[clang] [analyzer][z3] Fix crash in Z3 SMTConv when casting atomic int (PR #211489)
Balázs Benics via cfe-commits
cfe-commits at lists.llvm.org
Thu Jul 23 02:51:15 PDT 2026
================
@@ -89,3 +89,14 @@ void e() {
int f;
a(f); // expected-warning {{1st function call argument is an uninitialized value [core.CallAndMessage]}}
}
+
+// don't crash, and also produce a core.NullDereference finding
+_Atomic int b;
+int x;
+void k(void) {
+ int *p = 0;
+ b = x;
+ if (b == 0) {
+ *p = 1; // expected-warning {{Dereference of null pointer (loaded from variable 'p') [core.NullDereference]}}
+ }
+}
----------------
steakhal wrote:
I have some recommendations that I can't verify because godbolt doesn't have Z3:
- Could we move some of the globals to function params? This would reduce the leakage of the test and make it more to stand on its own.
- ~~Can we fuse the declaration of `p` with the subsequent assignment - aka. just initialize it with `x`?~~ Oh, I just realized that one is spelled as P and the other is actually B. - Super confusing varable name choice. I wish you used something more visually distinct. Maybe even small words?
- Comments should be capitalized and punctuated. Maybe even better, just have a trailing `no-crash` at the end of the line.
- We usually don't match the checker name when asserting a message. You could use that room for the `no-crash` comment for instance.
https://github.com/llvm/llvm-project/pull/211489
More information about the cfe-commits
mailing list