llvm / llvm/llvm-project

[analyzer] False positive core.CallAndMessage on unreachable code guarded by constant global condition

Open
#217,963 6 comments 0 reactions 0 assignees View on GitHub
clang:static analyzer false-positive
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

clang version 24.0.0git 0c8f1121a2bb2095227dab641e66e5ea4c238e87
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/tmptest/llvm-project/build/bin
Build config: +assertions

https://godbolt.org/z/Ghqoa6ros

```c++
#include

static int a = 1;
static int b = 0;

void func1() {
char *c;
if (a) {
printf("%s\n", c);
}
}

void func2() {
char *d;
if (b) {
printf("%s\n", d); // false positive
}
}

int main() {
func1();
func2();
return 0;
}
```

Both functions produce warnings:

```
test.c:9:9: warning: 2nd function call argument is an uninitialized value [core.CallAndMessage]
9 | printf("%s\n", c);
| ^~~~~~~~~~~~~~~~~
test.c:16:9: warning: 2nd function call argument is an uninitialized value [core.CallAndMessage]
16 | printf("%s\n", d);
| ^~~~~~~~~~~~~~~~~
2 warnings generated.
```

The warning in func2 is a false positive.

Contributor guide

Open the contributing guide

Research direction

Start with the Godbolt reproducer and the analyzer's core.CallAndMessage checker, comparing the diagnostics for func1 and func2 under the constant global conditions. Confirm how unreachable code is modeled and preserve the warning for reachable code; done means func2 no longer reports the uninitialized argument while func1 still does.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.