clang-analyzer doesn't check unreachable paths?

Hi everyone. "clang --analyze" for the snippet below only reports null pointer dereference:

int main() {
š š *(int*) 0;
š š 1 / 0;
}

Here it only reports division by zero:

int main() {
š š 1 / 0;
š š *(int*) 0;
}

And here it reports both:

int main(int argc, char* argv) {
š š argc > 2 ? *(int*) 0 : 1 / 0;
}

Does it mean that paths unreachable due to fatal errors are not checked? If yes, is there a way to ask for full coverage? Thank you. - Alex

Hi everyone. "clang --analyze" for the snippet below only reports null pointer dereference:

int main() {
    *(int*) 0;
    1 / 0;
}

Here it only reports division by zero:

int main() {
    1 / 0;
    *(int*) 0;
}

And here it reports both:

int main(int argc, char* argv) {
    argc > 2 ? *(int*) 0 : 1 / 0;
}

Does it mean that paths unreachable due to fatal errors are not checked?

This depends on the type of problem reported. For example, the analysis continues along the path on which a non-fatal failure (such as leak) has been reported. However, in most cases, we stop analyzing the path after a fatal failure.

If yes, is there a way to ask for full coverage?

No.