From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id BFFE2382EF2C; Wed, 14 Dec 2022 12:16:51 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org BFFE2382EF2C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1671020211; bh=wloH66+UBvMB8z5NcaHKfZ+/B7BtXpuvb1uIQCOKetA=; h=From:To:Subject:Date:From; b=f9H5b9iSN2fKx3MY+E+GhDAzZZcKyz9znh//hOP3UY6vEg4c/RZ99JMhecaDtkwRM BUDbdaMyOvuu9qjiWspZC5iey7zmS23DPOljpjgT6MbF0JnPER4Wj1wsEFYfUd0Lcp tjc9j7iL8WRIRB89ngaq5uoLDCgbjOx8McgcP0mw= From: "geoffreydgr at icloud dot com" To: gcc-bugs@gcc.gnu.org Subject: [Bug analyzer/108100] New: GCC Static Analyzer does not know "(a || b) == true" in the true branch of "if (a || b) " Date: Wed, 14 Dec 2022 12:16:51 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: analyzer X-Bugzilla-Version: 13.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: geoffreydgr at icloud dot com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: dmalcolm at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter target_milestone Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D108100 Bug ID: 108100 Summary: GCC Static Analyzer does not know "(a || b) =3D=3D true" in the true branch of "if (a || b) " Product: gcc Version: 13.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: analyzer Assignee: dmalcolm at gcc dot gnu.org Reporter: geoffreydgr at icloud dot com Target Milestone: --- I found a problem that GCC static analyzer does not know "(a||b) =3D=3D tru= e" in the true branch of "if (a || b) "=EF=BC=8Cand takes the 'true' branch of `i= f (!a)` and the 'true' branch of `if (!b)` at the same time (which is contradictory), resulting in the wrong report of NPD warning.=20 I think GCC Static Analyer may not handle '||' operator well. Please take a look. I run gcc (trunk) with options `-fanalyzer -O0` https://godbolt.org/z/4Y41j1GfW Input: ```c #include int foo(bool a, bool b) { int *c =3D 0; int *d =3D 0; if (a || b){ __analyzer_eval(a); __analyzer_eval(b); __analyzer_eval(a||b); __analyzer_eval((a||b) =3D=3D true); if (!a){ if (!b){ __analyzer_eval(a||b); *d =3D 0; } } } } ``` Output: ```bash : In function 'foo': :7:9: warning: implicit declaration of function '__analyzer_eval' [-Wimplicit-function-declaration] 7 | __analyzer_eval(a); | ^~~~~~~~~~~~~~~ :7:9: warning: UNKNOWN 7 | __analyzer_eval(a); | ^~~~~~~~~~~~~~~~~~ :8:9: warning: UNKNOWN 8 | __analyzer_eval(b); | ^~~~~~~~~~~~~~~~~~ :9:9: warning: UNKNOWN 9 | __analyzer_eval(a||b); | ^~~~~~~~~~~~~~~~~~~~~ :10:9: warning: UNKNOWN 10 | __analyzer_eval((a||b) =3D=3D true); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ :14:17: warning: UNKNOWN 14 | __analyzer_eval(a||b); | ^~~~~~~~~~~~~~~~~~~~~ :15:20: warning: dereference of NULL 'd' [CWE-476] [-Wanalyzer-null-dereference] 15 | *d =3D 0; | ~~~^~~ 'foo': events 1-7 | | 4 | int *c =3D 0; | | ^ | | | | | (1) 'c' is NULL | 5 | int *d =3D 0; | | ~ | | | | | (2) 'c' is NULL |...... | 12 | if (!a){ | | ~ | | | | | (3) following 'true' branch... | 13 | if (!b){ | | ~~~ | | || | | |(4) ...to here | | (5) following 'true' branch... | 14 | __analyzer_eval(a||b); | | ~~~~~~~~~~~~~~~~~~~~~ | | | | | (6) ...to here | 15 | *d =3D 0; | | ~~~~~~ | | | | | (7) dereference of NULL 'd' | Compiler returned: 0 ```=