[analyzer] Fix a crash until we can handle temporary struct objects properly.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@124822 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/StaticAnalyzer/Checkers/ExprEngine.cpp b/lib/StaticAnalyzer/Checkers/ExprEngine.cpp
index 79d2a2b2fc078d0a1eae19fdedfa97b4311cb228..2dd2202f03fea8ce4d997789ef8e9682dfe0e2b7 100644 (file)
--- a/lib/StaticAnalyzer/Checkers/ExprEngine.cpp
+++ b/lib/StaticAnalyzer/Checkers/ExprEngine.cpp
@@ -1716,7 +1716,11 @@ void ExprEngine::VisitMemberExpr(const MemberExpr* M, ExplodedNode* Pred,
     const GRState* state = GetState(*I);
     SVal baseExprVal = state->getSVal(baseExpr);
     if (isa<nonloc::LazyCompoundVal>(baseExprVal) ||
-        isa<nonloc::CompoundVal>(baseExprVal)) {
+        isa<nonloc::CompoundVal>(baseExprVal) ||
+        // FIXME: This can originate by conjuring a symbol for an unknown
+        // temporary struct object, see test/Analysis/fields.c:
+        // (p = getit()).x
+        isa<nonloc::SymbolVal>(baseExprVal)) {
       MakeNode(Dst, M, *I, state->BindExpr(M, UnknownVal()));
       continue;
     }

diff --git a/test/Analysis/fields.c b/test/Analysis/fields.c
index c97d4f82cdc0bbf484f72bcbdf7250c5def3f246..0827f3dbad18d6866ac2946e5a75b1873a21cee7 100644 (file)
--- a/test/Analysis/fields.c
+++ b/test/Analysis/fields.c
@@ -17,3 +17,13 @@ void f() {
   struct s a;
   int *p = &(a.n) + 1;
 }
+
+typedef struct {
+  int x,y;
+} Point;
+
+Point getit(void);
+void test() {
+  Point p;
+  (void)(p = getit()).x;
+}