Author: guillem-bartrina-sonarsource Date: 2026-07-23T10:40:44Z New Revision: f953ed4ec657bef2b92b798faa2872b75f1f4e81
URL: https://github.com/llvm/llvm-project/commit/f953ed4ec657bef2b92b798faa2872b75f1f4e81 DIFF: https://github.com/llvm/llvm-project/commit/f953ed4ec657bef2b92b798faa2872b75f1f4e81.diff LOG: [analyzer][z3] Fix crash in Z3 SMTConv when casting atomic int (#211489) CPP-7675 Added: Modified: clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h clang/test/Analysis/z3/z3-crosscheck.c Removed: ################################################################################ diff --git a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h index 4ba0483dc0380..61a71545fb1a6 100644 --- a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h +++ b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h @@ -270,8 +270,8 @@ class SMTConv { QualType ToTy, uint64_t ToBitWidth, QualType FromTy, uint64_t FromBitWidth) { - if ((FromTy->isIntegralOrEnumerationType() && - ToTy->isIntegralOrEnumerationType()) || + if ((FromTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType() && + ToTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType()) || (FromTy->isAnyPointerType() ^ ToTy->isAnyPointerType()) || (FromTy->isBlockPointerType() ^ ToTy->isBlockPointerType()) || (FromTy->isReferenceType() ^ ToTy->isReferenceType())) { diff --git a/clang/test/Analysis/z3/z3-crosscheck.c b/clang/test/Analysis/z3/z3-crosscheck.c index 41ecaee5529e0..6b467ce6982de 100644 --- a/clang/test/Analysis/z3/z3-crosscheck.c +++ b/clang/test/Analysis/z3/z3-crosscheck.c @@ -89,3 +89,11 @@ void e() { int f; a(f); // expected-warning {{1st function call argument is an uninitialized value [core.CallAndMessage]}} } + +void nullDerefGuardedByAtomicComp(int input) { + int *nullPointer = 0; + _Atomic int atomicValue = input; + if (atomicValue == 0) { + *nullPointer = 1; // no-crash // expected-warning {{Dereference of null pointer (loaded from variable 'nullPointer')}} + } +} _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
