[analyzer] False positive core.CallAndMessage on unreachable code guarded by constant global condition
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
clang version 24.0.0git 0c8f1121a2bb2095227dab641e66e5ea4c238e87
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/tmptest/llvm-project/build/bin
Build config: +assertions
https://godbolt.org/z/Ghqoa6ros
```c++
#include
static int a = 1;
static int b = 0;
void func1() {
char *c;
if (a) {
printf("%s\n", c);
}
}
void func2() {
char *d;
if (b) {
printf("%s\n", d); // false positive
}
}
int main() {
func1();
func2();
return 0;
}
```
Both functions produce warnings:
```
test.c:9:9: warning: 2nd function call argument is an uninitialized value [core.CallAndMessage]
9 | printf("%s\n", c);
| ^~~~~~~~~~~~~~~~~
test.c:16:9: warning: 2nd function call argument is an uninitialized value [core.CallAndMessage]
16 | printf("%s\n", d);
| ^~~~~~~~~~~~~~~~~
2 warnings generated.
```
The warning in func2 is a false positive.
Contributor guide
Research direction
Start with the Godbolt reproducer and the analyzer's core.CallAndMessage checker, comparing the diagnostics for func1 and func2 under the constant global conditions. Confirm how unreachable code is modeled and preserve the warning for reachable code; done means func2 no longer reports the uninitialized argument while func1 still does.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100