[llvm-branch-commits] [clang] release/22.x: [Sema] Fix ICE due to incorrect _Bool handling in format string checking (#174684) (PR #178133)

[via llvm-branch-commits]

https://github.com/llvmbot created https://github.com/llvm/llvm-project/pull/178133

Backport 15365d31e6b407d78d6c26c7b64cecacccccfd39

Requested by: @zyn0217

>From 19bbd0b9cda5d5d526679fb63b0bfb5b2e5d9d60 Mon Sep 17 00:00:00 2001
From: Yexuan Xiao <bizwen at nykz.org>
Date: Tue, 27 Jan 2026 15:50:31 +0800
Subject: [PATCH] [Sema] Fix ICE due to incorrect _Bool handling in format
 string checking (#174684)

Closes #174331

(cherry picked from commit 15365d31e6b407d78d6c26c7b64cecacccccfd39)
---
 clang/lib/AST/FormatString.cpp   |  2 +-
 clang/test/Sema/format-strings.c | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/clang/lib/AST/FormatString.cpp b/clang/lib/AST/FormatString.cpp
index d4cb89b43ae87..36c5f57671631 100644
--- a/clang/lib/AST/FormatString.cpp
+++ b/clang/lib/AST/FormatString.cpp
@@ -371,7 +371,7 @@ static clang::analyze_format_string::ArgType::MatchKind
 matchesSizeTPtrdiffT(ASTContext &C, QualType T, QualType E) {
   using MatchKind = clang::analyze_format_string::ArgType::MatchKind;
 
-  if (!T->isIntegerType())
+  if (!T->isIntegerType() || T->isBooleanType())
     return MatchKind::NoMatch;
 
   if (C.hasSameType(T, E))
diff --git a/clang/test/Sema/format-strings.c b/clang/test/Sema/format-strings.c
index 5280549adc3d7..cdac83fc0bb91 100644
--- a/clang/test/Sema/format-strings.c
+++ b/clang/test/Sema/format-strings.c
@@ -983,3 +983,35 @@ void test_promotion(void) {
   // pointers
   printf("%s", i); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
 }
+
+void test_bool(_Bool b, _Bool* bp)
+{
+  printf("%zu", b); // expected-warning-re{{format specifies type 'size_t' (aka '{{.+}}') but the argument has type '_Bool'}}
+  printf("%td", b); // expected-warning-re{{format specifies type 'ptrdiff_t' (aka '{{.+}}') but the argument has type '_Bool'}}
+  printf("%jd", b); // expected-warning-re{{format specifies type 'intmax_t' (aka '{{.+}}') but the argument has type '_Bool'}}
+  printf("%lld", b); // expected-warning{{format specifies type 'long long' but the argument has type '_Bool'}}
+  printf("%ld", b); // expected-warning{{format specifies type 'long' but the argument has type '_Bool'}}
+  printf("%d", b); // promoted from _Bool to int
+  printf("%hhd", b); // promoted from _Bool to int
+  printf("%hd", b); // promoted from _Bool to int
+#if !defined(__Fuchsia__) && !defined(__ANDROID__) //'%n' specifier not supported on this platform
+  // The n conversion specifier only supports signed types
+  printf("%zn", bp); // expected-warning-re{{format specifies type 'signed size_t *' (aka '{{.+}}') but the argument has type '_Bool *'}}
+  printf("%jn", bp); // expected-warning-re{{format specifies type 'intmax_t *' (aka '{{.+}}') but the argument has type '_Bool *'}}
+  printf("%lln", bp); // expected-warning{{format specifies type 'long long *' but the argument has type '_Bool *'}}
+  printf("%ln", bp); // expected-warning{{format specifies type 'long *' but the argument has type '_Bool *'}}
+  printf("%n", bp); // expected-warning{{format specifies type 'int *' but the argument has type '_Bool *'}}
+  printf("%hhn", bp); // expected-warning{{format specifies type 'signed char *' but the argument has type '_Bool *'}}
+  printf("%hn", bp); // belong to -Wformat-type-confusion
+#endif
+  printf("%c", b); // expected-warning{{using '%c' format specifier, but argument has boolean value}}
+  printf("%s", b); // expected-warning{{format specifies type 'char *' but the argument has type '_Bool'}}
+  printf("%d", b); // promoted from _Bool to int
+  printf("%o", b); // promoted from _Bool to int
+  printf("%x", b); // promoted from _Bool to int
+  printf("%u", b); // promoted from _Bool to int
+  printf("%f", b); // expected-warning{{format specifies type 'double' but the argument has type '_Bool'}}
+  printf("%e", b); // expected-warning{{format specifies type 'double' but the argument has type '_Bool'}}
+  printf("%a", b); // expected-warning{{format specifies type 'double' but the argument has type '_Bool'}}
+  printf("%g", b); // expected-warning{{format specifies type 'double' but the argument has type '_Bool'}}
+}