[clang][analyzer] Fix a nullptr dereference when `-ftime-trace` is used (#139820)
Fixes #139779.
The bug was introduced in #137355 in `SymbolConjured::getStmt`, when
trying to obtain a statement for a CFG initializer without an
initializer. This commit adds a null check before access.
diff --git a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h
index 9e7c98f..2e06e71 100644
--- a/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h
+++ b/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h
@@ -103,7 +103,10 @@
const Stmt *getStmt() const {
switch (Elem->getKind()) {
case CFGElement::Initializer:
- return Elem->castAs<CFGInitializer>().getInitializer()->getInit();
+ if (const auto *Init = Elem->castAs<CFGInitializer>().getInitializer()) {
+ return Init->getInit();
+ }
+ return nullptr;
case CFGElement::ScopeBegin:
return Elem->castAs<CFGScopeBegin>().getTriggerStmt();
case CFGElement::ScopeEnd:
diff --git a/clang/test/Analysis/ftime-trace-no-init.cpp b/clang/test/Analysis/ftime-trace-no-init.cpp
new file mode 100644
index 0000000..7fb289b
--- /dev/null
+++ b/clang/test/Analysis/ftime-trace-no-init.cpp
@@ -0,0 +1,5 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,apiModeling %s -ftime-trace=%t.raw.json -verify
+// expected-no-diagnostics
+
+// GitHub issue 139779
+struct {} a; // no-crash
