Also treat the type of the subexpression as a pointer in GRExprEngine::VisitCast when the expression is handled as an lvalue.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91969 91177308-0d34-0410-b5e6-96231b3b80d8

2 files changed, 12 insertions, 0 deletions

diff --git a/lib/Analysis/GRExprEngine.cpp b/lib/Analysis/GRExprEngine.cpp
index 6e77b6b103..c26867bf54 100644
--- a/lib/Analysis/GRExprEngine.cpp
+++ b/lib/Analysis/GRExprEngine.cpp
@@ -2125,6 +2125,7 @@ void GRExprEngine::VisitCast(Expr* CastE, Expr* Ex, ExplodedNode* Pred,
   if (asLValue) {
     ASTContext &Ctx = getContext();
     T = Ctx.getPointerType(Ctx.getCanonicalType(T));
+    ExTy = Ctx.getPointerType(Ctx.getCanonicalType(ExTy));
   }
 
   for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) {
diff --git a/test/Analysis/misc-ps-region-store.cpp b/test/Analysis/misc-ps-region-store.cpp
index e1750139c2..be150c92cc 100644
--- a/test/Analysis/misc-ps-region-store.cpp
+++ b/test/Analysis/misc-ps-region-store.cpp
@@ -23,3 +23,14 @@ int test2_b_aux(const short &n);
 int test2_b(int n) {
   return test2_b_aux(n);
 }
+
+// Test getting the lvalue of a derived and converting it to a base.  This
+// previously crashed.
+class Test3_Base {};
+class Test3_Derived : public Test3_Base {};
+
+int test3_aux(Test3_Base &x);
+int test3(Test3_Derived x) {
+  return test3_aux(x);
+}
+