getBindingForDerivedDefaultValue(RegionBindingsConstRef B,
                                                      const MemRegion *superR,

test/Analysis/initialization.c

+// RUN: %clang_analyze_cc1 -analyzer-checker=core -verify %s
+// expected-no-diagnostics
+
+void initbug() {
+  const union { float a; } u = {};
+  (void)u.a; // no-crash
+}
+