1 files changed, 14 insertions, 4 deletions
diff --git a/clang/lib/StaticAnalyzer/Core/LoopUnrolling.cpp b/clang/lib/StaticAnalyzer/Core/LoopUnrolling.cpp
index 1a09a521f116..dc268e562237 100644
--- a/clang/lib/StaticAnalyzer/Core/LoopUnrolling.cpp
+++ b/clang/lib/StaticAnalyzer/Core/LoopUnrolling.cpp
@@ -130,10 +130,10 @@ static internal::Matcher<Stmt> hasSuspiciousStmt(StringRef NodeName) {
             // Escaping and not known mutation of the loop counter is handled
             // by exclusion of assigning and address-of operators and
             // pass-by-ref function calls on the loop counter from the body.
-            changeIntBoundNode(equalsBoundNode(NodeName)),
-            callByRef(equalsBoundNode(NodeName)),
-            getAddrTo(equalsBoundNode(NodeName)),
-            assignedToRef(equalsBoundNode(NodeName)))));
+            changeIntBoundNode(equalsBoundNode(std::string(NodeName))),
+            callByRef(equalsBoundNode(std::string(NodeName))),
+            getAddrTo(equalsBoundNode(std::string(NodeName))),
+            assignedToRef(equalsBoundNode(std::string(NodeName))))));
 }
 
 static internal::Matcher<Stmt> forLoopMatcher() {
@@ -164,6 +164,11 @@ static bool isPossiblyEscaped(const VarDecl *VD, ExplodedNode *N) {
   if (VD->hasGlobalStorage())
     return true;
 
+  const bool isParm = isa<ParmVarDecl>(VD);
+  // Reference parameters are assumed as escaped variables.
+  if (isParm && VD->getType()->isReferenceType())
+    return true;
+
   while (!N->pred_empty()) {
     // FIXME: getStmtForDiagnostics() does nasty things in order to provide
     // a valid statement for body farms, do we need this behavior here?
@@ -193,6 +198,11 @@ static bool isPossiblyEscaped(const VarDecl *VD, ExplodedNode *N) {
 
     N = N->getFirstPred();
   }
+
+  // Parameter declaration will not be found.
+  if (isParm)
+    return false;
+
   llvm_unreachable("Reached root without finding the declaration of VD");
 }