[analyzer] Do not crash in CallEvent.getReturnType()

When the call expression is not available.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@328406 91177308-0d34-0410-b5e6-96231b3b80d8

3 files changed, 23 insertions, 3 deletions

diff --git a/lib/StaticAnalyzer/Core/CallEvent.cpp b/lib/StaticAnalyzer/Core/CallEvent.cpp
index 3ff02f17d0..dab5335ae0 100644
--- a/lib/StaticAnalyzer/Core/CallEvent.cpp
+++ b/lib/StaticAnalyzer/Core/CallEvent.cpp
@@ -67,11 +67,13 @@ using namespace clang;
 using namespace ento;
 
 QualType CallEvent::getResultType() const {
+  ASTContext &Ctx = getState()->getStateManager().getContext();
   const Expr *E = getOriginExpr();
-  assert(E && "Calls without origin expressions do not have results");
-  QualType ResultTy = E->getType();
+  if (!E)
+    return Ctx.VoidTy;
+  assert(E);
 
-  ASTContext &Ctx = getState()->getStateManager().getContext();
+  QualType ResultTy = E->getType();
 
   // A function that returns a reference to 'int' will have a result type
   // of simply 'int'. Check the origin expr's value kind to recover the
diff --git a/test/Analysis/Inputs/system-header-simulator-for-nullability-cxx.h b/test/Analysis/Inputs/system-header-simulator-for-nullability-cxx.h
new file mode 100644
index 0000000000..fe620c9ff1
--- /dev/null
+++ b/test/Analysis/Inputs/system-header-simulator-for-nullability-cxx.h
@@ -0,0 +1,9 @@
+#pragma clang system_header
+
+struct S {
+  ~S(){}
+};
+
+void foo() {
+  S s;
+}
diff --git a/test/Analysis/trustnonnullchecker_test.mm b/test/Analysis/trustnonnullchecker_test.mm
new file mode 100644
index 0000000000..fa84673492
--- /dev/null
+++ b/test/Analysis/trustnonnullchecker_test.mm
@@ -0,0 +1,9 @@
+// RUN: %clang_analyze_cc1 -fblocks -analyze -analyzer-checker=core,nullability,apiModeling  -verify %s
+
+#include "Inputs/system-header-simulator-for-nullability-cxx.h"
+
+// expected-no-diagnostics
+
+void blah() {
+  foo(); // no-crash
+}