[Bug analyzer/106203] New: Allow to emit diagnostics at return edges for the exit point as well as the call site

[Bug analyzer/106203] New: Allow to emit diagnostics at return edges for the exit point as well as the call site

[tlange at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106203

            Bug ID: 106203
           Summary: Allow to emit diagnostics at return edges for the exit
                    point as well as the call site
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: tlange at gcc dot gnu.org
  Target Milestone: ---

Currently, the region_model_context at return edges, created inside
program_state::on_edge, neither holds a stmt nor a stmt_finder and thus,
warnings at return edges are rejected by impl_region_model_context::warn.

PR105900 has 2 XFAILs inside allocation-size-(1|2).c because the call to
set_value (lhs, <returned_value>) happens at a return edge. Similarly, PR105888
also needs to emit a warning at a return edge, but for the callee's exit point.

David already expressed ideas on how to solve this:
- have two contexts for pop_frame: one in the old frame, the other in
the new frame (for the caller)
- generalize stmt_finder, so it can also update the supernode to use
- rework pop_frame (I've had to do this before, I've run into issues
like this before).

[Bug analyzer/106203] Allow to emit diagnostics at return edges for the exit point as well as the call site

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106203

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
I've been prototyping an implementation of PR 106147 (infinite loop detection),
and in some cases there aren't any statements at all for my warnings, just
location_t values (if that).  So as part of that I've been looking at a big
revamp of how source locations are tracked in the analyzer; I may be able to
fix this as part of that.