-
Notifications
You must be signed in to change notification settings - Fork 84
Closed
Description
Every now and then we've had unsoundness issues at branches which have both (true and false) outgoing edges raise Deadcode and yield bottom states. We should have a sanity check for this.
After #525, the dead branch reporting uses a flat boolean lattice:
analyzer/src/framework/constraints.ml
Lines 1118 to 1125 in 21e59a1
| match tv with | |
| | `Lifted tv -> | |
| let loc = Node.location g in (* TODO: looking up location now doesn't work nicely with incremental *) | |
| let cilinserted = if loc.synthetic then "(possibly inserted by CIL) " else "" in | |
| M.warn ~loc:(Node g) ~tags:[CWE (if tv then 571 else 570)] ~category:Deadcode "condition '%a' %sis always %B" d_exp exp cilinserted tv | |
| | `Bot (* all branches dead? can happen at our inserted Neg(1)-s because no Pos(1) *) | |
| | `Top -> (* may be both true and false *) | |
| () |
Thus the
Bot case would be when neither outgoing edge is live.As the comment mentions, only problem is our
Neg(1) edges, which don't have a corresponding Pos(1), so the single false branch being trivially dead means that there's also a Bot.