False positive knownConditionTrueFalse - comparing same address with different casts

[amai]

In the following example the reported [a.cpp:2]: (style) Condition '(void*)(TestObject*)4096==(void*)(!TestObjectBaseB*)(TestObject*)4096' is always true is IMHO a false positive.

void foo() {
  if ((void*)(Object*)0x1000 == (void*)(ObjectBaseB*)(Object*)0x1000) // FP
     ;
}
void bar(char* ptr) {
  if ((void*)(Object*)ptr == (void*)(ObjectBaseB*)(Object*)ptr) // given the current behaviour a "false FN"?!
     ;
}

It seems the 2nd cast is removed internally. OTOH I wonder why there is no warning issued for bar() then?

Debug output:

##file tickets/7366.cpp
1: void foo ( ) {
2: if ( ( Object * ) 4096 == ( Object * ) 4096 ) {
3: ; }
4: }
5: void bar ( char * ptr@1 ) {
6: if ( ptr@1 == ptr@1 ) {
7: ; }
8: }

[Daniel Marjamäki]

Where does this code come from?

That is normally undefined behaviour.

It is undefined behaviour to create a out-of-bounds pointer. Unless you know that there is an object at address 0x1000 it is UB to point at address 0x1000.

In normal unix/windows platforms you don't know where objects are so I have thought about adding a platform setting that would enable UB warnings when constant pointer values other than 0 are used.

[amai]

Source is from ​VirtualBox.
I assume at an embedd platform one might face situations like this.

[Daniel Marjamäki]

I assume at an embedd platform one might situations like this.

yes.

[Daniel Marjamäki]

I don't see why it's a FP right now. Same address in lhs and rhs is compared, isn't it?

[amai]

Replying to danielmarjamaki:

I don't see why it's a FP right now. Same address in lhs and rhs is compared, isn't it?

I think there's a catch in it...
Have a look at this example:

#include <iostream>
using namespace std;
class ObjectBaseA {
        public:
        virtual ~ObjectBaseA(){}
        int abasemember;
};
class ObjectBaseB {
        public:
        virtual ~ObjectBaseB(){}
        int bbasemember;
};
class Object : public ObjectBaseA, public ObjectBaseB {
   public:
   virtual ~Object(){}
   int derivedmember;
};

int main() {
        void* ptr=(void*)0x42;
        std::cout << (void*)ptr << std::endl;
        std::cout << (void*)(ObjectBaseB*)ptr << std::endl;
        std::cout << (void*)(Object*)ptr << std::endl;
        std::cout << (void*)(ObjectBaseB*)(Object*)ptr << std::endl;
        return 0;
}

[amai]

And some sample output from cygwin 32bit:

$ ./7366.exe
0x42
0x42
0x42
0x4a