Index: lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp =================================================================== --- lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp +++ lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp @@ -360,10 +360,18 @@ Loc lhsL = lhs.castAs().getLoc(); switch (rhs.getSubKind()) { case nonloc::LocAsIntegerKind: + // FIXME: at the moment the implementation + // of modeling "pointers as integers" is not complete. + if (!BinaryOperator::isComparisonOp(op)) + return UnknownVal(); return evalBinOpLL(state, op, lhsL, rhs.castAs().getLoc(), resultTy); case nonloc::ConcreteIntKind: { + // FIXME: at the moment the implementation + // of modeling "pointers as integers" is not complete. + if (!BinaryOperator::isComparisonOp(op)) + return UnknownVal(); // Transform the integer into a location and compare. // FIXME: This only makes sense for comparisons. If we want to, say, // add 1 to a LocAsInteger, we'd better unpack the Loc and add to it, Index: test/Analysis/ptr-arith.cpp =================================================================== --- test/Analysis/ptr-arith.cpp +++ test/Analysis/ptr-arith.cpp @@ -105,3 +105,9 @@ return 0; return N; } + +// Bug 34309 +bool ptrAsIntegerSubtractionNoCrash(long x, char *p) { + long y = (long)p - 1; + return y == x; +}