Visiting all branches in an if-else statements

Is it possible to visit all branches in an if-else or, switch statement even if one of the branches is definitely true? For example, consider the below code-snippet:

int x = 0;
if(x) { x  = 2; }
else { x = 4; }

CSA will execute the else part only but, I want it to explore the if part as well. I tried a number of things but, none of them worked. I intended to get the condition SVal and make it an unknown SVal (Not sure if it’s possible but, anyway it’s the 2nd step of the process) and then make a transition so that CSA considers all possible branches but, I am not able to get the node just before branching using check::PreStmt. It doesn’t trigger before If stmts. Then, I tried check::BranchCondition but, I think it gets triggered after the branch has already been taken. Is there any way to it? Any help will be much appreciated.
PS: Sorry, if my ideas are too dumb. I am just starting with CSA.
Thanks.

You can’t achieve that with path-sensitive analysis at the moment. It’s technically possible to implement restarting the analysis from any given point but it’s quite counterproductive as users typically aren’t happy to see bug reports against dead code. You definitely don’t want to continue the original analysis into paths that are provably impossible.

Another thing to think about is, are you sure you want path-sensitive analysis for your purposes? It’s a quite specific form of analysis, it’s only suitable for very specific problems.

1 Like

Thanks for the reply.
Actually, I need to detect bindings and also need to know the underlying memory region, and it can be achieved with CSA. The code example is not very good. Consider for example this code snippet -

for(int i = 0; i < 100; ++i) {
 if(i == 10) { x = 100; }
}

I need to detect the binding inside that if statement but since CSA stops after a few iterations that if statement is not executed. So, I thought to execute both branches then it will get executed even when i = 0.