<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>I hate to say this, but you're not going to be able to do this as a usual path-sensitive check. The main analyzer checkers are good at finding "is X true on <i>any</i> path", but not so good at "is X true on <i>all</i> paths". There are plenty of cases where the analyzer might not explore all possible paths:</div><div><br></div><div>- The function is too big.</div><div>- There's a construct the analyzer can't model (try-catch)</div><div>- For efficiency, simplifying assumptions have been made that won't be true in real life.</div><div>- For efficiency, not all functions are analyzed as top-level, which means certain paths might not be taken due to known argument values.</div><div><br></div><div>And there are cases where the general rule isn't going to help:</div><div><br></div><div>- The region being stored to isn't a local variable.</div><div>- The address of the region escapes but not the region itself.</div><div><br></div><div>I think what you want is something more like the current DeadStoresChecker, which uses custom transfer functions to walk the CFG and detect if a store ever goes unread. It's flow-sensitive, not path sensitive, but is there anything in particular that you want it to do that it doesn't already?</div><div><br></div><div>Jordan</div><div><br></div><br><div><div>On Sep 16, 2013, at 7:31 , YuvalShahar <<a href="mailto:yuval.shahar.007@gmail.com">yuval.shahar.007@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">I am trying to solve a problem LIKE "unused variables": A symbol is assigned<br>a value and the value is never used.<br><br>For such a problem I need to track:<br> Assignments: mark LHS as "assigned a value".<br> Statements: for each symbol used in the expression, remove its "assigned a<br>value" property.<br> EndPath: report each symbol that is marked "assigned a value".<br><br>The problem is that the report appears at the end of the path and not at the<br>point of the assignment.<br><br>On attempting to solve this problem I tried:<br> Assignments: mark LHS as "assigned a value"; attach an ExplodedNode<br>marking the assignment location.<br> Statements: for each symbol used in the expression, remove its "assigned a<br>value" property.<br> EndPath: report each symbol that is marked "assigned a value", using the<br>previously attached ExplodedNode.<br><br>I would like to hear your opinions about these reporting scheme:<br>- Would this scheme work?<br>- Is it expensive in memory?<br>- Is there a preferred scheme?<br><br>Thanks.<br><br><br><br><br>--<br>View this message in context: <a href="http://clang-developers.42468.n3.nabble.com/Reporting-a-bug-found-at-EndPath-at-its-correct-location-tp4034472.html">http://clang-developers.42468.n3.nabble.com/Reporting-a-bug-found-at-EndPath-at-its-correct-location-tp4034472.html</a><br>Sent from the Clang Developers mailing list archive at <a href="http://Nabble.com">Nabble.com</a>.<br>_______________________________________________<br>cfe-dev mailing list<br><a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br>http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev<br></blockquote></div><br></body></html>