static analyzer does not keep track of variable values

[llvmbot]

Bugzilla Link	16025
Version	trunk
OS	Linux
Attachments	report file
Reporter	LLVM Bugzilla Contributor
CC	@belkadan

Extended Description

Noticed while analyzing wine. The code in question: if(IsEqualCLSID((iter)->pclsid, rclsid) && (iter)->pfnGetClassObject) { if(!(iter)->pCF) hres = (iter)->pfnGetClassObject((*iter)->pfnCreateInstance, &IID_IUnknown, (void*)&(iter)->pCF); if((iter)->pCF) hres = IUnknown_QueryInterface((iter)->pCF, riid, ppv); TRACE("returning %p (%08x)\n", *ppv, hres); return hres;

the problem is that when analyzing, clang decides to take the false path initially (so (iter)->pCF is a valid pointer). It then takes the next false path, where (iter)->pCF is not valid.

This condition isn't possible, and makes the reports much less helpful.

The file in question is from wine/dlls/atl100/atl.c.

I've attached the html report from ccc-analyzer. Note lines 445/447.

[belkadan]

Cloned to rdar://problem/13938423

[llvmbot]

preprocessed file

Hm, interesting. Can you attach a preprocessed file?

Sure, attached is the output of: /home/austin/src/llvm/tools/clang/tools/scan-build/ccc-analyzer -m32 -E -I. -I. -I../../include -I../../include -DWINESRC -D_ATL_VER=_ATL_VER_100 -D_REENTRANT -fPIC -Wall -pipe -fno-strict-aliasing -Wdeclaration-after-statement -Wempty-body -Wignored-qualifiers -Wstrict-prototypes -Wtype-limits -Wunused-but-set-parameter -Wwrite-strings -gdwarf-2 -gstrict-dwarf -fno-omit-frame-pointer -Wpointer-arith -g -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -o atl.i atl.c

then gzip'ed.

[belkadan]

Hm, interesting. Can you attach a preprocessed file?

[llvmbot]

Clang used: git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179771 91177308-0d34-0410-b5e6-96231b3b80d8

wine-1.5.30.

[llvmbot]

assigned to @tkremenek