[llvm-branch-commits] [clang] release/23.x: [analyzer][z3] Fix crash in Z3 SMTConv when casting atomic int (#211489) (PR #211531)

[Tobias Hieta via llvm-branch-commits]

https://github.com/tru updated https://github.com/llvm/llvm-project/pull/211531

>From d2823bfa73ff4622fe467da12f13fb36d7104cbb Mon Sep 17 00:00:00 2001
From: guillem-bartrina-sonarsource <guillem.bartrina at sonarsource.com>
Date: Thu, 23 Jul 2026 12:40:44 +0200
Subject: [PATCH] [analyzer][z3] Fix crash in Z3 SMTConv when casting atomic
 int (#211489)

CPP-7675

(cherry picked from commit f953ed4ec657bef2b92b798faa2872b75f1f4e81)
---
 .../clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h     | 4 ++--
 clang/test/Analysis/z3/z3-crosscheck.c                    | 8 ++++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
index a494177372b6e..ffccf2c60e264 100644
--- a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
+++ b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h
@@ -264,8 +264,8 @@ class SMTConv {
                                           QualType ToTy, uint64_t ToBitWidth,
                                           QualType FromTy,
                                           uint64_t FromBitWidth) {
-    if ((FromTy->isIntegralOrEnumerationType() &&
-         ToTy->isIntegralOrEnumerationType()) ||
+    if ((FromTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType() &&
+         ToTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType()) ||
         (FromTy->isAnyPointerType() ^ ToTy->isAnyPointerType()) ||
         (FromTy->isBlockPointerType() ^ ToTy->isBlockPointerType()) ||
         (FromTy->isReferenceType() ^ ToTy->isReferenceType())) {
diff --git a/clang/test/Analysis/z3/z3-crosscheck.c b/clang/test/Analysis/z3/z3-crosscheck.c
index 41ecaee5529e0..6b467ce6982de 100644
--- a/clang/test/Analysis/z3/z3-crosscheck.c
+++ b/clang/test/Analysis/z3/z3-crosscheck.c
@@ -89,3 +89,11 @@ void e() {
   int f;
   a(f); // expected-warning {{1st function call argument is an uninitialized value [core.CallAndMessage]}}
 }
+
+void nullDerefGuardedByAtomicComp(int input) {
+  int *nullPointer = 0;
+  _Atomic int atomicValue = input;
+  if (atomicValue == 0) {
+    *nullPointer = 1; // no-crash // expected-warning {{Dereference of null pointer (loaded from variable 'nullPointer')}}
+  }
+}