[clang] [analyzer] Fix crash in RegionStoreManager::bindArray (PR #210200)

[Andy Ames via cfe-commits]

andyames-a11y wrote:

One more isolation, since I wanted to pin down exactly what's special about constructors here. Tested reading `*p` (pointer to an uninitialized local array) through several call shapes:

| Call shape | Result |
|---|---|
| Direct pointer deref, no function call | `UndefinedVal` — correctly flagged as uninitialized |
| Plain free function taking the array by reference | Still `UndefinedVal` — correctly flagged |
| Non-constructor member function taking the array by reference | Still `UndefinedVal` — correctly flagged |
| **Constructor** taking the array by reference | **`LazyCompoundVal`** — precision lost |

So it's specifically constructor calls, not "by-reference parameter" in general. I traced this as far as `CallEvent::invalidateRegions()` — `AnyCXXConstructorCall` pushes non-`const`-reference arguments into the invalidation list in a way regular calls don't hit once inlined — but the bulk-invalidation code that consumes that list (`InvalidateRegionsWorker` in `RegionStore.cpp`) only produces plain conjured scalars for arrays there, not `LazyCompoundVal`, so I haven't found the exact line that produces the `LazyCompoundVal` specifically.


https://github.com/llvm/llvm-project/pull/210200