https://github.com/guillem-bartrina-sonarsource updated https://github.com/llvm/llvm-project/pull/211489
>From fa9de228557198b532aab28d71e0887506cc20e6 Mon Sep 17 00:00:00 2001 From: guillem-bartrina-sonarsource <[email protected]> Date: Thu, 23 Jul 2026 09:47:53 +0200 Subject: [PATCH 1/3] Add crashing example --- clang/test/Analysis/z3/z3-crosscheck.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/clang/test/Analysis/z3/z3-crosscheck.c b/clang/test/Analysis/z3/z3-crosscheck.c index 41ecaee5529e0..79a93c9e5bae2 100644 --- a/clang/test/Analysis/z3/z3-crosscheck.c +++ b/clang/test/Analysis/z3/z3-crosscheck.c @@ -89,3 +89,14 @@ void e() { int f; a(f); // expected-warning {{1st function call argument is an uninitialized value [core.CallAndMessage]}} } + +// don't crash, and also produce a core.NullDereference finding +_Atomic int b; +int x; +void k(void) { + int *p = 0; + b = x; + if (b == 0) { + *p = 1; // expected-warning {{Dereference of null pointer (loaded from variable 'p') [core.NullDereference]}} + } +} >From 356c7bb645001422828b7dfb211f537ea64ac8e8 Mon Sep 17 00:00:00 2001 From: guillem-bartrina-sonarsource <[email protected]> Date: Thu, 23 Jul 2026 11:09:21 +0200 Subject: [PATCH 2/3] Consider atomic integer types for casting --- .../include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h index 4ba0483dc0380..61a71545fb1a6 100644 --- a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h +++ b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h @@ -270,8 +270,8 @@ class SMTConv { QualType ToTy, uint64_t ToBitWidth, QualType FromTy, uint64_t FromBitWidth) { - if ((FromTy->isIntegralOrEnumerationType() && - ToTy->isIntegralOrEnumerationType()) || + if ((FromTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType() && + ToTy.getAtomicUnqualifiedType()->isIntegralOrEnumerationType()) || (FromTy->isAnyPointerType() ^ ToTy->isAnyPointerType()) || (FromTy->isBlockPointerType() ^ ToTy->isBlockPointerType()) || (FromTy->isReferenceType() ^ ToTy->isReferenceType())) { >From e577907a447df5a1f422c2b3760b9488ee4e538b Mon Sep 17 00:00:00 2001 From: guillem-bartrina-sonarsource <[email protected]> Date: Thu, 23 Jul 2026 12:07:22 +0200 Subject: [PATCH 3/3] Improve regression test --- clang/test/Analysis/z3/z3-crosscheck.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/clang/test/Analysis/z3/z3-crosscheck.c b/clang/test/Analysis/z3/z3-crosscheck.c index 79a93c9e5bae2..6b467ce6982de 100644 --- a/clang/test/Analysis/z3/z3-crosscheck.c +++ b/clang/test/Analysis/z3/z3-crosscheck.c @@ -90,13 +90,10 @@ void e() { a(f); // expected-warning {{1st function call argument is an uninitialized value [core.CallAndMessage]}} } -// don't crash, and also produce a core.NullDereference finding -_Atomic int b; -int x; -void k(void) { - int *p = 0; - b = x; - if (b == 0) { - *p = 1; // expected-warning {{Dereference of null pointer (loaded from variable 'p') [core.NullDereference]}} +void nullDerefGuardedByAtomicComp(int input) { + int *nullPointer = 0; + _Atomic int atomicValue = input; + if (atomicValue == 0) { + *nullPointer = 1; // no-crash // expected-warning {{Dereference of null pointer (loaded from variable 'nullPointer')}} } } _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
