[clang] [analyzer] Variant checker bindings (PR #87886)

[Donát Nagy via cfe-commits]

================
@@ -602,6 +619,37 @@ void ExprEngine::VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
       ExplodedNode *UpdatedN = N;
       SVal InitVal = state->getSVal(InitEx, LC);
 
+      // The call expression to which we have bound something is hidden behind
+      // an implicit cast expression.
+
+      // This is a workaround for those checkers that are evaluating calls
+      // with return value, and are "behind" a cast expression. A good example
+      // for this is std::variant checker.
+      // Let's see the following code as an example:
+      //
+      // int a = std::get<int>(v);
+      //
+      // The AST for the std::get call shall look something like this:
+      //
+      // ImplicitCastExpr <FunctionToPointerDecay>
+      // `-CallExpr
+      //
+      // First the handling of `ImplicitCastExpr <FunctionToPointerDecay>`
+      // happens in the ExprEngine::VisitCast function. After that
+      // std::variant checker evaluates the std::get call and binds
+      // an SVal to the call expression. The problem here is that
+      // the handling of the casting is the responsible to bind the
+      // sub expressions (in our case std::get call expressions) value
+      // to the cast expression.
+      if (auto *AsImplCast = dyn_cast_or_null<CastExpr>(InitEx);
+          AsImplCast && InitVal.isUndef()) {
+        // InitVal = state->getSVal(AsImplCast->getSubExpr(), LC);
----------------
NagyDonat wrote:

Why is this line commented out?

https://github.com/llvm/llvm-project/pull/87886