For __builtin_bit_cast, we just need to evalLocation for the second argument instead of evalLoad.

Author: ziqingluo-90

clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp

@@ -285,23 +285,27 @@ void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex,
   ExplodedNodeSet dstPreStmt;
   getCheckerManager().runCheckersForPreStmt(dstPreStmt, Pred, CastE, *this);
 
-  if (CastE->getCastKind() == CK_LValueToRValue ||
-      CastE->getCastKind() == CK_LValueToRValueBitCast) {
+  if (CastE->getCastKind() == CK_LValueToRValue) {
+    for (ExplodedNode *subExprNode : dstPreStmt) {
+      ProgramStateRef state = subExprNode->getState();
+      const LocationContext *LCtx = subExprNode->getLocationContext();
+      evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
+    }
+    return;
+  }
+  if (CastE->getCastKind() == CK_LValueToRValueBitCast) {
+    // Handle `__builtin_bit_cast`:
     ExplodedNodeSet dstEvalLoad;
 
+    // Simulate the lvalue-to-rvalue conversion on `Ex`:
     for (ExplodedNode *subExprNode : dstPreStmt) {
       ProgramStateRef state = subExprNode->getState();
       const LocationContext *LCtx = subExprNode->getLocationContext();
-      evalLoad(dstEvalLoad, CastE, CastE, subExprNode, state,
-               state->getSVal(Ex, LCtx));
-    }
-    if (CastE->getCastKind() == CK_LValueToRValue) {
-      Dst.insert(dstEvalLoad);
-      return;
+      evalLocation(dstEvalLoad, CastE, Ex, subExprNode, state,
+                   state->getSVal(Ex, LCtx), true);
     }
-    assert(CastE->getCastKind() == CK_LValueToRValueBitCast &&
-           "unexpected cast kind");
-    // Need to simulate the actual cast operation:
+    // Simulate the operation that actually casts the original value to a new
+    // value of the destination type :
     StmtNodeBuilder Bldr(dstEvalLoad, Dst, *currBldrCtx);
 
     for (ExplodedNode *Node : dstEvalLoad) {