`RULE-0-0-1`: "unreachable statement" false positives due to over-pruning of the control-flow graph

从 RULE-0-0-1 的自定义 isReachable 谓词开始，跟踪 BasicBlock.getAPredecessor()、possiblePredecessor、potentiallyReturningFunction 和 reachableRecursive。使用 CodeQL CLI 2.26.2 通过自包含的 C++ 示例重现该报告，然后验证 update() 和 run() 中可达的语句不再被报告为不可达。

Affected rules

• RULE-0-0-1

Description

RULE-0-0-1 reports plainly reachable statements as unreachable. The query does not use the standard reachable predicate; it defines its own reachability walk over BasicBlock.getAPredecessor():

predicate isReachable(BasicBlock bb) {
  bb = any(Function f).getEntryPoint()
  or
  isReachable(bb.getAPredecessor())
  or
  ... // special cases for &&/||, ?:, catch blocks, constexpr if
}

BasicBlock.getAPredecessor() is derived from successors_adapted , One pruning step, possiblePredecessor, removes the control-flow graph edge after a FunctionCall unless the callee is classified as potentiallyReturningFunction. That classification is itself defined recursively in terms of the adapted control-flow graph (reachableRecursive).

When this circular analysis fails to prove that a function returns the edge after the call is dropped, the rest of the function becomes "unreachable", and the function's own exit point is then considered unreachable too. The function is consequently treated as noreturn, so callers have everything after the call flagged as well. The error cascades across the translation unit.

Environment: CodeQL CLI 2.26.2, codeql/misra-cpp-coding-standards 2.62.0 (cpp-all 5.0.0), C++17.

Example

Five false positives on this self-contained file: the if in update() and every statement in run() after the call to update().

#include <unordered_map>

namespace detail {

struct Error {
    Error() noexcept = default;
};

template <typename E>
struct unexpected {
    E error;
    explicit unexpected(E e) noexcept : error(e) {}
};

template <typename T, typename E>
struct expected {
    T value_{};
    E error_{};
    bool has_value_ = true;
    expected(T v) noexcept : value_(v), has_value_(true) {}
    expected(unexpected<E> u) noexcept : error_(u.error), has_value_(false) {}
    explicit operator bool() const noexcept { return has_value_; }
};

}  // namespace detail

using Error = detail::Error;
using Unexpected = detail::unexpected<Error>;
template <typename T> using Result = detail::expected<T, Error>;

Result<int> update(const std::unordered_map<int, int>& keys) noexcept {
    auto it = keys.find(0);
    if (it == keys.end()) {                     // flagged as unreachable
        return Result<int>{Unexpected{Error{}}};
    }
    return Result<int>{it->second};
}

void run() noexcept {
    std::unordered_map<int, int> keys;
    auto r = update(keys);                      // flagged as unreachable
    if (r) {                                    // flagged as unreachable
        (void)0;                                // flagged as unreachable
    }
    int x = 42;                                 // flagged as unreachable
    (void)x;
}