2 files changed, 20 insertions, 13 deletions
diff --git a/clang/lib/Analysis/MemRegion.cpp b/clang/lib/Analysis/MemRegion.cpp
index e41c5f937b6..779f651edbd 100644
--- a/clang/lib/Analysis/MemRegion.cpp
+++ b/clang/lib/Analysis/MemRegion.cpp
@@ -114,18 +114,14 @@ void ElementRegion::Profile(llvm::FoldingSetNodeID& ID) const {
 QualType SymbolicRegion::getRValueType(ASTContext& C) const {
   const SymbolData& data = SymMgr.getSymbolData(sym);
 
-  // FIXME: We could use the SymbolManager::getType() directly. But that
-  // would hide the assumptions we made here. What is the type of a symbolic
-  // region is unclear for other cases.
+  // Get the type of the symbol.
+  QualType T = data.getType(C);
 
-  // For now we assume the symbol is a typed region rvalue.
-  const TypedRegion* R 
-    = cast<TypedRegion>(cast<SymbolRegionRValue>(data).getRegion());
-
-  // Assume the region rvalue has a pointer type, only then we could have a
-  // symbolic region associated with it.
-  PointerType* PTy = cast<PointerType>(R->getRValueType(C).getTypePtr());
+  // Only when the symbol has pointer type it can have a symbolic region
+  // associated with it.
+  PointerType* PTy = cast<PointerType>(T.getTypePtr()->getDesugaredType());
 
+  // The type of the symbolic region is the pointee type of the symbol.
   return PTy->getPointeeType();
 }
 
diff --git a/clang/lib/Analysis/RegionStore.cpp b/clang/lib/Analysis/RegionStore.cpp
index e640087acba..93b55255d58 100644
--- a/clang/lib/Analysis/RegionStore.cpp
+++ b/clang/lib/Analysis/RegionStore.cpp
@@ -339,15 +339,20 @@ SVal RegionStoreManager::getLValueField(const GRState* St, SVal Base,
 SVal RegionStoreManager::getLValueElement(const GRState* St, 
                                           SVal Base, SVal Offset) {
 
-  if (Base.isUnknownOrUndef() || isa<loc::SymbolVal>(Base))
+  if (Base.isUnknownOrUndef())
     return Base;
 
   // Only handle integer offsets... for now.
   if (!isa<nonloc::ConcreteInt>(Offset))
     return UnknownVal();
 
-  const TypedRegion *BaseRegion =
-    cast<TypedRegion>(cast<loc::MemRegionVal>(Base).getRegion());
+  const TypedRegion* BaseRegion = 0;
+
+  if (isa<loc::SymbolVal>(Base))
+    BaseRegion = MRMgr.getSymbolicRegion(cast<loc::SymbolVal>(Base).getSymbol(),
+                                         StateMgr.getSymbolManager());
+  else
+    BaseRegion = cast<TypedRegion>(cast<loc::MemRegionVal>(Base).getRegion());
 
   // Pointer of any type can be cast and used as array base.
   const ElementRegion *ElemR = dyn_cast<ElementRegion>(BaseRegion);
@@ -476,6 +481,12 @@ SVal RegionStoreManager::getSizeInElements(const GRState* St,
     return UnknownVal();
   }
 
+  if (const SymbolicRegion* SR = dyn_cast<SymbolicRegion>(R)) {
+    // FIXME: Unsupported yet.
+    SR = 0;
+    return UnknownVal();
+  }
+
   assert(0 && "Other regions are not supported yet.");
   return UnknownVal();
 }