[clang] [analyzer] Restore commutativity of pointer/null comparison for addresses of fields of symbolic regions (PR #209875)

[Balázs Benics via cfe-commits]

================
@@ -0,0 +1,43 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=core -verify %s
+
+// Regression test for #206798.
+//
+// &r->s is a field of a symbolic region, so it's symbol-based. A Yoda null
+// check (`nullptr == p`) has to build the same constraint as the normal
+// `p == nullptr`. If it doesn't, the analyzer disagrees with itself and
+// reports a null deref that can't actually happen.
+
+struct S {
+  int n;
+};
+struct T {
+  S s;
+};
+
+int viaFieldAddress(S *p) {
+  if (!p) {
+  }
+  if (nullptr == p) // Yoda-style null check
+    return 0;
+  return p->n; // no-warning: p can't be null here
+}
+
+void callViaFieldAddress(T *r) { viaFieldAddress(&r->s); }
----------------
steakhal wrote:

What's the purpose of this intermediary function? Couldn't the invoked function be analyzed in top-level context and then introduce a local variable initialized by `&r->s`?

https://github.com/llvm/llvm-project/pull/209875