[all-commits] [llvm/llvm-project] 81d48e: [clang][analyzer] Fix a nullptr dereference when -...

[Fangyi Zhou via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 81d48e0f61f3e78cd6d6be9d3c8e48e7761a5ed5
      https://github.com/llvm/llvm-project/commit/81d48e0f61f3e78cd6d6be9d3c8e48e7761a5ed5
  Author: Fangyi Zhou <me at fangyi.io>
  Date:   2025-05-15 (Thu, 15 May 2025)

  Changed paths:
    M clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h
    M clang/lib/StaticAnalyzer/Core/SymbolManager.cpp
    A clang/test/Analysis/ftime-trace-no-init.cpp

  Log Message:
  -----------
  [clang][analyzer] Fix a nullptr dereference when -ftime-trace is used (Reland) (#139980)

Fixes #139779.

The bug was introduced in #137355 in `SymbolConjured::getStmt`, when
trying to obtain a statement for a CFG initializer without an
initializer.  This commit adds a null check before access.

Previous PR #139820, Revert #139936

Additional notes since previous PR:

When conjuring a symbol, sometimes there is no valid CFG element, e.g.
in the file causing the crash, there is no element at all in the CFG. In
these cases, the CFG element reference in the expression engine will be
invalid. As a consequence, there needs to be extra checks to ensure the
validity of the CFG element reference.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications