Index: lib/StaticAnalyzer/Core/ExprEngineC.cpp
===================================================================
--- lib/StaticAnalyzer/Core/ExprEngineC.cpp
+++ lib/StaticAnalyzer/Core/ExprEngineC.cpp
@@ -760,7 +760,8 @@
   for (const ExplodedNode *N = Pred ; N ; N = *N->pred_begin()) {
     ProgramPoint PP = N->getLocation();
     if (PP.getAs<PreStmtPurgeDeadSymbols>() || PP.getAs<BlockEntrance>()) {
-      assert(N->pred_size() == 1);
+      // FIXME: we are assuming one parent here, which
+      // is not necessarily the case. Cf. D42773.
       continue;
     }
     SrcBlock = PP.castAs<BlockEdge>().getSrc();
Index: test/Analysis/exploration_order/noexprcrash.c
===================================================================
--- /dev/null
+++ test/Analysis/exploration_order/noexprcrash.c
@@ -0,0 +1,6 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=core -analyzer-config exploration_strategy=unexplored_first %s
+
+typedef struct { char a; } b;
+int c(b* input) {
+    return (input->a ?: input) ? 1 : 0; // no-crash
+}