[analyzer] Fix crash in exploded graph dumping

[george.karpenkov]

Summary

By allocating new DeclStmt to ASTContext

[NoQ]

Seems legit. Also it seems that this is the only source of out-of-ASTContext statements so far.

lib/Analysis/CFG.cpp

if (DS->isSingleDecl())
     return VisitDeclSubExpr(DS);
 
   CFGBlock *B = nullptr;
 
   // Build an individual DeclStmt for each decl.
   for (DeclStmt::reverse_decl_iterator I = DS->decl_rbegin(),
                                        E = DS->decl_rend();
        I != E; ++I) {
-    // Get the alignment of the new DeclStmt, padding out to >=8 bytes.
-    unsigned A = alignof(DeclStmt) < 8 ? 8 : alignof(DeclStmt);
 
     // Allocate the DeclStmt using the BumpPtrAllocator.  It will get
     // automatically freed with the CFG.
     DeclGroupRef DG(*I);
     Decl *D = *I;
-    void *Mem = cfg->getAllocator().Allocate(sizeof(DeclStmt), A);
-    DeclStmt *DSNew = new (Mem) DeclStmt(DG, D->getLocation(), GetEndLoc(D));
+    DeclStmt *DSNew = new (Context) DeclStmt(DG, D->getLocation(), GetEndLoc(D));
     cfg->addSyntheticDeclStmt(DSNew, DS);
 
     // Append the fake DeclStmt to block.
     B = VisitDeclSubExpr(DSNew);
   }
 
   return B;
 }

test/Analysis/dump_egraph.c

 // RUN: %clang_analyze_cc1 -analyzer-checker=core -analyzer-dump-egraph=%t.dot %s
 // RUN: cat %t.dot | FileCheck %s
 // REQUIRES: asserts
 
 int getJ();
 
 int foo() {
-  int *x = 0;
-  return *x;
+  int *x = 0, *y = 0;
+  return *x + *y;
 }
 
 // CHECK: digraph "Exploded Graph" {
 // CHECK: Edge: (B2, B1)
 // CHECK: Block Entrance: B1
 // CHECK: Bug report attached