[Bug analyzer/106413] New: State explosion on va_arg when va_start is in top-level function of analysis

[Bug analyzer/106413] New: State explosion on va_arg when va_start is in top-level function of analysis

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106413

            Bug ID: 106413
           Summary: State explosion on va_arg when va_start is in
                    top-level function of analysis
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
  Target Milestone: ---

I accidentally introduced:
  FAIL: gcc.dg/analyzer/stdarg-3.c (test for excess errors)
in r13-1786-gb852aa7f265424; the issue is a -Wanalyzer-too-complex warning.

Looks like there's a state explosion in -fanalyzer whenever there's a loop that
calls __builtin_va_arg for the case where the va_start is in the top-level
function of the analysis (i.e. that we *don't* have a specific list of variadic
arguments).

[Bug analyzer/106413] State explosion on va_arg when va_start is in top-level function of analysis

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106413

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2022-07-22

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
I'm testing a fix for this.

[Bug analyzer/106413] State explosion on va_arg when va_start is in top-level function of analysis

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106413

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:6d5194a10dc103031b9c8a03091ca70f6db33c8b

commit r13-1807-g6d5194a10dc103031b9c8a03091ca70f6db33c8b
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Fri Jul 22 19:50:54 2022 -0400

    analyzer: fix state explosion on va_arg [PR106413]

    Fix state explosion on va_arg when the call to va_start is in the
    top-level function of the analysis.

    gcc/analyzer/ChangeLog:
            PR analyzer/106413
            * varargs.cc (region_model::impl_call_va_start): Avoid iterating
            through non-existant variadic arguments by initializing the
            impl_region to "UNKNOWN" if the va_start occurs in the top-level
            function to the analysis.

    gcc/testsuite/ChangeLog:
            PR analyzer/106413
            * gcc.dg/analyzer/torture/stdarg-4.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/106413] State explosion on va_arg when va_start is in top-level function of analysis

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106413

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above commit.