assigned to @tkremenek

I get an assertion failure when running the attached with:

./build/clang-ninja/bin/clang -cc1 -analyze -analyzer-checker=core,unix ~/Downloads/clang_crash_UnNL1U.i

Assertion failed: (op == BO_Add), function evalBinOp, file /Volumes/Data/Clangs/OpenSourceGit/clang/lib/StaticAnalyzer/Core/SValBuilder.cpp, line 363.
0 clang 0x000000010984a0bb llvm::sys::PrintStackTrace(llvm::raw_ostream&) + 43
1 clang 0x0000000109849336 llvm::sys::RunSignalHandlers() + 70
2 clang 0x000000010984a762 SignalHandler(int) + 322
3 libsystem_platform.dylib 0x00007fff9bf9852a _sigtramp + 26
4 clang 0x000000010ce9f444 clang::Stmt::StatisticsEnabled + 62803
5 clang 0x000000010984a576 abort + 22
6 clang 0x000000010984a551 __assert_rtn + 81
7 clang 0x000000010bfcf809 clang::ento::SValBuilder::evalBinOp(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::BinaryOperatorKind, clang::ento::SVal, clang::ento::SVal, clang::QualType) + 985
8 clang 0x000000010bfcfae4 clang::ento::SValBuilder::evalEQ(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::ento::DefinedOrUnknownSVal, clang::ento::DefinedOrUnknownSVal) + 148
9 clang 0x000000010bb358c7 (anonymous namespace)::CStringChecker::assumeZero(clang::ento::CheckerContext&, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::ento::SVal, clang::QualType) + 455
10 clang 0x000000010bb35ba0 (anonymous namespace)::CStringChecker::checkNonNull(clang::ento::CheckerContext&, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::Expr const*, clang::ento::SVal) const + 608
11 clang 0x000000010bb3b0a6 (anonymous namespace)::CStringChecker::evalStrcpyCommon(clang::ento::CheckerContext&, clang::CallExpr const*, bool, bool, bool) const + 662
12 clang 0x000000010bb33a46 (anonymous namespace)::CStringChecker::evalStrncpy(clang::ento::CheckerContext&, clang::CallExpr const*) const + 86
13 clang 0x000000010bb32566 (anonymous namespace)::CStringChecker::evalCall(clang::CallExpr const*, clang::ento::CheckerContext&) const + 1974
14 clang 0x000000010bb31da0 bool clang::ento::eval::Call::_evalCall<(anonymous namespace)::CStringChecker>(void*, clang::CallExpr const*, clang::ento::CheckerContext&) + 48
15 clang 0x000000010bece7b2 clang::ento::CheckerFn<bool (clang::CallExpr const*, clang::ento::CheckerContext&)>::operator()(clang::CallExpr const*, clang::ento::CheckerContext&) const + 66
16 clang 0x000000010bec9d3f clang::ento::CheckerManager::runCheckersForEvalCall(clang::ento::ExplodedNodeSet&, clang::ento::ExplodedNodeSet const&, clang::ento::CallEvent const&, clang::ento::ExprEngine&) + 831
17 clang 0x000000010bf48049 clang::ento::ExprEngine::evalCall(clang::ento::ExplodedNodeSet&, clang::ento::ExplodedNode*, clang::ento::CallEvent const&) + 185
18 clang 0x000000010bf47f0b clang::ento::ExprEngine::VisitCallExpr(clang::CallExpr const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&) + 427
19 clang 0x000000010bf11f81 clang::ento::ExprEngine::Visit(clang::Stmt const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&) + 5665
20 clang 0x000000010bf0efa4 clang::ento::ExprEngine::ProcessStmt(clang::CFGStmt, clang::ento::ExplodedNode*) + 532
21 clang 0x000000010bf0ec6a clang::ento::ExprEngine::processCFGElement(clang::CFGElement, clang::ento::ExplodedNode*, unsigned int, clang::ento::NodeBuilderContext*) + 218
22 clang 0x000000010bef068e clang::ento::CoreEngine::HandlePostStmt(clang::CFGBlock const*, unsigned int, clang::ento::ExplodedNode*) + 302
23 clang 0x000000010bef0010 clang::ento::CoreEngine::dispatchWorkItem(clang::ento::ExplodedNode*, clang::ProgramPoint, clang::ento::WorkListUnit const&) + 1264
24 clang 0x000000010beef968 clang::ento::CoreEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) + 1240
25 clang 0x000000010ae4ff28 clang::ento::ExprEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int) + 88
26 clang 0x000000010ae107ad (anonymous namespace)::AnalysisConsumer::ActionExprEngine(clang::Decl*, bool, clang::ento::ExprEngine::InliningModes, llvm::DenseSet<clang::Decl const*, llvm::DenseMapInfo<clang::Decl const*> >) + 1501
27 clang 0x000000010ae10169 (anonymous namespace)::AnalysisConsumer::RunPathSensitiveChecks(clang::Decl, clang::ento::ExprEngine::InliningModes, llvm::DenseSet<clang::Decl const*, llvm::DenseMapInfo<clang::Decl const*> >) + 153
28 clang 0x000000010ae0fc78 (anonymous namespace)::AnalysisConsumer::HandleCode(clang::Decl, unsigned int, clang::ento::ExprEngine::InliningModes, llvm::DenseSet<clang::Decl const*, llvm::DenseMapInfo<clang::Decl const*> >) + 696
29 clang 0x000000010ae073e8 (anonymous namespace)::AnalysisConsumer::HandleDeclsCallGraph(unsigned int) + 920
30 clang 0x000000010ae0503a (anonymous namespace)::AnalysisConsumer::HandleTranslationUnit(clang::ASTContext&) + 842
31 clang 0x000000010ae7d41f clang::ParseAST(clang::Sema&, bool, bool) + 1295
32 clang 0x000000010a293a8f clang::ASTFrontendAction::ExecuteAction() + 511
33 clang 0x000000010a292ff0 clang::FrontendAction::Execute() + 112
34 clang 0x000000010a1de8c1 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) + 1873
35 clang 0x000000010a3258ba clang::ExecuteCompilerInvocation(clang::CompilerInstance) + 4410
36 clang 0x0000000108b9486e cc1_main(llvm::ArrayRef<char const*>, char const*, void*) + 4926
37 clang 0x0000000108b8445f ExecuteCC1Tool(llvm::ArrayRef<char const*>, llvm::StringRef) + 479
38 clang 0x0000000108b81fbd main + 3245
39 libdyld.dylib 0x00007fff96c975ad start + 1
40 libdyld.dylib 0x0000000000000005 start + 1765182041

rdar://problem/23682244

Here is a reduced reproducer:

int strcmp(const char *s1, const char *s2);

void bar(char **a) {
strcmp("Hi", *a);
}

union argument {
char *f;
};

void foo(union argument a) {
void (*fPtr)(union argument ) = (void ()(union argument *))bar;

fPtr(&a);
}

Fix in r260066.