diff --git a/clang/lib/Analysis/FlowSensitive/Transfer.cpp b/clang/lib/Analysis/FlowSensitive/Transfer.cpp --- a/clang/lib/Analysis/FlowSensitive/Transfer.cpp +++ b/clang/lib/Analysis/FlowSensitive/Transfer.cpp @@ -279,7 +279,10 @@ void VisitCXXThisExpr(const CXXThisExpr *S) { auto *ThisPointeeLoc = Env.getThisPointeeStorageLocation(); - assert(ThisPointeeLoc != nullptr); + if (ThisPointeeLoc == nullptr) + // Unions are not supported yet, and will not have a location for the + // `this` expression's pointee. + return; auto &Loc = Env.createStorageLocation(*S); Env.setStorageLocation(*S, Loc); diff --git a/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp b/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp --- a/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp +++ b/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp @@ -42,10 +42,11 @@ template void runDataflow(llvm::StringRef Code, Matcher Match, LangStandard::Kind Std = LangStandard::lang_cxx17, - bool ApplyBuiltinTransfer = true) { + bool ApplyBuiltinTransfer = true, + llvm::StringRef TargetFun = "target") { ASSERT_THAT_ERROR( test::checkDataflow( - Code, "target", + Code, TargetFun, [ApplyBuiltinTransfer](ASTContext &C, Environment &) { return NoopAnalysis(C, ApplyBuiltinTransfer); }, @@ -3175,4 +3176,27 @@ }); } +TEST_F(TransferTest, DoesNotCrashOnUnionThisExpr) { + std::string Code = R"( + union Union { + int A; + float B; + }; + + void foo() { + Union A; + Union B; + A = B; + } + )"; + // This is a crash regression test when calling the transfer function on a + // `CXXThisExpr` that refers to a union. + runDataflow( + Code, + [](llvm::ArrayRef< + std::pair>>, + ASTContext &) {}, + LangStandard::lang_cxx17, /*ApplyBuiltinTransfer=*/true, "operator="); +} + } // namespace