Sonar 9.9 can not find "'break' will never be executed" bug for cpp code in merge request

Must-share information (formatted with Markdown):

  • which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension)
    sonarqube enterprise lts 9.9

  • how is SonarQube deployed: zip, Docker, Helm
    docker

  • what are you trying to achieve
    “‘break’ will never be executed” bug can not be found for merge request analysis.
    But it could be found by a branch analysis. I think it is a bug for 9.9.

  • what have you tried so far to achieve this
    I have reproduced this issue by sample code.
    For example:

#include <iostream>
using namespace std;
void foo(int type)
{
	switch(type)
	{
		case 1:
			
			cout << "type = 1" << endl;
			break;
		case 2:
			cout << "type = 2" << endl;
		 return; //this line will report "'break' will never be executed" bug in branch analysis
			break;
		default:
			cout << "type = " << type << endl;
			break;
	}	
	return;
}

int main()
{       
       int input = 0;
       cout << "input a num:" << endl;
       cin >> input;
       foo(input);      
       return 0;
}

=======================================
if I add some lines in dev1 branch, and create a merge request for code changes.
We expected same code pattern should report the same issue: “‘break’ will never be executed” .
But it seems Merge request analysis have NOT report it (FN). Is it a known issue?

void foo(int type)
{
	switch(type)
	{
		case 1:
			
			cout << "type = 1" << endl;
                        return;    // expected report bug but not by merge request analysis
			break;
		case 2:
			cout << "type = 2" << endl;
			return;
			break;
		default:
			cout << "type = " << type << endl;
			return;  // expected report bug but not by merge request analysis
			break;
	}
	
	return;
}

Do not share screenshots of logs – share the text itself (bonus points for being well-formatted)!

Hi,

For merge request analysis, issues are only reported on new (added or edited in the MR) code.

I’m guessing that this

isn’t “new” in the MR…?

 
Ann

As snapshot, the MR add two lines that should report the issue but not.

Hi,

So return is what’s new in the MR. Are you sure the issue about break being dead code would be raised on return and not on (the non-new) break?

 
Ann

Sure, “break will never be executed” will report on “break” line. But obviously, the MR will introduce a new issue to target branch and MR analysis can not block this happened.
So I can not persuade the customer that MR analysis is all right but something will go wrong after merged MR. Do you think so? Thanks.

image

Hi,

I understand your dilemma, and we’re aware that this is a problem. However, it’s not currently at the top of our list because it’s both tricky and relatively rare.

 
Ann