[Bug analyzer/107345] New: - -Wanayzer-null-dereference false positive with giving weird path infomation

[Bug analyzer/107345] New: - -Wanayzer-null-dereference false positive with giving weird path infomation

[geoffreydgr at icloud dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107345

            Bug ID: 107345
           Summary: - -Wanayzer-null-dereference false positive with
                    giving weird path infomation
           Product: gcc
           Version: 12.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: geoffreydgr at icloud dot com
  Target Milestone: ---

I got a weird false positive error when compiling the following "minimal,
complete and verifiable example (MCVE)" program.

```
#include <stdio.h>
int main() {   
  int e = 10086;
  int *f = &e;
  int g = 0;
  int *h[2][1];
  h[1][0] = f;
  if (g == (h[1][0])) {
    // printf("if true\n");
    unsigned int *i = 0;
  }
  printf("NPD_FLAG: %d\n ", *f);
  return 0;
}
```

Compiling the above code with gcc 12.1 with `-O0 -fanalyzer` in
https://godbolt.org/z/av4beszh7 results in :

```
<source>: In function 'main':
<source>:8:9: warning: comparison between pointer and integer
    8 |   if (g == (h[1][0])) {
      |         ^~
<source>:12:3: warning: dereference of NULL 'f' [CWE-476]
[-Wanalyzer-null-dereference]
   12 |   printf("NPD_FLAG: %d\n ", *f);
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  'main': events 1-4
    |
    |    8 |   if (g == (h[1][0])) {
    |      |      ^
    |      |      |
    |      |      (1) following 'true' branch...
    |    9 |     // printf("if true\n");
    |   10 |     unsigned int *i = 0;
    |      |                   ~
    |      |                   |
    |      |                   (2) ...to here
    |      |                   (3) '&e' is NULL
    |   11 |   }
    |   12 |   printf("NPD_FLAG: %d\n ", *f);
    |      |   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |   |
    |      |   (4) dereference of NULL 'f'
    |
```

It is obvious that dereference of  'f' at line 12 cannot result in NPD. It is
weird that the tool reports "(3) '&e' is NULL" at line 10.  There is even no 
'&e' there.
But if i change the original program to the following one,  the NPD false
positive goes away.

```
#include <stdio.h>
int main() {   
  int e = 10086;
  int *f = &e;
  int g = 0;
  int *h[2][1];
  h[1][0] = f;
  if (g == (f)) {
    // printf("if true\n");
    unsigned int *i = 0;
  }
  printf("NPD_FLAG: %d\n ", *f);
  return 0;
}
```

[Bug analyzer/107345] - -Wanayzer-null-dereference false positive with giving weird path infomation

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107345

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2022-10-24

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug.  The analyzer is seeing
  NULL == &e
and fails to treat this as being false; the logic for spotting comparison of
&VAR against NULL was only looking for NULL on the right-hand side.

I'm working on a fix.

[Bug analyzer/107345] - -Wanayzer-null-dereference false positive with giving weird path infomation

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107345

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:18faaeb3af42f3d7dc609b9b91df77d0d59b16f6

commit r13-3468-g18faaeb3af42f3d7dc609b9b91df77d0d59b16f6
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Oct 24 16:38:23 2022 -0400

    analyzer: handle (NULL == &VAR) [PR107345]

    gcc/analyzer/ChangeLog:
            PR analyzer/107345
            * region-model.cc (region_model::eval_condition_without_cm):
            Ensure that constants are on the right-hand side before checking
            for them.

    gcc/testsuite/ChangeLog:
            PR analyzer/107345
            * gcc.dg/analyzer/pr107345.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/107345] - -Wanayzer-null-dereference false positive with giving weird path infomation

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107345

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Fixed on trunk for GCC 13 by the above patch.

Keeping open for backporting to GCC 12.

[Bug analyzer/107345] - -Wanayzer-null-dereference false positive with giving weird path infomation

[geoffreydgr at icloud dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107345

--- Comment #4 from Geoffrey <geoffreydgr at icloud dot com> ---
(In reply to David Malcolm from comment #3)
> Fixed on trunk for GCC 13 by the above patch.
> 
> Keeping open for backporting to GCC 12.

That is really great! Thanks a lot!

[Bug analyzer/107345] - -Wanayzer-null-dereference false positive with giving weird path infomation

[geoffreydgr at icloud dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107345

--- Comment #5 from Geoffrey <geoffreydgr at icloud dot com> ---
(In reply to David Malcolm from comment #3)
> Fixed on trunk for GCC 13 by the above patch.
> 
> Keeping open for backporting to GCC 12.

That is really great! Thanks a lot!

[Bug analyzer/107345] -Wanalyzer-null-dereference false positive with giving weird path infomation

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107345

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by David Malcolm
<dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:111fb5d3cafd0f7f2a0d01aa9e1213013fa0cc83

commit r12-9357-g111fb5d3cafd0f7f2a0d01aa9e1213013fa0cc83
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Wed Mar 29 14:16:47 2023 -0400

    analyzer: handle (NULL == &VAR) [PR107345]

    Cherrypicked from r13-3468-g18faaeb3af42f3.

    gcc/analyzer/ChangeLog:
            PR analyzer/107345
            * region-model.cc (region_model::eval_condition_without_cm):
            Ensure that constants are on the right-hand side before checking
            for them.

    gcc/testsuite/ChangeLog:
            PR analyzer/107345
            * gcc.dg/analyzer/pr107345.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/107345] -Wanalyzer-null-dereference false positive with giving weird path infomation

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107345

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #7 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed on gcc 12 branch by the above (for the eventual gcc 12.3
release);  marking as resolved.