Index: lib/StaticAnalyzer/Core/ExprEngine.cpp
===================================================================
--- lib/StaticAnalyzer/Core/ExprEngine.cpp
+++ lib/StaticAnalyzer/Core/ExprEngine.cpp
@@ -2137,8 +2137,11 @@
   ExplodedNodeSet EvalSet;
   StmtNodeBuilder Bldr(CheckerPreStmt, EvalSet, *currBldrCtx);
   assert(A->isGLValue() ||
-          (!AMgr.getLangOpts().CPlusPlus &&
-           A->getType().isCForbiddenLValueType()));
+      (!AMgr.getLangOpts().CPlusPlus && A->getType().isCForbiddenLValueType())
+
+      // Subscripts into ObjCProperties are always rvalues.
+      || (isa<PseudoObjectExpr>(Base) && isa<ObjCPropertyRefExpr>(
+          cast<PseudoObjectExpr>(Base)->getSyntacticForm())));
 
   for (auto *Node : CheckerPreStmt) {
     const LocationContext *LCtx = Node->getLocationContext();
Index: test/Analysis/ObjCPropertiesSyntaxChecks.m
===================================================================
--- test/Analysis/ObjCPropertiesSyntaxChecks.m
+++ test/Analysis/ObjCPropertiesSyntaxChecks.m
@@ -66,3 +66,14 @@
 // that are definitely incorrect.
 @property (copy) NSMutableString *myProp; // no-crash // no-warning
 @end
+
+typedef __attribute__((__ext_vector_type__(3))) int Vector;
+
+@interface I2
+@property Vector v;
+@end
+
+// Do not crash on subscript operations into ObjC properties.
+int myfunc(I2 *i2) {
+  return i2.v[0]; // no-crash no-warning
+}