commit ab27c281d952ab675865fa3f227a70f385d7bcf9
author Argyrios Kyrtzidis <akyrtzi@gmail.com> Thu Feb 03 22:01:32 2011 +0000
committer Copybara-Service <copybara-worker@google.com> Mon Sep 14 17:28:15 2020 -0700
tree 92d6bdbe95aaf8017baca8aab64ca1efea7ae42b
parent ccfe82f89b3ebb9798c432a1cd480e4c63c899cd

[analyzer] Fix a crash until we can handle temporary struct objects properly.

llvm-svn: 124822
GitOrigin-RevId: 58f8b590e132dd74ad9035a82369205a95d807e8

lib/StaticAnalyzer/Checkers/ExprEngine.cpp

diff --git a/lib/StaticAnalyzer/Checkers/ExprEngine.cpp b/lib/StaticAnalyzer/Checkers/ExprEngine.cpp
index 79d2a2b..2dd2202 100644
--- a/lib/StaticAnalyzer/Checkers/ExprEngine.cpp
+++ b/lib/StaticAnalyzer/Checkers/ExprEngine.cpp
@@ -1716,7 +1716,11 @@
     const GRState* state = GetState(*I);
     SVal baseExprVal = state->getSVal(baseExpr);
     if (isa<nonloc::LazyCompoundVal>(baseExprVal) ||
-        isa<nonloc::CompoundVal>(baseExprVal)) {
+        isa<nonloc::CompoundVal>(baseExprVal) ||
+        // FIXME: This can originate by conjuring a symbol for an unknown
+        // temporary struct object, see test/Analysis/fields.c:
+        // (p = getit()).x
+        isa<nonloc::SymbolVal>(baseExprVal)) {
       MakeNode(Dst, M, *I, state->BindExpr(M, UnknownVal()));
       continue;
     }

test/Analysis/fields.c

diff --git a/test/Analysis/fields.c b/test/Analysis/fields.c
index c97d4f8..0827f3d 100644
--- a/test/Analysis/fields.c
+++ b/test/Analysis/fields.c
@@ -17,3 +17,13 @@
   struct s a;
   int *p = &(a.n) + 1;
 }
+
+typedef struct {
+  int x,y;
+} Point;
+
+Point getit(void);
+void test() {
+  Point p;
+  (void)(p = getit()).x;
+}