Extended Description

$ cat /tmp/getElementRegion-crash.cc
struct {
int n;
bool f(unsigned &p1) { p1 = (long)n - 1; }
} b;
unsigned a;
int c;
void g() { b.f(a) && a == c; }
$ clang_tidy -checks=-,clang-analyzer-* /tmp/getElementRegion-crash.cc -- -std=c++11
assert.h assertion failed at llvm/tools/clang/include/clang/AST/Type.h:628 in const clang::ExtQualsTypeCommonBase *clang::QualType::getCommonPtr() const: !isNull() && "Cannot retrieve a NULL type pointer"
@ 0x53f0f5a __assert_fail
@ 0x5e9065 clang::QualType::getCommonPtr()
@ 0x5ddbe9 clang::QualType::getCanonicalType()
@ 0x1b4f5cc clang::ASTContext::getCanonicalType()
@ 0x2c50612 clang::ento::MemRegionManager::getElementRegion()
@ 0x2d07f58 (anonymous namespace)::SimpleSValBuilder::evalBinOpLN()
@ 0x2bbbace clang::ento::SValBuilder::evalBinOp()
@ 0x2d09ab4 (anonymous namespace)::SimpleSValBuilder::simplifySVal()::Simplifier::VisitSymIntExpr()
@ 0x2d09692 clang::ento::SymExprVisitor<>::Visit()
@ 0x2d093ea (anonymous namespace)::SimpleSValBuilder::simplifySVal()::Simplifier::VisitNonLocSymbolVal()
@ 0x2d08f6b clang::ento::SValVisitor<>::Visit()
@ 0x2d0822f (anonymous namespace)::SimpleSValBuilder::simplifySVal()
@ 0x2d056cc (anonymous namespace)::SimpleSValBuilder::evalBinOpNN()
@ 0x2bbbd92 clang::ento::SValBuilder::evalBinOp()
@ 0x2cab136 clang::ento::ExprEngine::evalBinOp()
@ 0x2cd8320 clang::ento::ExprEngine::VisitBinaryOperator()
@ 0x2ca0a91 clang::ento::ExprEngine::Visit()
@ 0x2c9dea4 clang::ento::ExprEngine::ProcessStmt()
@ 0x2c9db6a clang::ento::ExprEngine::processCFGElement()
@ 0x2ccb526 clang::ento::CoreEngine::HandlePostStmt()
@ 0x2ccae23 clang::ento::CoreEngine::dispatchWorkItem()
@ 0x2cca9b8 clang::ento::CoreEngine::ExecuteWorkList()
@ 0x21227d5 clang::ento::ExprEngine::ExecuteWorkList()
@ 0x20cb182 (anonymous namespace)::AnalysisConsumer::ActionExprEngine()
@ 0x20caf41 (anonymous namespace)::AnalysisConsumer::RunPathSensitiveChecks()
@ 0x20cac05 (anonymous namespace)::AnalysisConsumer::HandleCode()
@ 0x20be323 (anonymous namespace)::AnalysisConsumer::HandleDeclsCallGraph()
@ 0x20bc5a7 (anonymous namespace)::AnalysisConsumer::HandleTranslationUnit()
@ 0x29d335e clang::MultiplexConsumer::HandleTranslationUnit()