From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 7F58F3850861; Mon, 13 Jun 2022 22:11:14 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 7F58F3850861 From: "dmalcolm at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug analyzer/105962] New: Unhelpful diagnostics paths from analyzer in the face of inlining Date: Mon, 13 Jun 2022 22:11:14 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: analyzer X-Bugzilla-Version: 12.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: dmalcolm at gcc dot gnu.org X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: dmalcolm at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter target_milestone Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: gcc-bugs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-bugs mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jun 2022 22:11:14 -0000 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D105962 Bug ID: 105962 Summary: Unhelpful diagnostics paths from analyzer in the face of inlining Product: gcc Version: 12.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: analyzer Assignee: dmalcolm at gcc dot gnu.org Reporter: dmalcolm at gcc dot gnu.org Target Milestone: --- Consider this double-free: void foo (void *p) { __builtin_free (p); } void bar (void *q) { foo (q); foo (q); } Below -O2, -fanalyzer shows the calls and returns: ../../src/gcc/testsuite/gcc.dg/analyzer/inline-1.c: In function =E2=80=98fo= o=E2=80=99: ../../src/gcc/testsuite/gcc.dg/analyzer/inline-1.c:3:3: warning: double-=E2= =80=98free=E2=80=99 of =E2=80=98p=E2=80=99 [CWE-415] [-Wanalyzer-double-free] 3 | __builtin_free (p); | ^~~~~~~~~~~~~~~~~~ =E2=80=98bar=E2=80=99: events 1-2 | | 6 | void bar (void *q) | | ^~~ | | | | | (1) entry to =E2=80=98bar=E2=80=99 | 7 | { | 8 | foo (q); | | ~~~~~~~ | | | | | (2) calling =E2=80=98foo=E2=80=99 from =E2=80=98bar=E2=80=99 | +--> =E2=80=98foo=E2=80=99: events 3-4 | | 1 | void foo (void *p) | | ^~~ | | | | | (3) entry to =E2=80=98foo=E2=80=99 | 2 | { | 3 | __builtin_free (p); | | ~~~~~~~~~~~~~~~~~~ | | | | | (4) first =E2=80=98free=E2=80=99 here | <------+ | =E2=80=98bar=E2=80=99: events 5-6 | | 8 | foo (q); | | ^~~~~~~ | | | | | (5) returning to =E2=80=98bar=E2=80=99 from =E2=80=98foo=E2= =80=99 | 9 | foo (q); | | ~~~~~~~ | | | | | (6) passing freed pointer =E2=80=98q=E2=80=99 in call to =E2= =80=98foo=E2=80=99 from =E2=80=98bar=E2=80=99 | +--> =E2=80=98foo=E2=80=99: events 7-8 | | 1 | void foo (void *p) | | ^~~ | | | | | (7) entry to =E2=80=98foo=E2=80=99 | 2 | { | 3 | __builtin_free (p); | | ~~~~~~~~~~~~~~~~~~ | | | | | (8) second =E2=80=98free=E2=80=99 here; first =E2=80= =98free=E2=80=99 was at (4) | but at -O2 and above, we show the unhelpful: In function =E2=80=98foo=E2=80=99, inlined from =E2=80=98bar=E2=80=99 at ../../src/gcc/testsuite/gcc.dg/analyzer/inline-1.c:9:3: ../../src/gcc/testsuite/gcc.dg/analyzer/inline-1.c:3:3: warning: double-=E2= =80=98free=E2=80=99 of =E2=80=98q=E2=80=99 [CWE-415] [-Wanalyzer-double-free] 3 | __builtin_free (p); | ^~~~~~~~~~~~~~~~~~ =E2=80=98bar=E2=80=99: events 1-2 | | 3 | __builtin_free (p); | | ^~~~~~~~~~~~~~~~~~ | | | | | (1) first =E2=80=98free=E2=80=99 here | | (2) second =E2=80=98free=E2=80=99 here; first =E2=80=98free= =E2=80=99 was at (1) which is somewhat mystifying. This is happening because -fanalyzer is running after inlining and sees thi= s at the gimple level: void bar (void * q) { [local count: 1073741824]: __builtin_free (q_2(D)); __builtin_free (q_2(D)); return; } We can probably improve the readability by fixing up the events in the diagnostic path based on the LOCATION_BLOCK inlining information captured in the stmt location values. I tried a version of this years ago in: =20 https://dmalcolm.fedorapeople.org/gcc/2020-02-20/gcc-newgit-analyzer-gcc10-= analysis-gcc10-v52-relative-to-bc0f8df124f6ee12c82c5a6c1335868a15bcaecb/001= 2-FIXME-WIP-on-inlining-and-paths.patch=