[clang] f953ed4 - [analyzer][z3] Fix crash in Z3 SMTConv when casting atomic int (#211489)

[via cfe-commits]

Author: guillem-bartrina-sonarsource
Date: 2026-07-23T10:40:44Z
New Revision: f953ed4ec657bef2b92b798faa2872b75f1f4e81

URL: https://github.com/llvm/llvm-project/commit/f953ed4ec657bef2b92b798faa2872b75f1f4e81
DIFF: https://github.com/llvm/llvm-project/commit/f953ed4ec657bef2b92b798faa2872b75f1f4e81.diff

LOG: [analyzer][z3] Fix crash in Z3 SMTConv when casting atomic int (#211489)

CPP-7675

Added: 
    

Modified: 
    clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
    clang/test/Analysis/z3/z3-crosscheck.c

Removed: 
    


################################################################################
diff  --git a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
index 4ba0483dc0380..61a71545fb1a6 100644
--- a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
+++ b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
@@ -270,8 +270,8 @@ class SMTConv {
                                           QualType ToTy, uint64_t ToBitWidth,
                                           QualType FromTy,
                                           uint64_t FromBitWidth) {
-    if ((FromTy->isIntegralOrEnumerationType() &&
-         ToTy->isIntegralOrEnumerationType()) ||
+    if ((FromTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType() &&
+         ToTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType()) ||
         (FromTy->isAnyPointerType() ^ ToTy->isAnyPointerType()) ||
         (FromTy->isBlockPointerType() ^ ToTy->isBlockPointerType()) ||
         (FromTy->isReferenceType() ^ ToTy->isReferenceType())) {

diff  --git a/clang/test/Analysis/z3/z3-crosscheck.c b/clang/test/Analysis/z3/z3-crosscheck.c
index 41ecaee5529e0..6b467ce6982de 100644
--- a/clang/test/Analysis/z3/z3-crosscheck.c
+++ b/clang/test/Analysis/z3/z3-crosscheck.c
@@ -89,3 +89,11 @@ void e() {
   int f;
   a(f); // expected-warning {{1st function call argument is an uninitialized value [core.CallAndMessage]}}
 }
+
+void nullDerefGuardedByAtomicComp(int input) {
+  int *nullPointer = 0;
+  _Atomic int atomicValue = input;
+  if (atomicValue == 0) {
+    *nullPointer = 1; // no-crash // expected-warning {{Dereference of null pointer (loaded from variable 'nullPointer')}}
+  }
+}