[llvm-branch-commits] [clang] release/23.x: [analyzer][z3] Fix crash in Z3 SMTConv when casting atomic int (#211489) (PR #211531)

[via llvm-branch-commits]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-clang

Author: llvmbot

<details>
<summary>Changes</summary>

Backport f953ed4ec657bef2b92b798faa2872b75f1f4e81

Requested by: @<!-- -->steakhal

---
Full diff: https://github.com/llvm/llvm-project/pull/211531.diff


2 Files Affected:

- (modified) clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h (+2-2) 
- (modified) clang/test/Analysis/z3/z3-crosscheck.c (+8) 


``````````diff
diff --git a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
index a494177372b6e..ffccf2c60e264 100644
--- a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
+++ b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
@@ -264,8 +264,8 @@ class SMTConv {
                                           QualType ToTy, uint64_t ToBitWidth,
                                           QualType FromTy,
                                           uint64_t FromBitWidth) {
-    if ((FromTy->isIntegralOrEnumerationType() &&
-         ToTy->isIntegralOrEnumerationType()) ||
+    if ((FromTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType() &&
+         ToTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType()) ||
         (FromTy->isAnyPointerType() ^ ToTy->isAnyPointerType()) ||
         (FromTy->isBlockPointerType() ^ ToTy->isBlockPointerType()) ||
         (FromTy->isReferenceType() ^ ToTy->isReferenceType())) {
diff --git a/clang/test/Analysis/z3/z3-crosscheck.c b/clang/test/Analysis/z3/z3-crosscheck.c
index 41ecaee5529e0..6b467ce6982de 100644
--- a/clang/test/Analysis/z3/z3-crosscheck.c
+++ b/clang/test/Analysis/z3/z3-crosscheck.c
@@ -89,3 +89,11 @@ void e() {
   int f;
   a(f); // expected-warning {{1st function call argument is an uninitialized value [core.CallAndMessage]}}
 }
+
+void nullDerefGuardedByAtomicComp(int input) {
+  int *nullPointer = 0;
+  _Atomic int atomicValue = input;
+  if (atomicValue == 0) {
+    *nullPointer = 1; // no-crash // expected-warning {{Dereference of null pointer (loaded from variable 'nullPointer')}}
+  }
+}

``````````

</details>


https://github.com/llvm/llvm-project/pull/211531