Index: include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
===================================================================
--- include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
+++ include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
@@ -332,6 +332,12 @@
   void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst);
 
   /// VisitArraySubscriptExpr - Transfer function for array accesses.
+  void VisitArraySubscriptExpr(const ArraySubscriptExpr *Ex,
+                                   ExplodedNode *Pred,
+                                   ExplodedNodeSet &Dst);
+
+  /// VisitLvalArraySubscriptExpr - Transfer function for lvalue access into
+  /// array.
   void VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *Ex,
                                    ExplodedNode *Pred,
                                    ExplodedNodeSet &Dst);
Index: lib/StaticAnalyzer/Core/ExprEngine.cpp
===================================================================
--- lib/StaticAnalyzer/Core/ExprEngine.cpp
+++ lib/StaticAnalyzer/Core/ExprEngine.cpp
@@ -1150,7 +1150,7 @@
 
     case Stmt::ArraySubscriptExprClass:
       Bldr.takeNodes(Pred);
-      VisitLvalArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Pred, Dst);
+      VisitArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Pred, Dst);
       Bldr.addNodes(Dst);
       break;
 
@@ -2126,6 +2126,17 @@
 }
 
 /// VisitArraySubscriptExpr - Transfer function for array accesses
+///
+/// Ignores array subscripts which return rvalues.
+void ExprEngine::VisitArraySubscriptExpr(const ArraySubscriptExpr *A,
+                                             ExplodedNode *Pred,
+                                             ExplodedNodeSet &Dst){
+  if (A->isGLValue())
+    return VisitLvalArraySubscriptExpr(A, Pred, Dst);
+}
+
+
+/// VisitArraySubscriptExpr - Transfer function for lvalue array accesses
 void ExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *A,
                                              ExplodedNode *Pred,
                                              ExplodedNodeSet &Dst){
@@ -2138,9 +2149,6 @@
 
   ExplodedNodeSet EvalSet;
   StmtNodeBuilder Bldr(CheckerPreStmt, EvalSet, *currBldrCtx);
-  assert(A->isGLValue() ||
-          (!AMgr.getLangOpts().CPlusPlus &&
-           A->getType().isCForbiddenLValueType()));
 
   for (auto *Node : CheckerPreStmt) {
     const LocationContext *LCtx = Node->getLocationContext();
Index: test/Analysis/ObjCPropertiesSyntaxChecks.m
===================================================================
--- test/Analysis/ObjCPropertiesSyntaxChecks.m
+++ test/Analysis/ObjCPropertiesSyntaxChecks.m
@@ -66,3 +66,14 @@
 // that are definitely incorrect.
 @property (copy) NSMutableString *myProp; // no-crash // no-warning
 @end
+
+typedef __attribute__((__ext_vector_type__(3))) int Vector;
+
+@interface I2
+@property Vector v;
+@end
+
+// Do not crash on subscript operations into ObjC properties.
+int myfunc(I2 *i2) {
+  return i2.v[0]; // no-crash no-warning
+}