[Bug analyzer/104308] New: no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[Bug analyzer/104308] New: no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[kdudka at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

            Bug ID: 104308
           Summary: no location info provided for
                    [-Wanalyzer-use-of-uninitialized-value] warnings
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: kdudka at redhat dot com
  Target Milestone: ---

I can see new (technically valid) analyzer warnings with gcc-12 on Fedora
rawhide without any location information being provided.  This makes the output
difficult to use for csdiff utilities as well as human reviewers:

$ printf '#include <string.h>\nint main() { char s[5]; memmove(s, s + 1, 2);
}\n' | gcc -fanalyzer -fdiagnostics-path-format=separate-events -c -xc -
In function ‘main’:
cc1: warning: use of uninitialized value ‘*(short unsigned int *)&s + 1’
[CWE-457] [-Wanalyzer-use-of-uninitialized-value]
cc1: note: (1) use of uninitialized value ‘*(short unsigned int *)&s + 1’ here

The same command produces no output with gcc-11.2.1 though.

[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-01-31
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug; confirmed.

-Wanalyzer-use-of-uninitialized-value is new as of gcc 12.

Current trunk gives me:
  https://godbolt.org/z/4bfE1TW61
In function ‘main’:
cc1: warning: use of uninitialized value ‘*(short unsigned int *)&s + 1’
[CWE-457] [-Wanalyzer-use-of-uninitialized-value]
  ‘main’: event 1
    |
    |foo.c:2:19:
    |    2 | int main() { char s[5]; memmove(s, s + 1, 2); }
    |      |                   ^
    |      |                   |
    |      |                   (1) region created on stack here
    |
  ‘main’: event 2
    |
    |cc1:
    | (2): use of uninitialized value ‘*(short unsigned int *)&s + 1’ here
    |

where event (1) has a location, but (2) doesn't.

[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Sorry, link should have been:
  https://godbolt.org/z/ecWYnE73T

[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[kdudka at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

Kamil Dudka <kdudka at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |kdudka at redhat dot com

--- Comment #3 from Kamil Dudka <kdudka at redhat dot com> ---
Thank you for having a look!  I was curious where (short unsigned int *) came
from but it seems to be a result of inlined memmove().  The report goes away
when the code is compiled with -fno-builtin-memmove.

[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Yes; using -fdump-ipa-analyzer=stderr shows that the memmove becomes:

  _1 = &s + 1;
  _3 = MEM <unsigned short> [(char * {ref-all})_1];
  MEM <unsigned short> [(char * {ref-all})&s] = _3;


where the first and third stmts in the gimple-ssa IR above have this location:

foo.c:2:25: note: 
    2 | int main() { char s[5]; memmove(s, s + 1, 2); }
      |                         ^~~~~~~~~~~~~~~~~~~~

but the middle stmt ("_3 = ...") has unknown location.

[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch

--- Comment #5 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Patch: https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592331.html

[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |WAITING

[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:875342766d42988fa2f8eb7d34ef562ba69e340a

commit r12-7856-g875342766d42988fa2f8eb7d34ef562ba69e340a
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Mar 28 09:43:07 2022 -0400

    gimple-fold: fix location of loads for memory ops [PR104308]

    PR analyzer/104308 reports that when -Wanalyzer-use-of-uninitialized-value
    complains about certain memmove operations where the source is
    uninitialized, the diagnostic uses UNKNOWN_LOCATION:

    In function 'main':
    cc1: warning: use of uninitialized value '*(short unsigned int *)&s + 1'
[CWE-457] [-Wanalyzer-use-of-uninitialized-value]
      'main': event 1
        |
        |pr104308.c:5:8:
        |    5 |   char s[5]; /* { dg-message "region created on stack here" }
*/
        |      |        ^
        |      |        |
        |      |        (1) region created on stack here
        |
      'main': event 2
        |
        |cc1:
        | (2): use of uninitialized value '*(short unsigned int *)&s + 1' here
        |

    The issue is that gimple_fold_builtin_memory_op converts a memmove to:

      _3 = MEM <unsigned short> [(char * {ref-all})_1];
      MEM <unsigned short> [(char * {ref-all})&s] = _3;

    but only sets the location of the 2nd stmt, not the 1st.

    Fixed thusly, giving:

    pr104308.c: In function 'main':
    pr104308.c:6:3: warning: use of uninitialized value '*(short unsigned int
*)&s + 1' [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
        6 |   memmove(s, s + 1, 2); /* { dg-warning "use of uninitialized
value" } */
          |   ^~~~~~~~~~~~~~~~~~~~
      'main': events 1-2
        |
        |    5 |   char s[5]; /* { dg-message "region created on stack here" }
*/
        |      |        ^
        |      |        |
        |      |        (1) region created on stack here
        |    6 |   memmove(s, s + 1, 2); /* { dg-warning "use of uninitialized
value" } */
        |      |   ~~~~~~~~~~~~~~~~~~~~
        |      |   |
        |      |   (2) use of uninitialized value '*(short unsigned int *)&s +
1' here
        |

