[clang] [analyzer] Make pointer/null comparison commutative for addresses of fields of symbolic regions (PR #209875)

Lucas Ly Ba via cfe-commits cfe-commits at lists.llvm.org
Thu Jul 23 08:06:10 PDT 2026


================
@@ -861,7 +861,11 @@ SVal SimpleSValBuilder::evalBinOpLL(ProgramStateRef state,
 
     // If one of the operands is a symbol and the other is a constant,
     // build an expression for use by the constraint manager.
-    if (SymbolRef rSym = rhs.getAsLocSymbol()) {
+    // Pass IncludeBaseRegions so that &r->s (a field of a symbolic region)
+    // still counts as a symbol here, like the MemRegionVal case does below.
+    // Without it, `nullptr == &r->s` skips this and hits the "non-null region"
+    // case, which contradicts `&r->s == nullptr` and gives a false NPD
----------------
lucasly-ba wrote:

wait im force pushing now had some problems

https://github.com/llvm/llvm-project/pull/209875


More information about the cfe-commits mailing list