llvm / llvm/llvm-project

[CSA] FALSE POSITIVE: `core.DivideZero` retains a stale value after an opaque aliased call

Open
#219,677 4 comments 0 reactions 0 assignees View on GitHub
clang:static analyzer false-positive
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Hi, I found a false positive in Clang Static Analyzer 24.0.0git when an opaque call receives mutable and const aliases of the same variable.

**Affected tool**

`Clang Static Analyzer 24.0.0git (1cb7e838cd47ecad4050948c0c907ecb1f466ac3)`

**Affected checker**

`Clang Static Analyzer core.DivideZero`

**Minimal reproducer**

```cpp
void opaque(const int *, int *);
int f() {
int x = 1;
opaque(&x, &x);
return 1 / (x - 1);
}
```

**Reproduction command**

```bash
clang --version
clang --analyze -std=c++11 -Xanalyzer -analyzer-checker=core.DivideZero csa-core-dividezero-fp-opaque-call-alias.cpp
```

**Current behavior**

Clang Static Analyzer reports `csa-core-dividezero-fp-opaque-call-alias.cpp:5:12: warning: Division by zero [core.DivideZero]`.

**Expected behavior**

`core.DivideZero` should not report a definite division by zero because the opaque call can modify `x` through its mutable pointer argument.

Contributor guide

Open the contributing guide

Research direction

Start by running the supplied clang --analyze command on csa-core-dividezero-fp-opaque-call-alias.cpp with the core.DivideZero checker enabled. Trace how the checker models the opaque call when const and mutable aliases refer to x. Done means the reproducer no longer produces a definite Division by zero warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
64/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.