From b1279b5c47755dbf655a68965ad6c1c6a678c687 Mon Sep 17 00:00:00 2001
From: Ted Kremenek <kremenek@apple.com>
Date: Fri, 16 Mar 2012 05:58:15 +0000
Subject: [PATCH] Fix analyzer crash on analyzing 'catch' with no condition
 variable.

llvm-svn: 152900
---
 .../lib/StaticAnalyzer/Core/ExprEngineCXX.cpp |  5 ++++
 clang/test/Analysis/misc-ps-region-store.cpp  | 23 +++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
index 245f587bac20..a14a491333f2 100644
--- a/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
+++ b/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
@@ -268,6 +268,11 @@ void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS,
                                    ExplodedNode *Pred,
                                    ExplodedNodeSet &Dst) {
   const VarDecl *VD = CS->getExceptionDecl();
+  if (!VD) {
+    Dst.Add(Pred);
+    return;
+  }
+
   const LocationContext *LCtx = Pred->getLocationContext();
   SVal V = svalBuilder.getConjuredSymbolVal(CS, LCtx, VD->getType(),
                                  currentBuilderContext->getCurrentBlockCount());
diff --git a/clang/test/Analysis/misc-ps-region-store.cpp b/clang/test/Analysis/misc-ps-region-store.cpp
index 9fa0b860f2a5..00dff70480ea 100644
--- a/clang/test/Analysis/misc-ps-region-store.cpp
+++ b/clang/test/Analysis/misc-ps-region-store.cpp
@@ -529,3 +529,26 @@ MyEnum rdar10892489_positive() {
   return MyEnumValue;
 }
 
+// Test handling of catch with no condition variable.
+void PR11545() {
+  try
+  {
+      throw;
+  }
+  catch (...)
+  {
+  }
+}
+
+void PR11545_positive() {
+  try
+  {
+      throw;
+  }
+  catch (...)
+  {
+    int *p = 0;
+    *p = 0xDEADBEEF; // expected-warning {{null}}
+  }
+}
+