Skip to content

Sanity check both branches not dead #826

@sim642

Description

@sim642

Every now and then we've had unsoundness issues at branches which have both (true and false) outgoing edges raise Deadcode and yield bottom states. We should have a sanity check for this.

After #525, the dead branch reporting uses a flat boolean lattice:

match tv with
| `Lifted tv ->
let loc = Node.location g in (* TODO: looking up location now doesn't work nicely with incremental *)
let cilinserted = if loc.synthetic then "(possibly inserted by CIL) " else "" in
M.warn ~loc:(Node g) ~tags:[CWE (if tv then 571 else 570)] ~category:Deadcode "condition '%a' %sis always %B" d_exp exp cilinserted tv
| `Bot (* all branches dead? can happen at our inserted Neg(1)-s because no Pos(1) *)
| `Top -> (* may be both true and false *)
()

Thus the Bot case would be when neither outgoing edge is live.
As the comment mentions, only problem is our Neg(1) edges, which don't have a corresponding Pos(1), so the single false branch being trivially dead means that there's also a Bot.

Metadata

Metadata

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions