[clang] [clang] Fix null pointer related issues in StaticAnalyzer (PR #210823)

[Ian Li via cfe-commits]

https://github.com/ianayl updated https://github.com/llvm/llvm-project/pull/210823

>From 3680c683b018fadb9eb4ab4fc9715fae4b98321b Mon Sep 17 00:00:00 2001
From: "Li, Ian" <ian.li at intel.com>
Date: Mon, 20 Jul 2026 08:29:26 -0700
Subject: [PATCH 1/5] Prevent nullptr dereference incase of null StackFrame

---
 clang/lib/StaticAnalyzer/Core/MemRegion.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/clang/lib/StaticAnalyzer/Core/MemRegion.cpp b/clang/lib/StaticAnalyzer/Core/MemRegion.cpp
index f3fe21101792c..4c45fa814d2f5 100644
--- a/clang/lib/StaticAnalyzer/Core/MemRegion.cpp
+++ b/clang/lib/StaticAnalyzer/Core/MemRegion.cpp
@@ -1039,7 +1039,9 @@ const VarRegion *MemRegionManager::getVarRegion(const VarDecl *D,
   const auto *PVD = dyn_cast<ParmVarDecl>(D);
   if (PVD) {
     unsigned Index = PVD->getFunctionScopeIndex();
-    const Expr *CallSite = SF->getCallSite();
+    const Expr *CallSite = nullptr;
+    if (SF)
+      CallSite = SF->getCallSite();
     if (CallSite) {
       const Decl *CalleeDecl = SF->getDecl();
       bool CurrentParam = true;

>From dbac565d1c1278062d1b313065dc067b9709792c Mon Sep 17 00:00:00 2001
From: "Li, Ian" <ian.li at intel.com>
Date: Mon, 20 Jul 2026 13:38:37 -0700
Subject: [PATCH 2/5] Add nullptr guards to reportBug in
 RawPtrRefLocalVarsChecker

---
 .../Checkers/WebKit/RawPtrRefLocalVarsChecker.cpp           | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefLocalVarsChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefLocalVarsChecker.cpp
index a624b7d686734..c005cd5ac8164 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefLocalVarsChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefLocalVarsChecker.cpp
@@ -419,9 +419,11 @@ class RawPtrRefLocalVarsChecker
       Os << " is a ";
       printPointerTypeAndType(Os, V->getType());
 
-      PathDiagnosticLocation BSLoc(Value->getExprLoc(), BR->getSourceManager());
+      SourceLocation ExprLoc = (Value) ? Value->getExprLoc() : V->getLocation();
+      PathDiagnosticLocation BSLoc(ExprLoc, BR->getSourceManager());
       auto Report = std::make_unique<BasicBugReport>(Bug, Os.str(), BSLoc);
-      Report->addRange(Value->getSourceRange());
+      if (Value)
+        Report->addRange(Value->getSourceRange());
       BR->emitReport(std::move(Report));
     } else {
       if (V->hasLocalStorage())

>From f5f0e3ca73d1e94ac16c5c634701150ba6a10b74 Mon Sep 17 00:00:00 2001
From: "Li, Ian" <ian.li at intel.com>
Date: Mon, 20 Jul 2026 14:16:35 -0700
Subject: [PATCH 3/5] Initialize CallEvent::Data to nullptr

---
 .../include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
index 3252421414181..2010e4b0da84b 100644
--- a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
+++ b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
@@ -162,7 +162,7 @@ class CallEvent {
 
 protected:
   // This is user data for subclasses.
-  const void *Data;
+  const void *Data = nullptr;
 
   // This is user data for subclasses.
   // This should come right before RefCount, so that the two fields can be

>From 1c105dae3642e34ccad91ba6a8bebf57fe54886f Mon Sep 17 00:00:00 2001
From: "Li, Ian" <ian.li at intel.com>
Date: Tue, 21 Jul 2026 11:16:33 -0700
Subject: [PATCH 4/5] change null guard to an assert instead

---
 clang/lib/StaticAnalyzer/Core/MemRegion.cpp | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/clang/lib/StaticAnalyzer/Core/MemRegion.cpp b/clang/lib/StaticAnalyzer/Core/MemRegion.cpp
index 4c45fa814d2f5..bc19b9b926493 100644
--- a/clang/lib/StaticAnalyzer/Core/MemRegion.cpp
+++ b/clang/lib/StaticAnalyzer/Core/MemRegion.cpp
@@ -1038,10 +1038,9 @@ const VarRegion *MemRegionManager::getVarRegion(const VarDecl *D,
                                                 const StackFrame *SF) {
   const auto *PVD = dyn_cast<ParmVarDecl>(D);
   if (PVD) {
+    assert(SF);
     unsigned Index = PVD->getFunctionScopeIndex();
-    const Expr *CallSite = nullptr;
-    if (SF)
-      CallSite = SF->getCallSite();
+    const Expr *CallSite = SF->getCallSite();
     if (CallSite) {
       const Decl *CalleeDecl = SF->getDecl();
       bool CurrentParam = true;

>From f4f144bf31f51c1fef129fe5e5966b91f59ab4e5 Mon Sep 17 00:00:00 2001
From: "Li, Ian" <ian.li at intel.com>
Date: Tue, 21 Jul 2026 11:47:14 -0700
Subject: [PATCH 5/5] Move assert location to avoid misleading code

---
 clang/lib/StaticAnalyzer/Core/MemRegion.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang/lib/StaticAnalyzer/Core/MemRegion.cpp b/clang/lib/StaticAnalyzer/Core/MemRegion.cpp
index bc19b9b926493..80a180c5694dd 100644
--- a/clang/lib/StaticAnalyzer/Core/MemRegion.cpp
+++ b/clang/lib/StaticAnalyzer/Core/MemRegion.cpp
@@ -1036,9 +1036,9 @@ static bool isStdStreamVar(const VarDecl *D) {
 
 const VarRegion *MemRegionManager::getVarRegion(const VarDecl *D,
                                                 const StackFrame *SF) {
+  assert(SF);
   const auto *PVD = dyn_cast<ParmVarDecl>(D);
   if (PVD) {
-    assert(SF);
     unsigned Index = PVD->getFunctionScopeIndex();
     const Expr *CallSite = SF->getCallSite();
     if (CallSite) {