2 files changed, 24 insertions, 7 deletions
diff --git a/clang/lib/Checker/GRExprEngine.cpp b/clang/lib/Checker/GRExprEngine.cpp
index 8ed57e70934..b5521859d17 100644
--- a/clang/lib/Checker/GRExprEngine.cpp
+++ b/clang/lib/Checker/GRExprEngine.cpp
@@ -1333,6 +1333,20 @@ void GRExprEngine::ProcessCallExit(GRCallExitNodeBuilder &B) {
     state = state->set<ReturnExpr>(0);
   }
 
+  // Bind the constructed object value to CXXConstructExpr.
+  if (const CXXConstructExpr *CCE = dyn_cast<CXXConstructExpr>(CE)) {
+    const CXXThisRegion *ThisR = getCXXThisRegion(CCE, LocCtx);
+    // We might not have 'this' region in the binding if we didn't inline
+    // the ctor call.
+    SVal ThisV = state->getSVal(ThisR);
+    loc::MemRegionVal *V = dyn_cast<loc::MemRegionVal>(&ThisV);
+    if (V) {
+      SVal ObjVal = state->getSVal(V->getRegion());
+      assert(isa<nonloc::LazyCompoundVal>(ObjVal));
+      state = state->BindExpr(CCE, ObjVal);
+    }
+  }
+
   B.GenerateNode(state);
 }
 
@@ -3198,10 +3212,7 @@ void GRExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *E, SVal Dest,
                                                     Pred->getLocationContext(),
                                    E, Builder->getBlock(), Builder->getIndex());
 
-  Type *T = CD->getParent()->getTypeForDecl();
-  QualType PT = getContext().getPointerType(QualType(T,0));
-  const CXXThisRegion *ThisR = ValMgr.getRegionManager().getCXXThisRegion(PT,
-                                                                          SFC);
+  const CXXThisRegion *ThisR = getCXXThisRegion(E, SFC);
 
   CallEnter Loc(E, CD, Pred->getLocationContext());
   for (ExplodedNodeSet::iterator NI = ArgsEvaluated.begin(),
@@ -3214,6 +3225,13 @@ void GRExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *E, SVal Dest,
       Dst.Add(N);
   }
 }
+
+const CXXThisRegion *GRExprEngine::getCXXThisRegion(const CXXConstructExpr *E,
+                                                 const StackFrameContext *SFC) {
+  Type *T = E->getConstructor()->getParent()->getTypeForDecl();
+  QualType PT = getContext().getPointerType(QualType(T,0));
+  return ValMgr.getRegionManager().getCXXThisRegion(PT, SFC);
+}
 //===----------------------------------------------------------------------===//
 // Checker registration/lookup.
 //===----------------------------------------------------------------------===//
diff --git a/clang/lib/Checker/RegionStore.cpp b/clang/lib/Checker/RegionStore.cpp
index c2b702acad9..19cf6d51e08 100644
--- a/clang/lib/Checker/RegionStore.cpp
+++ b/clang/lib/Checker/RegionStore.cpp
@@ -1044,7 +1044,7 @@ SVal RegionStoreManager::Retrieve(Store store, Loc L, QualType T) {
   }
 #endif
 
-  if (RTy->isStructureType())
+  if (RTy->isStructureType() || RTy->isClassType())
     return RetrieveStruct(store, R);
 
   // FIXME: Handle unions.
@@ -1337,8 +1337,7 @@ SVal RegionStoreManager::RetrieveLazySymbol(const TypedRegion *R) {
 
 SVal RegionStoreManager::RetrieveStruct(Store store, const TypedRegion* R) {
   QualType T = R->getValueType(getContext());
-  assert(T->isStructureType());
-  assert(T->getAsStructureType()->getDecl()->isDefinition());
+  assert(T->isStructureType() || T->isClassType());
   return ValMgr.makeLazyCompoundVal(store, R);
 }