Re: Git's static analysis

From: Junio C Hamano <gitster@pobox.com>
Date: Feb 6, 2009, 01:19 UTC
Message-ID: <7v63jo9xbg.fsf@gitster.siamese.dyndns.org>
In-Reply-To: <1233870004-63540-1-git-send-email-pdebie@ai.rug.nl>

Pieter de Bie <pdebie@ai.rug.nl> writes:

Show 8 quoted lines

> I played around a bit with the 'Clang' static analyser, and tried to run git's
> source code through it. It comes up with a few possible errors, so I thought
> you might find it interesting. I took a quick glance, and it also seems to
> have a few false positives, but it might still be worth to take a look.
>
> The results can be found here:
>
> 	http://frim.frim.nl/git-analyse/

Hmm, I took a quick look at a few, and they looked nonsense, but perhaps I am misreading things.

For example:

    http://frim.frim.nl/git-analyse/report-uxXiUR.html#EndPath

I am assuming that we follow the control flow of the labelled comments, so I followed along from [1] to [7] and then saw these:

    [8] loop condition is false, execution continues on line 1492
    1483:   for (i = 0; i < array->nr; i++) {
                ...
            }

    [9] taking false branch
    1492:   if (array->nr <= i)
                return NULL;

    [10] dereference of null pointer.
    1495:   c->object.flags |= ...

The thing is, if [8] exits, "i < array->nr" is not true anymore, and there is no way you can take false branch of "if (array->nr <= i)" in the immediately next step [9]. and reach point [10].

So it is either that the tool does not know how "for" and "if" statement works in C language, or I am completely misunderstanding what the in-line comments are trying to tell me.