[analyzer] Fixup to r158958.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159037 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/lib/StaticAnalyzer/Checkers/MallocChecker.cpp b/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
index 35c6073..b0fcb25 100644
--- a/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
@@ -482,7 +482,7 @@
 }
 
 static bool isFreeWhenDoneSetToZero(CallOrObjCMessage Call, Selector &S) {
-  for (unsigned i = 1; i < Call.getNumArgs(); ++i)
+  for (unsigned i = 1; i < S.getNumArgs(); ++i)
     if (S.getNameForSlot(i).equals("freeWhenDone"))
       if (Call.getArgSVal(i).isConstant(0))
         return true;
@@ -1435,7 +1435,7 @@
     // White list the ObjC functions which do free memory.
     // - Anything containing 'freeWhenDone' param set to 1.
     //   Ex: dataWithBytesNoCopy:length:freeWhenDone.
-    for (unsigned i = 1; i < Call->getNumArgs(); ++i) {
+    for (unsigned i = 1; i < S.getNumArgs(); ++i) {
       if (S.getNameForSlot(i).equals("freeWhenDone")) {
         if (Call->getArgSVal(i).isConstant(1))
           return false;
diff --git a/test/Analysis/malloc.mm b/test/Analysis/malloc.mm
index 23297ec..64135b236 100644
--- a/test/Analysis/malloc.mm
+++ b/test/Analysis/malloc.mm
@@ -206,4 +206,9 @@
   // Freeing the buffer is allowed.
   void* buffer = [pointerArray pointerAtIndex:0];
   free(buffer);
+}
+
+void noCrashOnVariableArgumentSelector() {
+  NSMutableString *myString = [NSMutableString stringWithString:@"some text"];
+  [myString appendFormat:@"some text = %d", 3];
 }
\ No newline at end of file
diff --git a/test/Analysis/system-header-simulator-objc.h b/test/Analysis/system-header-simulator-objc.h
index 20a26cd..a647b37 100644
--- a/test/Analysis/system-header-simulator-objc.h
+++ b/test/Analysis/system-header-simulator-objc.h
@@ -85,7 +85,13 @@
 - (id)initWithBytes:(const void *)bytes length:(NSUInteger)len encoding:(NSStringEncoding)encoding;
 - (id)initWithBytesNoCopy:(void *)bytes length:(NSUInteger)len encoding:(NSStringEncoding)encoding freeWhenDone:(BOOL)freeBuffer;
 + (id)stringWithUTF8String:(const char *)nullTerminatedCString;
++ (id)stringWithString:(NSString *)string;
 @end        @class NSString, NSURL, NSError;
+
+@interface NSMutableString : NSString
+- (void)appendFormat:(NSString *)format, ... __attribute__((format(__NSString__, 1, 2)));
+@end
+
 @interface NSData : NSObject <NSCopying, NSMutableCopying, NSCoding>  - (NSUInteger)length;
 + (id)dataWithBytesNoCopy:(void *)bytes length:(NSUInteger)length;
 + (id)dataWithBytesNoCopy:(void *)bytes length:(NSUInteger)length freeWhenDone:(BOOL)b;