[analyzer] LoopWidening: fix crash by avoiding aliased references invalidation

[AbbasSabra]

Summary

LoopWidening is invalidating references coming from type aliases which lead to a crash.

[AbbasSabra]

clang-format

[NoQ]

Fair!

[AbbasSabra]

In D80669#2058824, @NoQ wrote:

Fair!

Thanks for the review! May you please take care of merging this one too?

[AbbasSabra]

Gentle reminder

[vsavchenko]

Done, sorry for taking so long!
Thank you for your work!

clang/lib/StaticAnalyzer/Core/LoopWidening.cpp

const MemRegion *Regions[] = {MRMgr.getStackLocalsRegion(STC),
                                 MRMgr.getGlobalsRegion()};
   RegionAndSymbolInvalidationTraits ITraits;
   for (auto *Region : Regions) {
     ITraits.setTrait(Region,
                      RegionAndSymbolInvalidationTraits::TK_EntireMemSpace);
   }
 
   // References should not be invalidated.
-  auto Matches = match(findAll(stmt(hasDescendant(varDecl(hasType(referenceType())).bind(MatchRef)))),
-                       *LCtx->getDecl()->getBody(), ASTCtx);
+  auto Matches = match(
+      findAll(stmt(hasDescendant(
+          varDecl(hasType(hasCanonicalType(referenceType()))).bind(MatchRef)))),
   for (BoundNodes Match : Matches) {
     const VarDecl *VD = Match.getNodeAs<VarDecl>(MatchRef);
     assert(VD);
     const VarRegion *VarMem = MRMgr.getVarRegion(VD, LCtx);
     ITraits.setTrait(VarMem,
                      RegionAndSymbolInvalidationTraits::TK_PreserveContents);
   }
 

clang/test/Analysis/loop-widening-preserve-reference-type.cpp

 // RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify %s
 
 void clang_analyzer_eval(int);
 
 struct A {
   ~A() {}
 };
 struct B : public A {};
 
 void invalid_type_region_access() {
   const A &x = B();
   for (int i = 0; i < 10; ++i) { }
   clang_analyzer_eval(&x != 0); // expected-warning{{TRUE}}
 }                               // expected-warning@-1{{reference cannot be bound to dereferenced null pointer in well-defined C++ code; comparison may be assumed to always evaluate to true}}
+
+using AR = const A &;
+void invalid_type_alias_region_access() {
+  AR x = B();
+  for (int i = 0; i < 10; ++i) {
+  }
+  clang_analyzer_eval(&x != 0); // expected-warning{{TRUE}}
+} // expected-warning@-1{{reference cannot be bound to dereferenced null pointer in well-defined C++ code; comparison may be assumed to always evaluate to true}}