public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/108100] New: GCC Static Analyzer does not know "(a || b) == true" in the true branch of "if (a || b) "
@ 2022-12-14 12:16 geoffreydgr at icloud dot com
2023-04-04 1:20 ` [Bug analyzer/108100] " geoffreydgr at icloud dot com
0 siblings, 1 reply; 2+ messages in thread
From: geoffreydgr at icloud dot com @ 2022-12-14 12:16 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108100
Bug ID: 108100
Summary: GCC Static Analyzer does not know "(a || b) == true"
in the true branch of "if (a || b) "
Product: gcc
Version: 13.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: geoffreydgr at icloud dot com
Target Milestone: ---
I found a problem that GCC static analyzer does not know "(a||b) == true" in
the true branch of "if (a || b) ",and takes the 'true' branch of `if (!a)` and
the 'true' branch of `if (!b)` at the same time (which is contradictory),
resulting in the wrong report of NPD warning.
I think GCC Static Analyer may not handle '||' operator well. Please take a
look.
I run gcc (trunk) with options `-fanalyzer -O0`
https://godbolt.org/z/4Y41j1GfW
Input:
```c
#include <stdbool.h>
int foo(bool a, bool b) {
int *c = 0;
int *d = 0;
if (a || b){
__analyzer_eval(a);
__analyzer_eval(b);
__analyzer_eval(a||b);
__analyzer_eval((a||b) == true);
if (!a){
if (!b){
__analyzer_eval(a||b);
*d = 0;
}
}
}
}
```
Output:
```bash
<source>: In function 'foo':
<source>:7:9: warning: implicit declaration of function '__analyzer_eval'
[-Wimplicit-function-declaration]
7 | __analyzer_eval(a);
| ^~~~~~~~~~~~~~~
<source>:7:9: warning: UNKNOWN
7 | __analyzer_eval(a);
| ^~~~~~~~~~~~~~~~~~
<source>:8:9: warning: UNKNOWN
8 | __analyzer_eval(b);
| ^~~~~~~~~~~~~~~~~~
<source>:9:9: warning: UNKNOWN
9 | __analyzer_eval(a||b);
| ^~~~~~~~~~~~~~~~~~~~~
<source>:10:9: warning: UNKNOWN
10 | __analyzer_eval((a||b) == true);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<source>:14:17: warning: UNKNOWN
14 | __analyzer_eval(a||b);
| ^~~~~~~~~~~~~~~~~~~~~
<source>:15:20: warning: dereference of NULL 'd' [CWE-476]
[-Wanalyzer-null-dereference]
15 | *d = 0;
| ~~~^~~
'foo': events 1-7
|
| 4 | int *c = 0;
| | ^
| | |
| | (1) 'c' is NULL
| 5 | int *d = 0;
| | ~
| | |
| | (2) 'c' is NULL
|......
| 12 | if (!a){
| | ~
| | |
| | (3) following 'true' branch...
| 13 | if (!b){
| | ~~~
| | ||
| | |(4) ...to here
| | (5) following 'true' branch...
| 14 | __analyzer_eval(a||b);
| | ~~~~~~~~~~~~~~~~~~~~~
| | |
| | (6) ...to here
| 15 | *d = 0;
| | ~~~~~~
| | |
| | (7) dereference of NULL 'd'
|
Compiler returned: 0
```
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-04-04 1:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-14 12:16 [Bug analyzer/108100] New: GCC Static Analyzer does not know "(a || b) == true" in the true branch of "if (a || b) " geoffreydgr at icloud dot com
2023-04-04 1:20 ` [Bug analyzer/108100] " geoffreydgr at icloud dot com
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).