[clang] 0c540b9 - [analyzer] Fix unjustified early return in processCallExit (#205656)

[via cfe-commits]

Author: Donát Nagy
Date: 2026-06-25T15:06:27+02:00
New Revision: 0c540b9dcd041a2574f744144bb894b5862344b1

URL: https://github.com/llvm/llvm-project/commit/0c540b9dcd041a2574f744144bb894b5862344b1
DIFF: https://github.com/llvm/llvm-project/commit/0c540b9dcd041a2574f744144bb894b5862344b1.diff

LOG: [analyzer] Fix unjustified early return in processCallExit (#205656)

In `ExprEngine::processCallExit` step 3 may theoretically split the
state because it calls `removeDead`, which activates `LiveSymbols` and
`DeadSymbols` callbacks of various checkers. (However, in practice it is
likely that these checker callbacks never actually split the state -- at
least, no such state splits happen in the LIT tests.)

The nodes produced by `removeDead` are placed in the set `CleanedNodes`;
in theory the different execution paths should be handled in parallel,
independently of each other. However, the loop `for (ExplodedNode *N :
CleanedNodes)` contained an early return statement, which meant that if
the creation of `CEENode` failed for a node `N`, then the subsequent
iterations were skipped altogether.

This commit replaces the `return` with a `continue` to ensure that the
nodes in `CleanedNodes` are handled independently (if there are several
such nodes).

This logic error is present in the codebase since 2012 (!) when commit
7e53bd6fb01b062ece426252fb94c76bcce58941 introduced the `removeDead`
step into `processCallExit`.

Given that nobody noticed this error within the last 14 years, I very
strongly suspect that it doesn't have any observable functional effects,
i.e. this change is essentially NFC.

Added: 
    

Modified: 
    clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

Removed: 
    


################################################################################
diff  --git a/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
index 4cbcaa2721639..97c655c103b0a 100644
--- a/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
+++ b/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
@@ -384,7 +384,7 @@ void ExprEngine::processCallExit(ExplodedNode *CEBNode) {
 
     ExplodedNode *CEENode = Engine.makeNode(Loc, CEEState, N);
     if (!CEENode)
-      return;
+      continue;
 
     // Step 5: Perform the post-condition check of the CallExpr and enqueue the
     // result onto the work list.