Does Clan Static Analyzer recognize
__builtin_unreachable() or some similar thin that indicates undesired failure? So that I (library author) could assist the analyzer in reporting bad usages of a library:
__builtin_trap(); // if analyzer reaches this path, it should report a warnin
We do not currently warn on those, apart from debug.ExprInspection checker that warns whenever void clang_analyzer_warnIfReached() is called (we use this for regression tests).
It should be easy to write the checker you want. It'd probably subscribe on checkPreCall, see if the builtin is being called, and if there are arguments it may check if symbolic values for these arguments can be assumed to be true or false on this path, and then throw a report. You may look at BuiltinFunctionsChecker and NoReturnFunctionsChecker for examples.