diff --git a/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp b/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp index c883f90f5554ba..b8e3e933906021 100644 --- a/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp +++ b/clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp @@ -93,7 +93,19 @@ static Value *mergeDistinctValues(QualType Type, Value &Val1, Environment::ValueModel &Model) { // Join distinct boolean values preserving information about the constraints // in the respective path conditions. - if (auto *Expr1 = dyn_cast(&Val1)) { + if (Type->isBooleanType()) { + // FIXME: The type check above is a workaround and should be unnecessary. + // However, right now we can end up with BoolValue's in integer-typed + // variables due to our incorrect handling of boolean-to-integer casts (we + // just propagate the BoolValue to the result of the cast). For example: + // std::optional o; + // + // + // int x; + // if (o.has_value()) { + // x = o.value(); + // } + auto *Expr1 = cast(&Val1); auto *Expr2 = cast(&Val2); auto &MergedVal = MergedEnv.makeAtomicBoolValue(); MergedEnv.addToFlowCondition(MergedEnv.makeOr( diff --git a/clang/unittests/Analysis/FlowSensitive/UncheckedOptionalAccessModelTest.cpp b/clang/unittests/Analysis/FlowSensitive/UncheckedOptionalAccessModelTest.cpp index 4d9c57f0dacd53..1fcede5d62865c 100644 --- a/clang/unittests/Analysis/FlowSensitive/UncheckedOptionalAccessModelTest.cpp +++ b/clang/unittests/Analysis/FlowSensitive/UncheckedOptionalAccessModelTest.cpp @@ -2970,6 +2970,23 @@ TEST_P(UncheckedOptionalAccessTest, CtorInitializerValue) { cxxConstructorDecl(ofClass(hasName("Target")))); } +// This is regression test, it shouldn't crash. +TEST_P(UncheckedOptionalAccessTest, Bitfield) { + using namespace ast_matchers; + ExpectDiagnosticsFor( + R"( + #include "unchecked_optional_access_test.h" + struct Dst { + unsigned int n : 1; + }; + void target() { + $ns::$optional v; + Dst d; + if (v.has_value()) + d.n = v.value(); + } + )"); +} // FIXME: Add support for: // - constructors (copy, move) // - assignment operators (default, copy, move)