[clang] [analyzer] Fix crash in RegionStoreManager::bindArray from constructor array-to-pointer decay (PR #210649)

[Balázs Benics via cfe-commits]

================
@@ -2726,7 +2726,13 @@ RegionStoreManager::bindArray(LimitedRegionBindingsConstRef B,
     return bindAggregate(B, R, Init);
   }
 
-  if (isa<nonloc::SymbolVal, UnknownVal, UndefinedVal>(Init))
+  // We may get non-CompoundVal accidentally due to imprecise cast logic or
+  // that we are binding a genuinely symbolic/unknown/undefined array value.
+  // Preserve Init as a default binding rather than lossily converting to
+  // UnknownVal(), and handle every non-CompoundVal case exhaustively (like
+  // bindStruct()/bindVector() do) rather than enumerating specific SVal
+  // kinds one at a time.
+  if (!isa<nonloc::CompoundVal>(Init))
     return bindAggregate(B, R, Init);
----------------
steakhal wrote:

I'm worried that this would silently do the wrong thing.
We should at least have an `assert((isa<nonloc::SymbolVal, UnknownVal, UndefinedVal>(Init)))` here.
Remember, this was the only reason we found about this issue in the first place, so this has already proved value.

https://github.com/llvm/llvm-project/pull/210649