[clang] [analyzer] Fix StdVariantChecker crash on std::get with a non-ptr arg (PR #210167)

[John Paul Jepko via cfe-commits]

https://github.com/jpjepko updated https://github.com/llvm/llvm-project/pull/210167

>From 69c35961eb28931402136df6e3e5c1490c804443 Mon Sep 17 00:00:00 2001
From: John Jepko <john.jepko at ericsson.com>
Date: Thu, 16 Jul 2026 17:01:57 +0200
Subject: [PATCH 1/2] Add stdvariant crash fix

---
 clang/lib/StaticAnalyzer/Checkers/StdVariantChecker.cpp | 7 +++++--
 clang/test/Analysis/std-variant-checker.cpp             | 4 ++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/clang/lib/StaticAnalyzer/Checkers/StdVariantChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/StdVariantChecker.cpp
index e46eddf3804b2..ad57b7fe6d3ff 100644
--- a/clang/lib/StaticAnalyzer/Checkers/StdVariantChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/StdVariantChecker.cpp
@@ -226,8 +226,11 @@ class StdVariantChecker : public Checker<eval::Call, check::RegionChanges> {
     if (ArgSVal.isUnknown())
       return false;
 
-    const auto &ArgType =
-        ArgSVal.getType(C.getASTContext())->getPointeeType().getTypePtr();
+    QualType SValType = ArgSVal.getType(C.getASTContext());
+    if (SValType.isNull() || !SValType->isPointerType())
+      return false;
+
+    const auto &ArgType = SValType->getPointeeType().getTypePtr();
     // We have to make sure that the argument is an std::variant.
     // There is another std::get with std::pair argument
     if (!isStdVariant(ArgType))
diff --git a/clang/test/Analysis/std-variant-checker.cpp b/clang/test/Analysis/std-variant-checker.cpp
index 5b256b0f60dd0..452ea41f2a669 100644
--- a/clang/test/Analysis/std-variant-checker.cpp
+++ b/clang/test/Analysis/std-variant-checker.cpp
@@ -366,6 +366,10 @@ void unknownVal() {
   (void)std::get<int>(*(std::variant<int, float>*)(int)3.14f); // no crash
 }
 
+void concreteAddress() {
+  (void)std::get<int>(*(std::variant<int, char>*)11); // no crash
+}
+
 template <typename T>
 using MyVariant = std::variant<int, float>;
 

>From d84aea97b042536ae1f995d221f51f8a05302ecc Mon Sep 17 00:00:00 2001
From: ejepjoh <john.jepko at ericsson.com>
Date: Mon, 20 Jul 2026 22:48:33 +0200
Subject: [PATCH 2/2] Get type more directly rather than through the SVal

---
 .../lib/StaticAnalyzer/Checkers/StdVariantChecker.cpp  | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/clang/lib/StaticAnalyzer/Checkers/StdVariantChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/StdVariantChecker.cpp
index ad57b7fe6d3ff..c63717c52c0d6 100644
--- a/clang/lib/StaticAnalyzer/Checkers/StdVariantChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/StdVariantChecker.cpp
@@ -222,15 +222,7 @@ class StdVariantChecker : public Checker<eval::Call, check::RegionChanges> {
   bool handleStdGetCall(const CallEvent &Call, CheckerContext &C) const {
     ProgramStateRef State = C.getState();
 
-    SVal ArgSVal = Call.getArgSVal(0);
-    if (ArgSVal.isUnknown())
-      return false;
-
-    QualType SValType = ArgSVal.getType(C.getASTContext());
-    if (SValType.isNull() || !SValType->isPointerType())
-      return false;
-
-    const auto &ArgType = SValType->getPointeeType().getTypePtr();
+    const auto *ArgType = Call.getArgExpr(0)->getType().getTypePtr();
     // We have to make sure that the argument is an std::variant.
     // There is another std::get with std::pair argument
     if (!isStdVariant(ArgType))