    One side-effect of this change is a change in part of the output of
    gcc.dg/uninit-40.c from:

      uninit-40.c:47:3: warning: â*(long unsigned int *)(&u[1][0][0])â is
used uninitialized [-Wuninitialized]
         47 |   __builtin_memcpy (&v[1], &u[1], sizeof (V));
            |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      uninit-40.c:45:5: note: â*(long unsigned int *)(&u[1][0][0])â was
declared here
         45 |   V u[2], v[2];
            |     ^

    to:

      uninit-40.c:47:3: warning: âuâ is used uninitialized
[-Wuninitialized]
         47 |   __builtin_memcpy (&v[1], &u[1], sizeof (V));
            |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      uninit-40.c:45:5: note: âuâ declared here
         45 |   V u[2], v[2];
            |     ^

    What's happening is that pass "early_uninit"(29)'s call to
    maybe_warn_operand is guarded by this condition:
      1051            else if (gimple_assign_load_p (stmt)
      1052                     && gimple_has_location (stmt))

    Before the patch, the stmt:
      _3 = MEM <unsigned long> [(char * {ref-all})&u + 8B];
    has no location, and so early_uninit skips this operand at line
    1052 above.  Later, pass "uninit"(217) tests the var_decl "u$8", and
    emits a warning for it.

    With the patch, the stmt has a location, and so early_uninit emits a
    warning for "u" and sets a NW_UNINIT warning suppression at that
    location.  Later, pass "uninit"(217)'s test of "u$8" is rejected
    due to that per-location suppression of uninit warnings, from the
    earlier warning.

    gcc/ChangeLog:
            PR analyzer/104308
            * gimple-fold.cc (gimple_fold_builtin_memory_op): When optimizing
            to loads then stores, set the location of the new load stmt.

    gcc/testsuite/ChangeLog:
            PR analyzer/104308
            * gcc.dg/analyzer/pr104308.c: New test.
            * gcc.dg/uninit-40.c (foo): Update expression in expected message.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above patch.

[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[kdudka at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

Kamil Dudka <kdudka at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|FIXED                       |---
             Status|RESOLVED                    |ASSIGNED

--- Comment #8 from Kamil Dudka <kdudka at redhat dot com> ---
As spotted by Vincent Mihalkovic, the fix seems to be incomplete.  If we run
gcc-12.0.1-0.14.fc37.x86_64 on the following test-case, some diagnostic
messages are still printed without any location info:


$ cat test-memcpy.c
#include <string.h>

int main(void)
{
    char a1[5];
    char a2[5];
    return (memcpy(a1, a2, 5) == a1);
}


$ gcc -fanalyzer -fdiagnostics-path-format=separate-events -c test-memcpy.c
In function ‘main’:
cc1: warning: use of uninitialized value ‘*(unsigned char (*)[5])(&a2[0])’
[CWE-457] [-Wanalyzer-use-of-uninitialized-value]
test-memcpy.c:6:10: note: (1) region created on stack here
    6 |     char a2[5];
      |          ^~
cc1: note: (2) use of uninitialized value ‘*(unsigned char (*)[5])(&a2[0])’
here

[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

--- Comment #9 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
(In reply to Kamil Dudka from comment #8)
> As spotted by Vincent Mihalkovic, the fix seems to be incomplete.  If we run
> gcc-12.0.1-0.14.fc37.x86_64 on the following test-case, some diagnostic
> messages are still printed without any location info:

Thanks; I'm testing a fix.

[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |WAITING
                URL|                            |https://gcc.gnu.org/piperma
                   |                            |il/gcc-patches/2022-April/5
                   |                            |93245.html

--- Comment #10 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Followup patch posted; waiting on review:
  https://gcc.gnu.org/pipermail/gcc-patches/2022-April/593245.html

[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:a5dc2641add6b4f54086d40ae706fda3cdaac7f5

commit r12-8253-ga5dc2641add6b4f54086d40ae706fda3cdaac7f5
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Apr 25 19:34:33 2022 -0400

    gimple-fold: fix further missing stmt locations [PR104308]

    PR analyzer/104308 initially reported about a
    -Wanalyzer-use-of-uninitialized-value diagnostic using UNKNOWN_LOCATION
    when complaining about certain memmove operations where the source
    is uninitialized.

    In r12-7856-g875342766d4298 I fixed the missing location for
    a stmt generated by gimple_fold_builtin_memory_op, but the reporter
    then found another way to generate such a stmt with UNKNOWN_LOCATION.

    I've now gone through gimple_fold_builtin_memory_op looking at all
    statement creation, and found three places in which a new statement
    doesn't have a location set on it (either directly via
    gimple_set_location, or indirectly via gsi_replace), one of which is
    the new reproducer.

    This patch adds a gimple_set_location to these three cases, and adds
    test coverage for one of them (the third hunk within the patch), fixing
    the new reproducer for PR analyzer/104308.

    gcc/ChangeLog:
            PR analyzer/104308
            * gimple-fold.cc (gimple_fold_builtin_memory_op): Explicitly set
            the location of new_stmt in all places that don't already set it,
            whether explicitly, or via a call to gsi_replace.

    gcc/testsuite/ChangeLog:
            PR analyzer/104308
            * gcc.dg/analyzer/pr104308.c: Add test coverage.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/104308] no location info provided for [-Wanalyzer-use-of-uninitialized-value] warnings

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|WAITING                     |RESOLVED

--- Comment #12 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above commit.