[analyzer] Fixup to r158958.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159037 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/lib/StaticAnalyzer/Checkers/MallocChecker.cpp b/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
index 35c6073..b0fcb25 100644
--- a/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
@@ -482,7 +482,7 @@
 }
 
 static bool isFreeWhenDoneSetToZero(CallOrObjCMessage Call, Selector &S) {
-  for (unsigned i = 1; i < Call.getNumArgs(); ++i)
+  for (unsigned i = 1; i < S.getNumArgs(); ++i)
     if (S.getNameForSlot(i).equals("freeWhenDone"))
       if (Call.getArgSVal(i).isConstant(0))
         return true;
@@ -1435,7 +1435,7 @@
     // White list the ObjC functions which do free memory.
     // - Anything containing 'freeWhenDone' param set to 1.
     //   Ex: dataWithBytesNoCopy:length:freeWhenDone.
-    for (unsigned i = 1; i < Call->getNumArgs(); ++i) {
+    for (unsigned i = 1; i < S.getNumArgs(); ++i) {
       if (S.getNameForSlot(i).equals("freeWhenDone")) {
         if (Call->getArgSVal(i).isConstant(1))
           return false;