[clang] [webkit.UncountedLambdaCapturesChecker] Fix a nullptr deference. (PR #120702)

[Ryosuke Niwa via cfe-commits]

https://github.com/rniwa created https://github.com/llvm/llvm-project/pull/120702

Added a nullptr check.

>From 527fd23a6bd58cada036fe4a47c13ca93eabf507 Mon Sep 17 00:00:00 2001
From: Ryosuke Niwa <rniwa at webkit.org>
Date: Fri, 20 Dec 2024 01:32:40 -0800
Subject: [PATCH] [webkit.UncountedLambdaCapturesChecker] Fix a nullptr
 deference.

Added a nullptr check.
---
 .../WebKit/UncountedLambdaCapturesChecker.cpp    |  2 ++
 ...counted-lambda-captures-find-lambda-crash.cpp | 16 ++++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 clang/test/Analysis/Checkers/WebKit/uncounted-lambda-captures-find-lambda-crash.cpp

diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/UncountedLambdaCapturesChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/UncountedLambdaCapturesChecker.cpp
index da9698e327562e..a57499d52acd0c 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/UncountedLambdaCapturesChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/UncountedLambdaCapturesChecker.cpp
@@ -155,6 +155,8 @@ class UncountedLambdaCapturesChecker
         if (!Init)
           return nullptr;
         TempExpr = dyn_cast<CXXBindTemporaryExpr>(Init->IgnoreParenCasts());
+        if (!TempExpr)
+          return nullptr;
         return dyn_cast_or_null<LambdaExpr>(TempExpr->getSubExpr());
       }
 
diff --git a/clang/test/Analysis/Checkers/WebKit/uncounted-lambda-captures-find-lambda-crash.cpp b/clang/test/Analysis/Checkers/WebKit/uncounted-lambda-captures-find-lambda-crash.cpp
new file mode 100644
index 00000000000000..4d9edb75b7ff36
--- /dev/null
+++ b/clang/test/Analysis/Checkers/WebKit/uncounted-lambda-captures-find-lambda-crash.cpp
@@ -0,0 +1,16 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=webkit.UncountedLambdaCapturesChecker -verify %s
+// expected-no-diagnostics
+
+struct Foo {
+  int x;
+  int y;
+  Foo(int x, int y) : x(x) , y(y) { }
+  ~Foo() { }
+};
+
+Foo bar(const Foo&);
+void foo() {
+  int x = 7;
+  int y = 5;
+  bar(Foo(x, y));
+}