[analyzer] Fails to load from a bitfield that was covered by a type-punned write before
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
The [commit](https://github.com/llvm/llvm-project/commit/a6a34333a113) causing false positives:
Minimal reproducer:
```c++
// Minimal reproducer for core.uninitialized.Assign false positive
// introduced by LLVM commit a6a34333a113 (present in main).
//
// main: reports "Assigned value is uninitialized" on *out = s.val
// Reverted: no finding (correct)
//
// Reproduce:
// clang --analyze -Xanalyzer -analyzer-checker=core single.c
typedef struct {
unsigned pad : 4;
unsigned val : 4;
} S1;
unsigned* extern_func(unsigned*);
int callee_func(unsigned* out)
{
unsigned v;
unsigned* p = extern_func(&v);
if (p != &v)
return 1;
*out = *p;
return 0;
}
void caller_func(unsigned char* out)
{
S1 s = {0};
if (callee_func((unsigned*)&s) == 0)
*out = s.val;
}
```
Contributor guide
Research direction
Start with the minimal reproducer in the issue and run the shown clang --analyze command with the core checker. Compare behavior against commit a6a34333a113; done means the analyzer no longer reports a false positive for the type-punned bitfield write while preserving the intended uninitialized-value diagnostic behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100