[analyzer] Check that a member expr is valid even when the result is an lvalue.

We want to catch cases like this early, so that we can produce better
diagnostics and path notes:

  Point *p = 0;
  int *px = &p->x; // should warn here
  *px = 1;

llvm-svn: 164441

1 files changed, 7 insertions, 0 deletions

diff --git a/clang/test/Analysis/fields.c b/clang/test/Analysis/fields.c
index da0847a5607..a10d5a80601 100644
--- a/clang/test/Analysis/fields.c
+++ b/clang/test/Analysis/fields.c
@@ -26,3 +26,10 @@ void test() {
   Point p;
   (void)(p = getit()).x;
 }
+
+
+void testNullAddress() {
+  Point *p = 0;
+  int *px = &p->x; // expected-warning{{Access to field 'x' results in a dereference of a null pointer (loaded from variable 'p')}}
+  *px = 1; // No warning because analysis stops at the previous line.
+}