[clang] [analyzer] Fix StdVariantChecker crash on std::get with a non-ptr arg (PR #210167)

Balázs Benics via cfe-commits cfe-commits at lists.llvm.org
Sun Jul 19 02:22:49 PDT 2026


================
@@ -226,8 +226,11 @@ class StdVariantChecker : public Checker<eval::Call, check::RegionChanges> {
     if (ArgSVal.isUnknown())
       return false;
 
-    const auto &ArgType =
-        ArgSVal.getType(C.getASTContext())->getPointeeType().getTypePtr();
+    QualType SValType = ArgSVal.getType(C.getASTContext());
+    if (SValType.isNull() || !SValType->isPointerType())
+      return false;
+
+    const auto &ArgType = SValType->getPointeeType().getTypePtr();
----------------
steakhal wrote:

Thinking about this I found this:
```c++
QualType Type::getPointeeType() const {
  if (const auto *PT = getAs<PointerType>())
    return PT->getPointeeType();
  if (const auto *OPT = getAs<ObjCObjectPointerType>())
    return OPT->getPointeeType();
  if (const auto *BPT = getAs<BlockPointerType>())
    return BPT->getPointeeType();
  if (const auto *RT = getAs<ReferenceType>())
    return RT->getPointeeType();
  if (const auto *MPT = getAs<MemberPointerType>())
    return MPT->getPointeeType();
  if (const auto *DT = getAs<DecayedType>())
    return DT->getPointeeType();
  return {};
```

And we restrict it to be `isPointerType()`, which means that we would restrict it to use only the first branch. Is there any reason we need to drop support for the rest of the types?

https://github.com/llvm/llvm-project/pull/210167


More information about the cfe-commits mailing list