[analyzer] Fix crash when returning C++ objects from ObjC messages-to-nil.

the assertion is in fact incorrect: there is a cornercase in Objective-C++
in which a C++ object is not constructed with a constructor, but merely
zero-initialized. Namely, this happens when an Objective-C message is sent
to a nil and it is supposed to return a C++ object.

Differential Revision: https://reviews.llvm.org/D60988

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@359262 91177308-0d34-0410-b5e6-96231b3b80d8

1 files changed, 24 insertions, 0 deletions

diff --git a/test/Analysis/nil-receiver.mm b/test/Analysis/nil-receiver.mm
new file mode 100644
index 0000000000..c462fce182
--- /dev/null
+++ b/test/Analysis/nil-receiver.mm
@@ -0,0 +1,24 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection \
+// RUN:                    -verify %s
+
+#define nil ((id)0)
+
+void clang_analyzer_eval(int);
+
+struct S {
+  int x;
+  S();
+};
+
+@interface I
+@property S s;
+@end
+
+void foo() {
+  // This produces a zero-initialized structure.
+  // FIXME: This very fact does deserve the warning, because zero-initialized
+  // structures aren't always valid in C++. It's particularly bad when the
+  // object has a vtable.
+  S s = ((I *)nil).s;
+  clang_analyzer_eval(s.x == 0); // expected-warning{{TRUE}}
+}