[clang] [clang][analyzer] Improved PointerSubChecker (PR #93676)

[Donát Nagy via cfe-commits]

================
@@ -44,24 +44,30 @@ void PointerSubChecker::checkPreStmt(const BinaryOperator *B,
 
   const MemRegion *LR = LV.getAsRegion();
   const MemRegion *RR = RV.getAsRegion();
-
-  if (!(LR && RR))
-    return;
-
-  const MemRegion *BaseLR = LR->getBaseRegion();
-  const MemRegion *BaseRR = RR->getBaseRegion();
-
-  if (BaseLR == BaseRR)
+  if (!LR || !RR)
     return;
 
-  // Allow arithmetic on different symbolic regions.
-  if (isa<SymbolicRegion>(BaseLR) || isa<SymbolicRegion>(BaseRR))
-    return;
+  const auto *ElemLR = dyn_cast<ElementRegion>(LR);
+  const auto *ElemRR = dyn_cast<ElementRegion>(RR);
+  // FIXME: We want to verify that these are elements of an array.
+  // Because behavior of ElementRegion it may be confused with a cast.
+  // There is not a simple way to distinguish it from array element (check the
+  // types?). Because this missing check a warning is missing in the rare case
+  // when two casted pointers to the same region (variable) are subtracted.
----------------
NagyDonat wrote:

If two pointers point to the same variable, it's valid to subtract them.

By the way, it's also valid to declare a `long long` variable, point a `char *` pointer at it (`char *` may point anywhere) and use it to iterate over the memory region of the `long long` as if it was a `char[8]`. (By the way in this case you have `ElementRegion`s and your code behaves correctly.)

https://github.com/llvm/llvm-project/pull/93676