GCC Static Analyzer does not know `(a || b) == true` in the true branch of `if (a || b)`

[Geoffrey1014]

date: 2022-12-13 Commit: 8c8ca873216387bc26046615c806b96f0345ff9d args: -O0 -fanalyzer test:

#include <stdbool.h>

int foo(bool a, bool b) {
    int *c = 0;
    int *d = 0;
    if (a || b){
        __analyzer_eval(a);
        __analyzer_eval(b);
        __analyzer_eval(a||b);
        __analyzer_eval((a||b) == true);

        if (!a){
            if (!b){
                __analyzer_eval(a||b);
                *d = 0;
            }
        }
    }
}

report: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108100 fix: original:

[Geoffrey1014]

I found a problem that GCC static analyzer does not know "(a||b) == true" in the true branch of "if (a || b) "，and takes the 'true' branch of if (!a) and the 'true' branch of if (!b) at the same time (which is contradictory), resulting in the wrong report of NPD warning. I think GCC Static Analyer may not handle '||' operator well. Please take a look.

I run gcc (trunk) with options -fanalyzer -O0 https://godbolt.org/z/4Y41j1GfW

Input:

#include <stdbool.h>

int foo(bool a, bool b) {
    int *c = 0;
    int *d = 0;
    if (a || b){
        __analyzer_eval(a);
        __analyzer_eval(b);
        __analyzer_eval(a||b);
        __analyzer_eval((a||b) == true);

        if (!a){
            if (!b){
                __analyzer_eval(a||b);
                *d = 0;
            }
        }
    }
}

Output:

<source>: In function 'foo':
<source>:7:9: warning: implicit declaration of function '__analyzer_eval' [-Wimplicit-function-declaration]
    7 |         __analyzer_eval(a);
      |         ^~~~~~~~~~~~~~~
<source>:7:9: warning: UNKNOWN
    7 |         __analyzer_eval(a);
      |         ^~~~~~~~~~~~~~~~~~
<source>:8:9: warning: UNKNOWN
    8 |         __analyzer_eval(b);
      |         ^~~~~~~~~~~~~~~~~~
<source>:9:9: warning: UNKNOWN
    9 |         __analyzer_eval(a||b);
      |         ^~~~~~~~~~~~~~~~~~~~~
<source>:10:9: warning: UNKNOWN
   10 |         __analyzer_eval((a||b) == true);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<source>:14:17: warning: UNKNOWN
   14 |                 __analyzer_eval(a||b);
      |                 ^~~~~~~~~~~~~~~~~~~~~
<source>:15:20: warning: dereference of NULL 'd' [CWE-476] [-Wanalyzer-null-dereference]
   15 |                 *d = 0;
      |                 ~~~^~~
  'foo': events 1-7
    |
    |    4 |     int *c = 0;
    |      |          ^
    |      |          |
    |      |          (1) 'c' is NULL
    |    5 |     int *d = 0;
    |      |          ~
    |      |          |
    |      |          (2) 'c' is NULL
    |......
    |   12 |         if (!a){
    |      |            ~
    |      |            |
    |      |            (3) following 'true' branch...
    |   13 |             if (!b){
    |      |                ~~~
    |      |                ||
    |      |                |(4) ...to here
    |      |                (5) following 'true' branch...
    |   14 |                 __analyzer_eval(a||b);
    |      |                 ~~~~~~~~~~~~~~~~~~~~~
    |      |                 |
    |      |                 (6) ...to here
    |   15 |                 *d = 0;
    |      |                 ~~~~~~
    |      |                    |
    |      |                    (7) dereference of NULL 'd'
    |
Compiler returned: 0

[Geoffrey1014]

CSA can handle "||". https://godbolt.org/z/48EnbqKEr