[analyzer] Fix crash when analyzing C++ code.

llvm-svn: 126025

clang/lib/StaticAnalyzer/Core/SValBuilder.cpp

@@ -292,7 +292,7 @@ SVal SValBuilder::evalCast(SVal val, QualType castTy, QualType originalTy) {
     //  }
 
     assert(Loc::isLocType(originalTy) || originalTy->isFunctionType() ||
-           originalTy->isBlockPointerType());
+           originalTy->isBlockPointerType() || castTy->isReferenceType());
 
     StoreManager &storeMgr = StateMgr.getStoreManager();
 

clang/lib/StaticAnalyzer/Core/Store.cpp

@@ -78,7 +78,7 @@ const MemRegion *StoreManager::castRegion(const MemRegion *R, QualType CastToTy)
 
   // Now assume we are casting from pointer to pointer. Other cases should
   // already be handled.
-  QualType PointeeTy = CastToTy->getAs<PointerType>()->getPointeeType();
+  QualType PointeeTy = CastToTy->getPointeeType();
   QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
 
   // Handle casts to void*.  We just pass the region through.

clang/test/Analysis/cxx-crashes.cpp

@@ -14,6 +14,10 @@ bool f3() {
   return !false;
 }
 
+void *f4(int* w) {
+  return reinterpret_cast<void*&>(w);
+}
+
 namespace {
 
 struct A { };
@@ -27,3 +31,15 @@ A f(char *dst) {
 }
 
 }
+
+namespace {
+
+struct S {
+    void *p;
+};
+
+void *f(S* w) {
+    return &reinterpret_cast<void*&>(*w);
+}
+
+}