[Bug analyzer/106204] New: False positive from -Wanalyzer-use-of-uninitialized-value with -ftrivial-auto-var-init=zero

["dmalcolm at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106204

            Bug ID: 106204
           Summary: False positive from
                    -Wanalyzer-use-of-uninitialized-value with
                    -ftrivial-auto-var-init=zero
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
  Target Milestone: ---

I'm seeing a lot of false positives from -Wanalyzer-use-of-uninitialized-value
when building the upstream Linux kernel.

Seems to be a bad interaction with -ftrivial-auto-var-init=zero; minimal
reproducer:

$ cat ../../src/hooks.c
int foo(unsigned *len);
int test()
{
 unsigned len;
 int rc;

 rc = foo(&len);
 if (!rc)
  rc = len;
 return rc;
}

$ ./xgcc -B. ../../src/hooks.c -ftrivial-auto-var-init=zero -fanalyzer -S 
../../src/hooks.c: In function ‘test’:
../../src/hooks.c:4:11: warning: use of uninitialized value ‘<unknown>’
[CWE-457] [-Wanalyzer-use-of-uninitialized-value]
    4 |  unsigned len;
      |           ^~~
  ‘test’: event 1
    |
    |    4 |  unsigned len;
    |      |           ^~~
    |      |           |
    |      |           (1) use of uninitialized value ‘<unknown>’ here
    |

where the uninit is being reported on the assignment to "len = _1;" here:

  _1 = .DEFERRED_INIT (4, 2, &"len"[0]);
  len = _1;