`RULE-0-0-1`: "unreachable statement" false positives due to over-pruning of the control-flow graph

從 RULE-0-0-1 的自訂 isReachable predicate 開始，追蹤 BasicBlock.getAPredecessor()、possiblePredecessor、potentiallyReturningFunction 和 reachableRecursive。使用 CodeQL CLI 2.26.2，透過自包含的 C++ 範例重現該報告，然後確認 update() 和 run() 中可達的陳述式不再被報告為不可達。

Affected rules

• RULE-0-0-1

Description

RULE-0-0-1 reports plainly reachable statements as unreachable. The query does not use the standard reachable predicate; it defines its own reachability walk over BasicBlock.getAPredecessor():

predicate isReachable(BasicBlock bb) {
  bb = any(Function f).getEntryPoint()
  or
  isReachable(bb.getAPredecessor())
  or
  ... // special cases for &&/||, ?:, catch blocks, constexpr if
}

BasicBlock.getAPredecessor() is derived from successors_adapted , One pruning step, possiblePredecessor, removes the control-flow graph edge after a FunctionCall unless the callee is classified as potentiallyReturningFunction. That classification is itself defined recursively in terms of the adapted control-flow graph (reachableRecursive).

When this circular analysis fails to prove that a function returns the edge after the call is dropped, the rest of the function becomes "unreachable", and the function's own exit point is then considered unreachable too. The function is consequently treated as noreturn, so callers have everything after the call flagged as well. The error cascades across the translation unit.

Environment: CodeQL CLI 2.26.2, codeql/misra-cpp-coding-standards 2.62.0 (cpp-all 5.0.0), C++17.

Example

Five false positives on this self-contained file: the if in update() and every statement in run() after the call to update().

#include <unordered_map>

namespace detail {

struct Error {
    Error() noexcept = default;
};

template <typename E>
struct unexpected {
    E error;
    explicit unexpected(E e) noexcept : error(e) {}
};

template <typename T, typename E>
struct expected {
    T value_{};
    E error_{};
    bool has_value_ = true;
    expected(T v) noexcept : value_(v), has_value_(true) {}
    expected(unexpected<E> u) noexcept : error_(u.error), has_value_(false) {}
    explicit operator bool() const noexcept { return has_value_; }
};

}  // namespace detail

using Error = detail::Error;
using Unexpected = detail::unexpected<Error>;
template <typename T> using Result = detail::expected<T, Error>;

Result<int> update(const std::unordered_map<int, int>& keys) noexcept {
    auto it = keys.find(0);
    if (it == keys.end()) {                     // flagged as unreachable
        return Result<int>{Unexpected{Error{}}};
    }
    return Result<int>{it->second};
}

void run() noexcept {
    std::unordered_map<int, int> keys;
    auto r = update(keys);                      // flagged as unreachable
    if (r) {                                    // flagged as unreachable
        (void)0;                                // flagged as unreachable
    }
    int x = 42;                                 // flagged as unreachable
    (void)x;
}