C is Brittle D is Plastic

[Richard (Rikki) Andrew Cattermole]

On 08/04/2026 8:24 AM, Walter Bright wrote:
> ```
> if (foo())
>      T* p = (T*)malloc(...);
> ...dum dee dum dee dum...
> if (foo())
> {
>      *p = 3;
>      free(p);
> }
> ```
> If the static analyzer cannot determine what foo() returns, it cannot 
> determine if the code is bad or not. It's the halting problem.
> 
> I've seen the equivalent of this in the wild. It's bad style, but it 
> exists.

1. Dedicated static analyzers work with whole program analysis, via IR's.

2. This is solved, without the use of meet operations. Basically the 
entire state context gets duplicated on if statement completion, one for 
each branch, and everything after gets evaluated with both contexts. 
This appears to be why GCC will only error on one branch with the static 
analyzer errors. This has a research paper on it, and I was able to come 
up with it on my own too. I haven't done it in the fast DFA engine 
because its not exactly fast.