[clang] [analyzer] Fix _Atomic crashes for Z3 symbolic execution (PR #212050)

via cfe-commits cfe-commits at lists.llvm.org
Sun Jul 26 04:13:20 PDT 2026


================
@@ -270,8 +274,14 @@ class SMTConv {
                                           QualType ToTy, uint64_t ToBitWidth,
                                           QualType FromTy,
                                           uint64_t FromBitWidth) {
-    if ((FromTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType() &&
-         ToTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType()) ||
+    FromTy = getSymbolicValueType(FromTy);
+    ToTy = getSymbolicValueType(ToTy);
+
+    if (FromTy == ToTy && FromBitWidth == ToBitWidth)
+      return Exp;
----------------
rdevshp wrote:

When FromTy->isBooleanType() && ToTy->isBooleanType(), the code returns 
```
return Solver->mkIte(
  Exp, Solver->mkBitvector(llvm::APSInt("1"), ToBitWidth),
  Solver->mkBitvector(llvm::APSInt("0"), ToBitWidth));
```
which does not have the correct Z3 sort (should have Z3 sort Boolean and not bitvector). The early return bypasses this and skips the cast. The type canonicalization was there to make sure that the cast is correctly skipped in this case.

https://github.com/llvm/llvm-project/pull/212050


More information about the cfe-commits mailing list