[Analyzer] false-positive on clang-analyzer-core.uninitialized.Branch on coroutine promise type
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
It seems like this analysis doesn't correctly understand that `PromiseType` gets default-initialized?
```c++
#include
#include
namespace repro
{
struct ReturnObject;
struct PromiseType
{
bool receiver;
PromiseType() : receiver(false) {}
ReturnObject get_return_object();
std::suspend_never initial_suspend() noexcept { return {}; }
std::suspend_never final_suspend() noexcept { return {}; }
void unhandled_exception() { std::terminate(); }
void return_value(int value)
{
if (receiver) {}
}
};
struct ReturnObject
{
using promise_type = PromiseType;
};
ReturnObject PromiseType::get_return_object()
{
return {};
}
ReturnObject co_return_after_branch(bool fail)
{
if (fail)
{
co_return 1;
}
co_return 0;
}
} // namespace repro
int main()
{
auto promise = repro::co_return_after_branch(true);
(void)promise;
return 0;
}
```
```
% /nix/store/h3ikd8i3dq1hd7xpzy15kjj7nkwc7x59-clang-tools-22.1.2/bin/clang-tidy \
clang_analyzer_cobalt_promise_repro.cpp \
-checks="-*,clang-analyzer-core.uninitialized.Branch" \
-warnings-as-errors=clang-analyzer-core.uninitialized.Branch \
-- \
-std=c++23 \
-I.
1 warning generated.
clang_analyzer_cobalt_promise_repro.cpp:23:13: error: Branch condition evaluates to a garbage value [clang-analyzer-core.uninitialized.Branch,-warnings-as-errors]
23 | if (receiver) {}
| ^
clang_analyzer_cobalt_promise_repro.cpp:50:20: note: Calling 'co_return_after_branch'
50 | auto promise = repro::co_return_after_branch(true);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
clang_analyzer_cobalt_promise_repro.cpp:39:9: note: 'fail' is true
39 | if (fail)
| ^~~~
clang_analyzer_cobalt_promise_repro.cpp:39:5: note: Taking true branch
39 | if (fail)
| ^
clang_analyzer_cobalt_promise_repro.cpp:41:9: note: Calling 'PromiseType::return_value'
41 | co_return 1;
| ^~~~~~~~~~~
clang_analyzer_cobalt_promise_repro.cpp:23:13: note: Branch condition evaluates to a garbage value
23 | if (receiver) {}
| ^~~~~~~~
1 warning treated as error
```
Got this by minimising an example out of a codebase that used `boost::cobalt::promise`, so I've hit this in the real world...
Contributor guide
Assessment
This issue has not been assessed yet.