False positive clang-analyzer-core.uninitialized.Branch when passing initialized array to smart pointer

[chrchr-github]

#include <memory>
void f(size_t n) {
  std::unique_ptr<int[]> d(new int[n]{});
  
  if (d.get()[0]) {}
}

[<source>:5:7: warning: Branch condition evaluates to a garbage value [clang-analyzer-core.uninitialized.Branch]
    5 |   if (d.get()[0]) {}
      |       ^~~~~~~~~~
[<source>:3:28: note: Storing uninitialized value]
    3 |   std::unique_ptr<int[]> d(new int[n]{});
      |                            ^~~~~~~~~~~~
[<source>:3:26: note: Calling constructor for 'unique_ptr<int[], std::default_delete<int[]>>']
    3 |   std::unique_ptr<int[]> d(new int[n]{});
      |                          ^~~~~~~~~~~~~~~

https://godbolt.org/z/Khaozjs9G
Originally observed with boost::scoped_array.

[chrchr-github]

Maybe related: #61731

[llvmbot]

@llvm/issue-subscribers-clang-static-analyzer

Author: None (chrchr-github)

~~~c++ #include <memory> void f(size_t n) { std::unique_ptr<int[]> d(new int[n]{});

if (d.get()[0]) {}
}

[<source>:5:7: warning: Branch condition evaluates to a garbage value [clang-analyzer-core.uninitialized.Branch]
5 | if (d.get()[0]) {}
| ^~~~~~~~~~
[<source>:3:28: note: Storing uninitialized value]
3 | std::unique_ptr<int[]> d(new int[n]{});
| ^~~~~~~~~~~~
[<source>:3:26: note: Calling constructor for 'unique_ptr<int[], std::default_delete<int[]>>']
3 | std::unique_ptr<int[]> d(new int[n]{});
| ^~~~~~~~~~~~~~~

https://godbolt.org/z/Khaozjs9G
Originally observed with boost::scoped_array.
</details>

[chrchr-github]

There is no warning if

• the init list is not empty
• the array size is a literal

[chrchr-github]

Reduced:

void f(int n) {
    int* p = new int[n]{};
    if (p[0]) {}
    delete [] p;
}

[steakhal]

Thanks for the minimal repro.

I had a look, and I think I have a pretty good clue what's going on now.
Inside ExprEngine::VisitCXXNewAllocatorCall() we have this:

State = State->bindDefaultInitial(RetVal, UndefinedVal{}, LCtx);

Which is why we see the region pointed by p uninitialized.
Even though we have CNE->getInitializer() here, in the environment we don't have anything associated with it, thus State->getSVal(CNE->getInitializer(), LCtx) would be UnknownVal.

So, we can't simply just say:

    SVal InitVal = CNE->getInitializer()
                       ? State->getSVal(CNE->getInitializer(), LCtx)
                       : UndefinedVal();
    State = State->bindDefaultInitial(RetVal, InitVal, LCtx);

What we should now achieve, is to actually associate an SVal with the InitListExpr (the first argument of the CXXNewExpr).
I think @Snape3058 already did something about InitListExprs once in the past in PR #70792. Maybe we can get inspired by it.