Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Go: go/comparison-of-identical-expressions false positive when a variable is reassigned in a range loop (go-all 8.0.0)

已关闭
  • 哪里不对？
#22,770 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
54/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
go
领域
testing-qa

调研方向

Start by reproducing the false positive with the Go samples in the issue and the two versions of CompareIdenticalValues.ql; compare results with go-all 7.3.2 and 8.0.0. Investigate how the range-loop CFG handles assignments that flow past the loop, and check whether related data-flow queries are affected. Done when the range-loop comparison is no longer reported while the issue’s other cases behave as expected.

由索引模型根据 Issue 内容生成。

描述

Description of the false positive

Since codeql/go-queries 1.6.12 (with codeql/go-all 8.0.0), go/comparison-of-identical-expressions reports a comparison between a variable and the value it was initialised from, even though the variable may be reassigned inside a range loop between the two. With codeql/go-queries 1.6.11 (codeql/go-all 7.3.2), the same database gives no result.

The trigger is the range loop. The same assignment in a plain if or in a three-clause for loop is not reported. It looks related to the CFG rewrite in go-all 8.0.0, whose changelog mentions range statements. If assignments in a range body don't reach the code after the loop, other data-flow queries might be affected as well. I have only checked this query.

Code samples or links to source code

package repro

// Reported (line "if n == c"): n may be raised inside the range loop.
func Settle(c int, xs []int) int {
	for {
		n := c
		for _, x := range xs {
			if x > n {
				n = x
			}
		}
		if n == c { // <- "This expression compares an expression to itself."
			break
		}
		c = n
	}
	return c
}

// Also reported: unconditional assignment in a range loop.
func VariantD(c int, xs []int) int {
	n := c
	for _, x := range xs {
		n = x
	}
	if n == c { // <- reported
		return 0
	}
	return n
}

// Not reported: the same assignment in a three-clause loop.
func VariantB(c int, xs []int) int {
	n := c
	for i := 0; i < len(xs); i++ {
		if xs[i] > n {
			n = xs[i]
		}
	}
	if n == c {
		return 0
	}
	return n
}

To reproduce (CodeQL CLI 2.27.1, macOS arm64, Go 1.25.13). --no-tracing is used only because this machine has no Rosetta for the tracer.

codeql database create db --language=go --source-root src --build-mode=autobuild --no-tracing
codeql database analyze db codeql/[email protected]:RedundantCode/CompareIdenticalValues.ql --format=sarif-latest --output=a.sarif --rerun
codeql database analyze db codeql/[email protected]:RedundantCode/CompareIdenticalValues.ql --format=sarif-latest --output=b.sarif --rerun
  • a.sarif, go-queries 1.6.11 / go-all 7.3.2: 0 results.
  • b.sarif, go-queries 1.6.12 / go-all 8.0.0: 3 results: Settle, VariantD, and a third range-loop variant without the outer loop.

Without --rerun, the second command silently reuses the first command's cached results: its SARIF reports go-queries 1.6.11 and 0 results. This may be worth a look separately.

The same comparison is reported in real code here: https://github.com/gomaja/go-asn1/blob/2e83d89af0dc815fc1e0a589691032aa069153bc/runtime/ber/named_bit_size.go#L43. In that code, next starts as candidate and can be raised inside the range loop over the permitted intervals.

主要语言
CodeQL
星标
10.2k
派生
2.1k
平均合并
2 天 11 小时
30 天内合并 PR
155

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

github/codeql 的其他 Issue

查看 github/codeql 的全部 Issue

相似的 Issue

更多 Testing & QA Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。