AstPin* outpinp;
             {
                 AstVar* outModVarp = (AstVar*) nodep->modVarp()->user4p();
// BUG - outModVarp is NULL here
                 AstNode* outexprp = nodep->exprp()->cloneTree(false);  // Note has lvalue() set
                 outpinp = new AstPin(nodep->fileline(),
                                      nodep->pinNum(),
// CRASH - Null pointer dereference
                                      outModVarp->name(),  // should be {var}"__out"
                                      outexprp);

module testcase_xz (
     input clk,
     output out
);

reg out;

always @(posedge clk)
begin
     if ( clk !== 1'bx && clk !== 1'bz )
     begin
         out <= ~out;
     end
end

endmodule