[clang] [clang][dataflow] Fix a new crash on assigning values of unmodeled types. (PR #179788)

[Artem Dergachev via cfe-commits]

https://github.com/haoNoQ updated https://github.com/llvm/llvm-project/pull/179788

>From 50e3b8538c25f2c22d3e198d7035e3886428c49c Mon Sep 17 00:00:00 2001
From: Artem Dergachev <artem.dergachev at gmail.com>
Date: Wed, 4 Feb 2026 16:33:13 -0500
Subject: [PATCH 1/2] [clang][dataflow] Fix a new crash on assigning values of
 unmodeled types.

Regressed in #178943.
---
 clang/lib/Analysis/FlowSensitive/Transfer.cpp | 10 +++-
 .../Analysis/FlowSensitive/TransferTest.cpp   | 48 +++++++++++++++++++
 2 files changed, 57 insertions(+), 1 deletion(-)

diff --git a/clang/lib/Analysis/FlowSensitive/Transfer.cpp b/clang/lib/Analysis/FlowSensitive/Transfer.cpp
index 51cc1f9bc26ab..5a5e43e19e024 100644
--- a/clang/lib/Analysis/FlowSensitive/Transfer.cpp
+++ b/clang/lib/Analysis/FlowSensitive/Transfer.cpp
@@ -169,8 +169,16 @@ class TransferVisitor : public ConstStmtVisitor<TransferVisitor> {
         break;
 
       auto *RHSVal = Env.getValue(*RHS);
-      if (RHSVal == nullptr)
+      if (RHSVal == nullptr) {
         RHSVal = Env.createValue(LHS->getType());
+        if (RHSVal == nullptr) {
+          // At least make sure the old value is gone. It's unlikely to be there
+          // in the first place given that we don't even know how to create
+          // a basic unknown value of that type.
+          Env.clearValue(*LHSLoc);
+          break;
+        }
+      }
 
       // Assign a value to the storage location of the left-hand side.
       Env.setValue(*LHSLoc, *RHSVal);
diff --git a/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp b/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp
index e528ca2221ad1..c994a9fcae1aa 100644
--- a/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp
+++ b/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp
@@ -1011,6 +1011,54 @@ TEST(TransferTest, BinaryOperatorAssignUnknown) {
       });
 }
 
+TEST(TransferTest, BinaryOperatorAssignFloat) {
+  using ast_matchers::binaryOperator;
+  using ast_matchers::match;
+  using ast_matchers::selectFirst;
+  using ast_matchers::hasOperatorName;
+
+  // This was crashing.
+  std::string Code = R"(
+    void target() {
+      double Foo = 0.0f;
+      double FooAtA = Foo;
+      Foo = 1.0f;
+      double FooAtB = Foo;
+      bool check = (FooAtA == FooAtB);
+      // [[p]]
+    }
+  )";
+  runDataflow(
+      Code,
+      [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,
+         ASTContext &ASTCtx) {
+        ASSERT_THAT(Results.keys(), UnorderedElementsAre("p"));
+
+        const Environment &EnvP = getEnvironmentAtAnnotation(Results, "p");
+
+        const ValueDecl *FooAtADecl = findValueDecl(ASTCtx, "FooAtA");
+        ASSERT_THAT(FooAtADecl, NotNull());
+        const Value *FooAtAVal = EnvP.getValue(*FooAtADecl);
+        // FIXME: Should be non-null. Floats aren't modeled at all.
+        EXPECT_THAT(FooAtAVal, IsNull());
+
+        const ValueDecl *FooAtBDecl = findValueDecl(ASTCtx, "FooAtB");
+        ASSERT_THAT(FooAtBDecl, NotNull());
+        const Value *FooAtBVal = EnvP.getValue(*FooAtBDecl);
+        // FIXME: Should be non-null. Floats aren't modeled at all.
+        EXPECT_THAT(FooAtBVal, IsNull());
+
+        // See if the storage location is correctly propagated.
+        auto MatchResult =
+            match(binaryOperator(hasOperatorName("=")).bind("bo"), ASTCtx);
+        const auto *BO = selectFirst<BinaryOperator>("bo", MatchResult);
+        ASSERT_THAT(BO, NotNull());
+        const StorageLocation *BOLoc = EnvP.getStorageLocation(*BO);
+        // FIXME: Should be non-null.
+        EXPECT_THAT(BOLoc, IsNull());
+      });
+}
+
 TEST(TransferTest, VarDeclInitAssign) {
   std::string Code = R"(
     void target() {

>From 38bd9322894837d87d4185fb9f149d033e60b5f4 Mon Sep 17 00:00:00 2001
From: Artem Dergachev <artem.dergachev at gmail.com>
Date: Wed, 4 Feb 2026 16:53:31 -0500
Subject: [PATCH 2/2] [clang][dataflow] Fixup: Sort my using-directives.

---
 clang/unittests/Analysis/FlowSensitive/TransferTest.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp b/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp
index c994a9fcae1aa..b4e7e0cb47967 100644
--- a/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp
+++ b/clang/unittests/Analysis/FlowSensitive/TransferTest.cpp
@@ -1013,9 +1013,9 @@ TEST(TransferTest, BinaryOperatorAssignUnknown) {
 
 TEST(TransferTest, BinaryOperatorAssignFloat) {
   using ast_matchers::binaryOperator;
+  using ast_matchers::hasOperatorName;
   using ast_matchers::match;
   using ast_matchers::selectFirst;
-  using ast_matchers::hasOperatorName;
 
   // This was crashing.
   std::string Code = R"(