From 4c62c7c981e9c66bb21f7229b715fe833e39b955 Mon Sep 17 00:00:00 2001
From: Akira Hatanaka <ahatanaka@apple.com>
Date: Fri, 18 Mar 2016 19:03:50 +0000
Subject: [PATCH] [Objective-c] Fix a crash in
 WeakObjectProfileTy::getBaseInfo.

The crash occurs in WeakObjectProfileTy::getBaseInfo when getBase() is
called on an ObjCPropertyRefExpr object whose receiver is an interface.
This commit fixes the crash by checking the type of the receiver and
setting IsExact to true if it is an interface.

rdar://problem/25208167

Differential Revision: http://reviews.llvm.org/D18268

llvm-svn: 263818
---
 clang/lib/Sema/ScopeInfo.cpp             | 14 +++++++++-----
 clang/test/SemaObjC/arc-repeated-weak.mm | 12 ++++++++++++
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/clang/lib/Sema/ScopeInfo.cpp b/clang/lib/Sema/ScopeInfo.cpp
index ef9eed6..d183288 100644
--- a/clang/lib/Sema/ScopeInfo.cpp
+++ b/clang/lib/Sema/ScopeInfo.cpp
@@ -86,11 +86,15 @@ FunctionScopeInfo::WeakObjectProfileTy::getBaseInfo(const Expr *E) {
     if (BaseProp) {
       D = getBestPropertyDecl(BaseProp);
 
-      const Expr *DoubleBase = BaseProp->getBase();
-      if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(DoubleBase))
-        DoubleBase = OVE->getSourceExpr();
-
-      IsExact = DoubleBase->isObjCSelfExpr();
+      if (BaseProp->isClassReceiver())
+        IsExact = true;
+      else {
+        const Expr *DoubleBase = BaseProp->getBase();
+        if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(DoubleBase))
+          DoubleBase = OVE->getSourceExpr();
+
+        IsExact = DoubleBase->isObjCSelfExpr();
+      }
     }
     break;
   }
diff --git a/clang/test/SemaObjC/arc-repeated-weak.mm b/clang/test/SemaObjC/arc-repeated-weak.mm
index 264c598..7ac2313 100644
--- a/clang/test/SemaObjC/arc-repeated-weak.mm
+++ b/clang/test/SemaObjC/arc-repeated-weak.mm
@@ -439,3 +439,15 @@ void doubleLevelAccessIvar(Test *a, Test *b) {
 }
 @end
 
+// This used to crash in WeakObjectProfileTy::getBaseInfo when getBase() was
+// called on an ObjCPropertyRefExpr object whose receiver was an interface.
+
+@class NSString;
+@interface NSBundle
++(NSBundle *)foo;
+@property NSString *prop;
+@end
+
+void foo() {
+  NSString * t = NSBundle.foo.prop;
+}
-- 
2.7.4