From 1d22cda9dbf116c761db465ee2c7ce50acb7863d Mon Sep 17 00:00:00 2001
From: Akira Hatanaka <ahatanaka@apple.com>
Date: Fri, 18 Mar 2016 19:03:50 +0000
Subject: [PATCH] [Objective-c] Fix a crash in
 WeakObjectProfileTy::getBaseInfo.

The crash occurs in WeakObjectProfileTy::getBaseInfo when getBase() is
called on an ObjCPropertyRefExpr object whose receiver is an interface.
This commit fixes the crash by checking the type of the receiver and
setting IsExact to true if it is an interface.

rdar://problem/25208167

Differential Revision: http://reviews.llvm.org/D18268


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@263818 91177308-0d34-0410-b5e6-96231b3b80d8
---
 lib/Sema/ScopeInfo.cpp             | 14 +++++++++-----
 test/SemaObjC/arc-repeated-weak.mm | 12 ++++++++++++
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/lib/Sema/ScopeInfo.cpp b/lib/Sema/ScopeInfo.cpp
index ef9eed65eb..d18328878c 100644
--- a/lib/Sema/ScopeInfo.cpp
+++ b/lib/Sema/ScopeInfo.cpp
@@ -86,11 +86,15 @@ FunctionScopeInfo::WeakObjectProfileTy::getBaseInfo(const Expr *E) {
     if (BaseProp) {
       D = getBestPropertyDecl(BaseProp);
 
-      const Expr *DoubleBase = BaseProp->getBase();
-      if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(DoubleBase))
-        DoubleBase = OVE->getSourceExpr();
-
-      IsExact = DoubleBase->isObjCSelfExpr();
+      if (BaseProp->isClassReceiver())
+        IsExact = true;
+      else {
+        const Expr *DoubleBase = BaseProp->getBase();
+        if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(DoubleBase))
+          DoubleBase = OVE->getSourceExpr();
+
+        IsExact = DoubleBase->isObjCSelfExpr();
+      }
     }
     break;
   }
diff --git a/test/SemaObjC/arc-repeated-weak.mm b/test/SemaObjC/arc-repeated-weak.mm
index 264c598942..7ac2313fa3 100644
--- a/test/SemaObjC/arc-repeated-weak.mm
+++ b/test/SemaObjC/arc-repeated-weak.mm
@@ -439,3 +439,15 @@ void doubleLevelAccessIvar(Test *a, Test *b) {
 }
 @end
 
+// This used to crash in WeakObjectProfileTy::getBaseInfo when getBase() was
+// called on an ObjCPropertyRefExpr object whose receiver was an interface.
+
+@class NSString;
+@interface NSBundle
++(NSBundle *)foo;
+@property NSString *prop;
+@end
+
+void foo() {
+  NSString * t = NSBundle.foo.prop;
+}
-- 
2.50.1