If a nonnull argument evaluates to UnknownVal, don't warn (and don't crash).

llvm-svn: 106456

2 files changed, 12 insertions, 2 deletions

diff --git a/clang/lib/Checker/AttrNonNullChecker.cpp b/clang/lib/Checker/AttrNonNullChecker.cpp
index 471cf197170..d0bccb27b40 100644
--- a/clang/lib/Checker/AttrNonNullChecker.cpp
+++ b/clang/lib/Checker/AttrNonNullChecker.cpp
@@ -60,11 +60,16 @@ void AttrNonNullChecker::PreVisitCallExpr(CheckerContext &C,
     if (!Att->isNonNull(idx))
       continue;
 
-    const DefinedSVal &V = cast<DefinedSVal>(state->getSVal(*I));
+    SVal V = state->getSVal(*I);
+    DefinedSVal *DV = dyn_cast<DefinedSVal>(&V);
+
+    // If the value is unknown or undefined, we can't perform this check.
+    if (!DV)
+      continue;
 
     ConstraintManager &CM = C.getConstraintManager();
     const GRState *stateNotNull, *stateNull;
-    llvm::tie(stateNotNull, stateNull) = CM.AssumeDual(state, V);
+    llvm::tie(stateNotNull, stateNull) = CM.AssumeDual(state, *DV);
 
     if (stateNull && !stateNotNull) {
       // Generate an error node.  Check for a null node in case
diff --git a/clang/test/Analysis/null-deref-ps.c b/clang/test/Analysis/null-deref-ps.c
index 5a1049c7d71..eac7957fb92 100644
--- a/clang/test/Analysis/null-deref-ps.c
+++ b/clang/test/Analysis/null-deref-ps.c
@@ -118,6 +118,11 @@ void f6d(int *p) {
   }  
 }
 
+void f6e(int *p, int offset) {
+  // PR7406 - crash from treating an UnknownVal as defined, to see if it's 0.
+  bar((p+offset)+1, 0); // not crash
+}
+
 int* qux();
 
 int f7(int x) {