From 16a4449901d5401cbc2db9be93d4208ef2542844 Mon Sep 17 00:00:00 2001
From: chrchr-github <78114321+chrchr-github@users.noreply.github.com>
Date: Sat, 28 May 2022 00:11:23 +0200
Subject: [PATCH] Fix crash with statement expression (#4142)

---
 lib/checkleakautovar.cpp |  3 ++-
 test/testleakautovar.cpp | 12 ++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/lib/checkleakautovar.cpp b/lib/checkleakautovar.cpp
index 7d5dec8b5..9c841f9cd 100644
--- a/lib/checkleakautovar.cpp
+++ b/lib/checkleakautovar.cpp
@@ -442,7 +442,8 @@ void CheckLeakAutoVar::checkScope(const Token * const startToken,
                     continue;
 
                 // Check assignments in the if-statement. Skip multiple assignments since we don't track those
-                if (Token::Match(innerTok, "%var% =") && innerTok->astParent() == innerTok->next() && !innerTok->next()->astParent()->isAssignmentOp()) {
+                if (Token::Match(innerTok, "%var% =") && innerTok->astParent() == innerTok->next() &&
+                    !(innerTok->next()->astParent() && innerTok->next()->astParent()->isAssignmentOp())) {
                     // allocation?
                     // right ast part (after `=` operator)
                     const Token* tokRightAstOperand = innerTok->next()->astOperand2();
diff --git a/test/testleakautovar.cpp b/test/testleakautovar.cpp
index 5f69a2281..4262b59d3 100644
--- a/test/testleakautovar.cpp
+++ b/test/testleakautovar.cpp
@@ -165,6 +165,7 @@ private:
         TEST_CASE(ifelse23); // #5473
         TEST_CASE(ifelse24); // #1733
         TEST_CASE(ifelse25); // #9966
+        TEST_CASE(ifelse26);
 
         // switch
         TEST_CASE(switch1);
@@ -1839,6 +1840,17 @@ private:
         ASSERT_EQUALS("", errout.str());
     }
 
+    void ifelse26() { // don't crash
+        check("union tidi {\n"
+              "    long long ti;\n"
+              "    unsigned int di[2];\n"
+              "};\n"
+              "void f(long long val) {\n"
+              "    if (val == ({ union tidi d = {.di = {0x0, 0x80000000}}; d.ti; })) {}\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void switch1() {
         check("void f() {\n"
               "    char *p = 0;\n"