[analyzer] Taint: when looking up a binding, provide the type.

llvm-svn: 148080

1 files changed, 4 insertions, 1 deletions

diff --git a/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
index 81f16bdfa87..1d112c53280 100644
--- a/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
@@ -243,7 +243,10 @@ SymbolRef GenericTaintChecker::getPointedToSymbol(CheckerContext &C,
     return 0;
   }
 
-  SVal Val = State->getSVal(*AddrLoc);
+  const PointerType *ArgTy =
+    dyn_cast<PointerType>(Arg->getType().getCanonicalType().getTypePtr());
+  assert(ArgTy);
+  SVal Val = State->getSVal(*AddrLoc, ArgTy->getPointeeType());
   return Val.getAsSymbol();
 }