[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

["cvs-commit at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:875342766d42988fa2f8eb7d34ef562ba69e340a

commit r12-7856-g875342766d42988fa2f8eb7d34ef562ba69e340a
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Mar 28 09:43:07 2022 -0400

    gimple-fold: fix location of loads for memory ops [PR104308]

    PR analyzer/104308 reports that when -Wanalyzer-use-of-uninitialized-value
    complains about certain memmove operations where the source is
    uninitialized, the diagnostic uses UNKNOWN_LOCATION:

    In function 'main':
    cc1: warning: use of uninitialized value '*(short unsigned int *)&s + 1'
[CWE-457] [-Wanalyzer-use-of-uninitialized-value]
      'main': event 1
        |
        |pr104308.c:5:8:
        |    5 |   char s[5]; /* { dg-message "region created on stack here" }
*/
        |      |        ^
        |      |        |
        |      |        (1) region created on stack here
        |
      'main': event 2
        |
        |cc1:
        | (2): use of uninitialized value '*(short unsigned int *)&s + 1' here
        |

    The issue is that gimple_fold_builtin_memory_op converts a memmove to:

      _3 = MEM <unsigned short> [(char * {ref-all})_1];
      MEM <unsigned short> [(char * {ref-all})&s] = _3;

    but only sets the location of the 2nd stmt, not the 1st.

    Fixed thusly, giving:

    pr104308.c: In function 'main':
    pr104308.c:6:3: warning: use of uninitialized value '*(short unsigned int
*)&s + 1' [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
        6 |   memmove(s, s + 1, 2); /* { dg-warning "use of uninitialized
value" } */
          |   ^~~~~~~~~~~~~~~~~~~~
      'main': events 1-2
        |
        |    5 |   char s[5]; /* { dg-message "region created on stack here" }
*/
        |      |        ^
        |      |        |
        |      |        (1) region created on stack here
        |    6 |   memmove(s, s + 1, 2); /* { dg-warning "use of uninitialized
value" } */
        |      |   ~~~~~~~~~~~~~~~~~~~~
        |      |   |
        |      |   (2) use of uninitialized value '*(short unsigned int *)&s +
1' here
        |

    One side-effect of this change is a change in part of the output of
    gcc.dg/uninit-40.c from:

      uninit-40.c:47:3: warning: â*(long unsigned int *)(&u[1][0][0])â is
used uninitialized [-Wuninitialized]
         47 |   __builtin_memcpy (&v[1], &u[1], sizeof (V));
            |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      uninit-40.c:45:5: note: â*(long unsigned int *)(&u[1][0][0])â was
declared here
         45 |   V u[2], v[2];
            |     ^

    to:

      uninit-40.c:47:3: warning: âuâ is used uninitialized
[-Wuninitialized]
         47 |   __builtin_memcpy (&v[1], &u[1], sizeof (V));
            |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      uninit-40.c:45:5: note: âuâ declared here
         45 |   V u[2], v[2];
            |     ^

    What's happening is that pass "early_uninit"(29)'s call to
    maybe_warn_operand is guarded by this condition:
      1051            else if (gimple_assign_load_p (stmt)
      1052                     && gimple_has_location (stmt))

    Before the patch, the stmt:
      _3 = MEM <unsigned long> [(char * {ref-all})&u + 8B];
    has no location, and so early_uninit skips this operand at line
    1052 above.  Later, pass "uninit"(217) tests the var_decl "u$8", and
    emits a warning for it.

    With the patch, the stmt has a location, and so early_uninit emits a
    warning for "u" and sets a NW_UNINIT warning suppression at that
    location.  Later, pass "uninit"(217)'s test of "u$8" is rejected
    due to that per-location suppression of uninit warnings, from the
    earlier warning.

    gcc/ChangeLog:
            PR analyzer/104308
            * gimple-fold.cc (gimple_fold_builtin_memory_op): When optimizing
            to loads then stores, set the location of the new load stmt.

    gcc/testsuite/ChangeLog:
            PR analyzer/104308
            * gcc.dg/analyzer/pr104308.c: New test.
            * gcc.dg/uninit-40.c (foo): Update expression in expected message.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>