[clang] [analyzer] Fix crash in RegionStoreManager::bindArray from constructor array-to-pointer decay (PR #210649)

Andy Ames via cfe-commits cfe-commits at lists.llvm.org
Mon Jul 20 09:47:20 PDT 2026


================
@@ -2726,7 +2726,13 @@ RegionStoreManager::bindArray(LimitedRegionBindingsConstRef B,
     return bindAggregate(B, R, Init);
   }
 
-  if (isa<nonloc::SymbolVal, UnknownVal, UndefinedVal>(Init))
+  // We may get non-CompoundVal accidentally due to imprecise cast logic or
+  // that we are binding a genuinely symbolic/unknown/undefined array value.
+  // Preserve Init as a default binding rather than lossily converting to
+  // UnknownVal(), and handle every non-CompoundVal case exhaustively (like
+  // bindStruct()/bindVector() do) rather than enumerating specific SVal
+  // kinds one at a time.
+  if (!isa<nonloc::CompoundVal>(Init))
     return bindAggregate(B, R, Init);
----------------
andyames-a11y wrote:

Assert added.

https://github.com/llvm/llvm-project/pull/210649


More information about the cfe-commits mailing list