https://github.com/marco-milanese-sonarsource created https://github.com/llvm/llvm-project/pull/219225
This PR fixes a false positive on `UnreachableCodeChecker` occurring when STU exploration exhausts the steps budget and the CTU second phase completes its exploration (i.e., has no more work to do). There are two code pieces to consider: * When we transition from STU exploration to CTU exploration ([`CoreEngine.h:173`](https://github.com/llvm/llvm-project/blob/main/clang/lib/StaticAnalyzer/Core/CoreEngine.cpp#L173)) we move `CTUWList` to `WList`: ```c++ if (CTUWList) { NumSTUSteps += STUSteps; const unsigned MinCTUSteps = this->ExprEng.getAnalysisManager().options.CTUMaxNodesMin; const unsigned Pct = this->ExprEng.getAnalysisManager().options.CTUMaxNodesPercentage; unsigned MaxCTUSteps = std::max(STUSteps * Pct / 100, MinCTUSteps); WList = std::move(CTUWList); // remaining STU work gets discarded const unsigned CTUSteps = ProcessWList(MaxCTUSteps); NumCTUSteps += CTUSteps; } ``` * At the end of the analysis `UnreachableCodeChecker` checks for code that was not explored. This is corresponds to actual dead code only as long as the exploration is complete, thus (correctly) the checker calls `hasWorkRemaining` ([`CoreEngine.h:149`](https://github.com/llvm/llvm-project/blob/main/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h#L149-L151)). If such predicate is true it immediately bails out as any finding may be due to the uncomplete exploration. * `hasWorkRemaining` relies on `WList` being empty or not to determine if there is work remaining (i.e., complete/uncomplete exploration): ```c++ bool hasWorkRemaining() const { return wasBlocksExhausted() || WList->hasWork() || wasBlockAborted(); } ``` Now, consider the scenario where: 1. STU exploration was *not* exhaustive (i.e., some code was not analyzed because we did not have enough steps budget). 2. CTU exploration was exhaustive. In this case `hasWorkRemaining` should return `true` as STU exploration had more work to do, but because we override it with the CTU worklist (and the latter is fully emptied), then `hasWorkRemaining` will return `false`, raising the false positive. This can be simulated in the regression test by setting a very low STU budget and enabling CTU mode. Actually we don't need to do any CTU work, supply extra TUs; this is because the switch to the CTU worklist (empty) is always done when CTU mode is enabled. >From 59f08b836ae562a43939d8317b5855bafed5e2c0 Mon Sep 17 00:00:00 2001 From: Marco Milanese <[email protected]> Date: Thu, 27 Aug 2026 16:42:47 +0200 Subject: [PATCH] Add regression test --- clang/test/Analysis/ctu/stu-workremaining.cpp | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 clang/test/Analysis/ctu/stu-workremaining.cpp diff --git a/clang/test/Analysis/ctu/stu-workremaining.cpp b/clang/test/Analysis/ctu/stu-workremaining.cpp new file mode 100644 index 0000000000000..1524a98ec9a93 --- /dev/null +++ b/clang/test/Analysis/ctu/stu-workremaining.cpp @@ -0,0 +1,21 @@ +// RUN: %clang_analyze_cc1 -std=c++20 \ +// RUN: -analyzer-checker=core,alpha.deadcode.UnreachableCode \ +// RUN: -analyzer-config experimental-enable-naive-ctu-analysis=true \ +// RUN: -analyzer-config max-nodes=10 \ +// RUN: -verify=ctu-on %s +// ctu-on-no-diagnostics + +// RUN: %clang_analyze_cc1 -std=c++20 \ +// RUN: -analyzer-checker=core,alpha.deadcode.UnreachableCode \ +// RUN: -analyzer-config experimental-enable-naive-ctu-analysis=false \ +// RUN: -analyzer-config max-nodes=10 \ +// RUN: -verify=ctu-off %s +// ctu-off-no-diagnostics + +#define NOP ((void)0) + +void entrypoint(int x) { + NOP; NOP; NOP; NOP; NOP; + NOP; NOP; NOP; NOP; NOP; + if (x) NOP; +} _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
