llvm / llvm/llvm-project

[Analyzer] false-positive on clang-analyzer-core.uninitialized.Branch on coroutine promise type

Open
#193,397 4 comments 0 reactions 0 assignees View on GitHub
clang:static analyzer confirmed false-positive
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

It seems like this analysis doesn't correctly understand that `PromiseType` gets default-initialized?

```c++
#include
#include

namespace repro
{

struct ReturnObject;

struct PromiseType
{
bool receiver;

PromiseType() : receiver(false) {}

ReturnObject get_return_object();

std::suspend_never initial_suspend() noexcept { return {}; }
std::suspend_never final_suspend() noexcept { return {}; }
void unhandled_exception() { std::terminate(); }

void return_value(int value)
{
if (receiver) {}
}
};

struct ReturnObject
{
using promise_type = PromiseType;
};

ReturnObject PromiseType::get_return_object()
{
return {};
}

ReturnObject co_return_after_branch(bool fail)
{
if (fail)
{
co_return 1;
}
co_return 0;
}

} // namespace repro

int main()
{
auto promise = repro::co_return_after_branch(true);
(void)promise;
return 0;
}
```

```
% /nix/store/h3ikd8i3dq1hd7xpzy15kjj7nkwc7x59-clang-tools-22.1.2/bin/clang-tidy \
clang_analyzer_cobalt_promise_repro.cpp \
-checks="-*,clang-analyzer-core.uninitialized.Branch" \
-warnings-as-errors=clang-analyzer-core.uninitialized.Branch \
-- \
-std=c++23 \
-I.
1 warning generated.
clang_analyzer_cobalt_promise_repro.cpp:23:13: error: Branch condition evaluates to a garbage value [clang-analyzer-core.uninitialized.Branch,-warnings-as-errors]
23 | if (receiver) {}
| ^
clang_analyzer_cobalt_promise_repro.cpp:50:20: note: Calling 'co_return_after_branch'
50 | auto promise = repro::co_return_after_branch(true);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
clang_analyzer_cobalt_promise_repro.cpp:39:9: note: 'fail' is true
39 | if (fail)
| ^~~~
clang_analyzer_cobalt_promise_repro.cpp:39:5: note: Taking true branch
39 | if (fail)
| ^
clang_analyzer_cobalt_promise_repro.cpp:41:9: note: Calling 'PromiseType::return_value'
41 | co_return 1;
| ^~~~~~~~~~~
clang_analyzer_cobalt_promise_repro.cpp:23:13: note: Branch condition evaluates to a garbage value
23 | if (receiver) {}
| ^~~~~~~~
1 warning treated as error
```

Got this by minimising an example out of a codebase that used `boost::cobalt::promise`, so I've hit this in the real world...

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.