diff --git a/clang/include/clang/Analysis/FlowSensitive/DataflowEnvironment.h b/clang/include/clang/Analysis/FlowSensitive/DataflowEnvironment.h --- a/clang/include/clang/Analysis/FlowSensitive/DataflowEnvironment.h +++ b/clang/include/clang/Analysis/FlowSensitive/DataflowEnvironment.h @@ -140,8 +140,6 @@ /// The body of the callee must not reference globals. /// /// The arguments of `Call` must map 1:1 to the callee's parameters. - /// - /// Each argument of `Call` must already have a `StorageLocation`. Environment pushCall(const CallExpr *Call) const; Environment pushCall(const CXXConstructExpr *Call) const; diff --git a/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp b/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp --- a/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp +++ b/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp @@ -253,7 +253,8 @@ const Expr *Arg = Args[ArgIndex]; auto *ArgLoc = getStorageLocation(*Arg, SkipPast::Reference); - assert(ArgLoc != nullptr); + if (ArgLoc == nullptr) + continue; const VarDecl *Param = *ParamIt; auto &Loc = createStorageLocation(*Param); diff --git a/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp b/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp --- a/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp +++ b/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp @@ -4229,6 +4229,27 @@ /*.BuiltinTransferOptions=*/{/*.ContextSensitive=*/true}}); } +TEST(TransferTest, ContextSensitiveReturnInt) { + std::string Code = R"( + int identity(int x) { return x; } + + void target() { + int y = identity(42); + // [[p]] + } + )"; + runDataflow(Code, + [](llvm::ArrayRef< + std::pair>> + Results, + ASTContext &ASTCtx) { + ASSERT_THAT(Results, ElementsAre(Pair("p", _))); + // This just tests that the analysis doesn't crash. + }, + {/*.ApplyBuiltinTransfer=*/true, + /*.BuiltinTransferOptions=*/{/*.ContextSensitive=*/true}}); +} + TEST(TransferTest, ContextSensitiveMethodLiteral) { std::string Code = R"( class MyClass {