[clang] [clang][analyzer] Add support for detecting uninitialized dynamically-allocated objects (PR #193001)

[Balázs Benics via cfe-commits]

================
@@ -451,26 +451,44 @@ static void printTail(llvm::raw_ostream &Out,
 //                           Utility functions.
 //===----------------------------------------------------------------------===//
 
+static const SubRegion *
+getConstructedSubRegion(const CXXConstructorDecl *CtorDecl,
+                        CheckerContext &Context) {
+  Loc ThisLoc =
+      Context.getSValBuilder().getCXXThis(CtorDecl, Context.getStackFrame());
+  SVal ObjectV = Context.getState()->getSVal(ThisLoc);
----------------
steakhal wrote:

So I applied this change to getSVal:
```c++

SVal ProgramState::getSVal(Loc location, QualType T) const {
  SVal V = getRawSVal(location, T);

  if (isa_and_nonnull<CXXThisRegion>(location.getAsRegion()) &&
      (!V.getAsRegion() || !V.getAsRegion()->getAs<SubRegion>())) {
    llvm::errs() << "loading from " << location << ": " << V << "\n";
    std::abort();
  }
```

And this pointed me to this test case `testC` where it crashed:
```c++
namespace dtor_over_loc_concrete_int {
struct A {
  ~A() {}
};

struct B {
  A a;
  ~B() {}
};

struct C : A {
  ~C() {}
};

void testB() {
  B *b = (B *)-1;
  b->~B(); // no-crash
}

void testC() {
  C *c = (C *)-1;
  c->~C(); // no-crash
}

void testAutoDtor() {
  const A &a = *(A *)-1;
  // no-crash
}
} // namespace dtor_over_loc_concrete_int
```

This should serve as evidence that a `CXXThisRegion` may refer to a concrete address (ConcreteInt) that is not a SubRegion; thus fail that cast.

https://github.com/llvm/llvm-project/pull/193001