[MC/DC][branch coverage] trouble in handling macros from system headers with cast

[whentojump]

Compiler explorer link.

test.c

// (1) macros defined in a system header
#include <test.h>

int buf[100];
int a, b, c;

int main(void) {
    if ( FOO(buf) && a && b )
        return 1;
    if ( BAR(buf) && a && b )
        return 2;
    return 3;
}

test.h

#define FOO(x) ( x[0] && x[1] )
#define BAR(x) ( ((int *)x)[0] && ((int *)x)[1] ) // (2) cast

Expressions involving FOO or BAR exhibit different behaviors in terms of MC/DC: different numbers of conditions are reported

    7|                   1|int main(void) {
    8|                   1|    if ( FOO(buf) && a && b )
  -------------------------------
  |---> MC/DC Decision Region (8:10) to (8:28)
  |
  |  Number of Conditions: 4
  |     Condition C1 --> (8:10)
  |     Condition C2 --> (8:10)
  |     Condition C3 --> (8:22)
  |     Condition C4 --> (8:27)
  |
  |  Executed MC/DC Test Vectors:
  |
  |     C1, C2, C3, C4    Result
  |  1 { F,  -,  -,  -  = F      }
  |
  |  C1-Pair: not covered
  |  C2-Pair: not covered
  |  C3-Pair: not covered
  |  C4-Pair: not covered
  |  MC/DC Coverage for Decision: 0.00%
  |
  -------------------------------
    9|                   0|        return 1;
   10|                   1|    if ( BAR(buf) && a && b )
  -------------------------------
  |---> MC/DC Decision Region (10:10) to (10:28)
  |
  |  Number of Conditions: 3
  |     Condition C1 --> (10:10)
  |     Condition C2 --> (10:22)
  |     Condition C3 --> (10:27)
  |
  |  Executed MC/DC Test Vectors:
  |
  |     C1, C2, C3    Result
  |  1 { F,  -,  -  = F      }
  |
  |  C1-Pair: not covered
  |  C2-Pair: not covered
  |  C3-Pair: not covered
  |  MC/DC Coverage for Decision: 0.00%
  |
  -------------------------------
   11|                   0|        return 2;
   12|                   1|    return 3;
   13|                   1|}

Real-world example: https://sources.debian.org/src/hostname/3.23%2Bnmu1/hostname.c/#L312

cc: @evodius96

[whentojump]

In fact, with the same triggering conditions, branch coverage is affected as well. Compiler explorer link.

   14|      1|int main(void) {
   15|      1|    if (true) {
  ------------------
  |  Branch (15:9): [True: 1, Folded]
  ------------------
   16|      1|        return 1;
   17|      1|    } else {
   18|      0|        if ( a && BAR(buf) )
  ------------------
  |  Branch (18:14): [True: 0, False: 0]
  |  Branch (18:19): [True: 1, False: 18.4E]
  ------------------
   19|      0|            return 2;
   20|      0|    }
   21|      0|    return 3;
   22|      1|}

The True outcome is believed to be taken once. Since the whole else {...} is not executed, the False outcome ends up with a negative counter 0xffffffffffffffff, or 18,446,744,073,709,551,615, or 18.4E.