[CSA] FALSE POSITIVE: `core.DivideZero` retains a stale value after an opaque aliased call
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
Hi, I found a false positive in Clang Static Analyzer 24.0.0git when an opaque call receives mutable and const aliases of the same variable.
**Affected tool**
`Clang Static Analyzer 24.0.0git (1cb7e838cd47ecad4050948c0c907ecb1f466ac3)`
**Affected checker**
`Clang Static Analyzer core.DivideZero`
**Minimal reproducer**
```cpp
void opaque(const int *, int *);
int f() {
int x = 1;
opaque(&x, &x);
return 1 / (x - 1);
}
```
**Reproduction command**
```bash
clang --version
clang --analyze -std=c++11 -Xanalyzer -analyzer-checker=core.DivideZero csa-core-dividezero-fp-opaque-call-alias.cpp
```
**Current behavior**
Clang Static Analyzer reports `csa-core-dividezero-fp-opaque-call-alias.cpp:5:12: warning: Division by zero [core.DivideZero]`.
**Expected behavior**
`core.DivideZero` should not report a definite division by zero because the opaque call can modify `x` through its mutable pointer argument.
Contributor guide
Research direction
Start by running the supplied clang --analyze command on csa-core-dividezero-fp-opaque-call-alias.cpp with the core.DivideZero checker enabled. Trace how the checker models the opaque call when const and mutable aliases refer to x. Done means the reproducer no longer produces a definite Division by zero warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100