[all-commits] [llvm/llvm-project] 0c540b: [analyzer] Fix unjustified early return in process...

[Donát Nagy via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 0c540b9dcd041a2574f744144bb894b5862344b1
      https://github.com/llvm/llvm-project/commit/0c540b9dcd041a2574f744144bb894b5862344b1
  Author: Donát Nagy <donat.nagy at ericsson.com>
  Date:   2026-06-25 (Thu, 25 Jun 2026)

  Changed paths:
    M clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

  Log Message:
  -----------
  [analyzer] Fix unjustified early return in processCallExit (#205656)

In `ExprEngine::processCallExit` step 3 may theoretically split the
state because it calls `removeDead`, which activates `LiveSymbols` and
`DeadSymbols` callbacks of various checkers. (However, in practice it is
likely that these checker callbacks never actually split the state -- at
least, no such state splits happen in the LIT tests.)

The nodes produced by `removeDead` are placed in the set `CleanedNodes`;
in theory the different execution paths should be handled in parallel,
independently of each other. However, the loop `for (ExplodedNode *N :
CleanedNodes)` contained an early return statement, which meant that if
the creation of `CEENode` failed for a node `N`, then the subsequent
iterations were skipped altogether.

This commit replaces the `return` with a `continue` to ensure that the
nodes in `CleanedNodes` are handled independently (if there are several
such nodes).

This logic error is present in the codebase since 2012 (!) when commit
7e53bd6fb01b062ece426252fb94c76bcce58941 introduced the `removeDead`
step into `processCallExit`.

Given that nobody noticed this error within the last 14 years, I very
strongly suspect that it doesn't have any observable functional effects,
i.e. this change is essentially NFC.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications