[clang] [analyzer] Fix null-pointer dereference in PthreadLockChecker (PR #210912)

[Balázs Benics via cfe-commits]

================
@@ -20,10 +20,47 @@ namespace ento {
 
 RangedConstraintManager::~RangedConstraintManager() {}
 
+// Is `Assumption` (i.e. "the condition is non-zero") consistent with a symbol
+// that simplified to the concrete integer `V`? Mirrors the nonloc::ConcreteInt
+// handling in SimpleConstraintManager::assumeAux.
+static bool isConcreteFeasible(const llvm::APSInt &V, bool Assumption) {
+  return (V != 0) ? Assumption : !Assumption;
+}
+
 ProgramStateRef RangedConstraintManager::assumeSym(ProgramStateRef State,
                                                    SymbolRef Sym,
                                                    bool Assumption) {
-  Sym = simplify(State, Sym);
+  SVal SimplifiedVal = simplifyToSVal(State, Sym);
+  // Note: a loc::ConcreteInt is not possible here. This callsite is only ever
+  // reached with non-loc-typed symbols (SimpleConstraintManager::assumeAux's
+  // nonloc::SymbolVal case and assumeSymRel's comparison-to-zero rewrite), and
+  // simplifyToSVal() -> makeSymbolVal() only produces a Loc for pointer-typed
+  // symbols -- so the fold can only ever be a nonloc::ConcreteInt.
+  if (auto CI = SimplifiedVal.getAs<nonloc::ConcreteInt>()) {
----------------
steakhal wrote:

I think instead of this argumet, we could just use `getAsInteger()` on the SVal and move on.

https://github.com/llvm/llvm-project/pull/210912