[llvm-branch-commits] [clang] d2823bf - [analyzer][z3] Fix crash in Z3 SMTConv when casting atomic int (#211489)

[Tobias Hieta via llvm-branch-commits]

Author: guillem-bartrina-sonarsource
Date: 2026-07-23T16:26:32+02:00
New Revision: d2823bfa73ff4622fe467da12f13fb36d7104cbb

URL: https://github.com/llvm/llvm-project/commit/d2823bfa73ff4622fe467da12f13fb36d7104cbb
DIFF: https://github.com/llvm/llvm-project/commit/d2823bfa73ff4622fe467da12f13fb36d7104cbb.diff

LOG: [analyzer][z3] Fix crash in Z3 SMTConv when casting atomic int (#211489)

CPP-7675

(cherry picked from commit f953ed4ec657bef2b92b798faa2872b75f1f4e81)

Added: 
    

Modified: 
    clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
    clang/test/Analysis/z3/z3-crosscheck.c

Removed: 
    


################################################################################
diff  --git a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
index a494177372b6e..ffccf2c60e264 100644
--- a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
+++ b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
@@ -264,8 +264,8 @@ class SMTConv {
                                           QualType ToTy, uint64_t ToBitWidth,
                                           QualType FromTy,
                                           uint64_t FromBitWidth) {
-    if ((FromTy->isIntegralOrEnumerationType() &&
-         ToTy->isIntegralOrEnumerationType()) ||
+    if ((FromTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType() &&
+         ToTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType()) ||
         (FromTy->isAnyPointerType() ^ ToTy->isAnyPointerType()) ||
         (FromTy->isBlockPointerType() ^ ToTy->isBlockPointerType()) ||
         (FromTy->isReferenceType() ^ ToTy->isReferenceType())) {

diff  --git a/clang/test/Analysis/z3/z3-crosscheck.c b/clang/test/Analysis/z3/z3-crosscheck.c
index 41ecaee5529e0..6b467ce6982de 100644
--- a/clang/test/Analysis/z3/z3-crosscheck.c
+++ b/clang/test/Analysis/z3/z3-crosscheck.c
@@ -89,3 +89,11 @@ void e() {
   int f;
   a(f); // expected-warning {{1st function call argument is an uninitialized value [core.CallAndMessage]}}
 }
+
+void nullDerefGuardedByAtomicComp(int input) {
+  int *nullPointer = 0;
+  _Atomic int atomicValue = input;
+  if (atomicValue == 0) {
+    *nullPointer = 1; // no-crash // expected-warning {{Dereference of null pointer (loaded from variable 'nullPointer')}}
+  }
+}