[clang] [analyzer] Suppress out of bounds reports after weak loop assumptions (PR #109804)

[via cfe-commits]

=?utf-8?q?Donát?= Nagy <donat.nagy at ericsson.com>
Message-ID:
In-Reply-To: <llvm.org/llvm/llvm-project/pull/109804 at github.com>


================
@@ -2808,27 +2825,63 @@ void ExprEngine::processBranch(const Stmt *Condition,
       std::tie(StTrue, StFalse) = *KnownCondValueAssumption;
     else {
       assert(!isa<ObjCForCollectionStmt>(Condition));
+      // TODO: instead of this shortcut perhaps it would be better to "rejoin"
+      // the common execution path with
+      // StTrue = StFalse = PrevState;
       builder.generateNode(PrevState, true, PredN);
       builder.generateNode(PrevState, false, PredN);
       continue;
----------------
isuckatcs wrote:

I guess the shortcut here is that we know that this branch has no way to introduce infeasible branches, as both the `true` and the `false` state exists. With continuing early, we can avoid a few redundant branches.

Below you can find a possible refactor for this part of the function if you want to push it further:
```c++
ProgramStateRef StTrue, StFalse;
StTrue = StFalse = PrevState;

if (const auto KnownCondValueAssumption = assumeCondition(Condition, PredN)) {
  std::tie(StTrue, StFalse) = *KnownCondValueAssumption;

  if (!StTrue)
    builder.markInfeasible(true);

  if (!StFalse)
    builder.markInfeasible(false);
}

if (StTrue && StFalse)
  assert(!isa<ObjCForCollectionStmt>(Condition));

builder.generateNode(StTrue, true, PredN);
builder.generateNode(StFalse, false, PredN);
```
I haven't tested it, but this should be equivalent to the the current logic.

https://github.com/llvm/llvm-project/pull/109804