[clang] [clang][analyzer] Model function addresses in constant initializers (PR #217608)

[Radovan Božić via cfe-commits]

================
@@ -326,6 +326,14 @@ loc::MemRegionVal SValBuilder::getCXXThis(const CXXRecordDecl *D,
 std::optional<SVal> SValBuilder::getConstantVal(const Expr *E) {
   E = E->IgnoreParens();
 
+  // A function used as a constant initializer can either decay to a function
+  // pointer or bind directly to a function reference.
+  if (E->getType()->isFunctionPointerType() || E->getType()->isFunctionType()) {
+    if (const auto *FD =
+            dyn_cast_or_null<FunctionDecl>(E->getReferencedDeclOfCallee()))
+      return getFunctionPointer(FD);
+  }
----------------
bozicrHT wrote:

I don't think so. The new branch is not entered in this example. The evaluation `clang_analyzer_dump(Truthy)` print `1 U1b`, not a function code region. I can add regression test if necessary:
```cpp
void fn();
const bool Truthy = &fn;
void test_bool() {
  clang_analyzer_dump(Truthy); // expected-warning{{1 U1b}}
}
```

https://github.com/llvm/llvm-project/pull/217608