From bd34520a8c4fe689cca8afaa8114e50bd6bad8f8 Mon Sep 17 00:00:00 2001
From: Anna Zaks <ganna@apple.com>
Date: Tue, 18 Jun 2013 23:16:20 +0000
Subject: [PATCH] [analyzer] Do not create a CompoundVal for lvalue
 InitListExprs.

These should be treated like scalars. This fixes a crash reported in radar://14164698.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@184257 91177308-0d34-0410-b5e6-96231b3b80d8
---
 lib/StaticAnalyzer/Core/ExprEngineC.cpp | 11 +++++++----
 test/Analysis/cxx11-crashes.cpp         | 21 +++++++++++++++++++++
 2 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/lib/StaticAnalyzer/Core/ExprEngineC.cpp b/lib/StaticAnalyzer/Core/ExprEngineC.cpp
index 8487267592..e9dda5ceea 100644
--- a/lib/StaticAnalyzer/Core/ExprEngineC.cpp
+++ b/lib/StaticAnalyzer/Core/ExprEngineC.cpp
@@ -579,9 +579,10 @@ void ExprEngine::VisitInitListExpr(const InitListExpr *IE,
   const LocationContext *LCtx = Pred->getLocationContext();
   QualType T = getContext().getCanonicalType(IE->getType());
   unsigned NumInitElements = IE->getNumInits();
-  
-  if (T->isArrayType() || T->isRecordType() || T->isVectorType() ||
-      T->isAnyComplexType()) {
+
+  if (!IE->isGLValue() &&
+      (T->isArrayType() || T->isRecordType() || T->isVectorType() ||
+       T->isAnyComplexType())) {
     llvm::ImmutableList<SVal> vals = getBasicVals().getEmptySValList();
     
     // Handle base case where the initializer has no elements.
@@ -606,7 +607,9 @@ void ExprEngine::VisitInitListExpr(const InitListExpr *IE,
     return;
   }
 
-  // Handle scalars: int{5} and int{}.
+  // Handle scalars: int{5} and int{} and GLvalues.
+  // Note, if the InitListExpr is a GLvalue, it means that there is an address
+  // representing it, so it must have a single init element.
   assert(NumInitElements <= 1);
 
   SVal V;
diff --git a/test/Analysis/cxx11-crashes.cpp b/test/Analysis/cxx11-crashes.cpp
index d0b9222b6a..a2b70db2f8 100644
--- a/test/Analysis/cxx11-crashes.cpp
+++ b/test/Analysis/cxx11-crashes.cpp
@@ -65,3 +65,24 @@ bool begin(double *it) {
   bool *a = reinterpret_cast<type &>(*( reinterpret_cast<char *>( it )));
   return *a;
 }
+
+// radar://14164698 Don't crash on "assuming" a ComoundVal.
+class JSONWireProtocolInputStream {
+public:
+  virtual ~JSONWireProtocolInputStream();
+};
+class JSONWireProtocolReader {
+public:
+  JSONWireProtocolReader(JSONWireProtocolInputStream& istream)
+  : _istream{istream} {} // On evaluating a bind here,
+                         // the dereference checker issues an assume on a CompoundVal.
+~JSONWireProtocolReader();
+private:
+JSONWireProtocolInputStream& _istream;
+};
+class SocketWireProtocolStream : public JSONWireProtocolInputStream {
+};
+void test() {
+  SocketWireProtocolStream stream{};
+  JSONWireProtocolReader reader{stream};
+}
\ No newline at end of file
-- 
2.40.0