[clang] [analyzer] Refine invalidation caused by `fread` (PR #93408)

[Balazs Benics via cfe-commits]

================
@@ -937,8 +990,21 @@ void StreamChecker::evalFreadFwrite(const FnDescription *Desc,
 
   // At read, invalidate the buffer in any case of error or success,
   // except if EOF was already present.
-  if (IsFread && !E.isStreamEof())
-    State = escapeArgs(State, C, Call, {0});
+  if (IsFread && !E.isStreamEof()) {
+    // Try to invalidate the individual elements.
+    if (const auto *BufferFirstElem =
+            dyn_cast_or_null<ElementRegion>(Call.getArgSVal(0).getAsRegion())) {
----------------
steakhal wrote:

In case `fread` reads to the beginning of a buffer, we won't have an `ElementRegion`, thus the heuristic for eagerly binding the invalidated elements won't trigger. This is unfortunate, but you can think of this as we keep the previous behavior.
To circumvent this, I'd need to know the type for for the pointee.
This would imply that I should special-case `TypedValueRegion` and `SymbolicRegion`.

I'll think about it.

https://github.com/llvm/llvm-project/pull/93408