public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/108704] New: Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c
@ 2023-02-07 23:13 dmalcolm at gcc dot gnu.org
2023-02-07 23:14 ` [Bug analyzer/108704] [13 Regression] " dmalcolm at gcc dot gnu.org
` (5 more replies)
0 siblings, 6 replies; 7+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2023-02-07 23:13 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108704
Bug ID: 108704
Summary: Many -Wanalyzer-use-of-uninitialized-value false
positives seen in qemu's softfloat.c
Product: gcc
Version: 13.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
Created attachment 54425
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54425&action=edit
Reduced reproducer
Trunk shows many (dozens?) of -Wanalyzer-use-of-uninitialized-value false
positives on qemu's softfloat.c
https://godbolt.org/z/MTe9597Eh shows:
<source>: In function 'test':
<source>:27:9: warning: use of uninitialized value 'fp0' [CWE-457]
[-Wanalyzer-use-of-uninitialized-value]
27 | fp0 = floatx80_add(fp0, float32_to_floatx80((0x3F800000)));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'test': events 1-3
|
| 24 | floatx80 fp0;
| | ^~~
| | |
| | (1) region created on stack here
| | (2) capacity: 16 bytes
|......
| 27 | fp0 = floatx80_add(fp0, float32_to_floatx80((0x3F800000)));
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (3) use of uninitialized value 'fp0' here
|
Compiler returned: 0
where fp0 appears to have been initialized on the line above.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug analyzer/108704] [13 Regression] Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c
2023-02-07 23:13 [Bug analyzer/108704] New: Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c dmalcolm at gcc dot gnu.org
@ 2023-02-07 23:14 ` dmalcolm at gcc dot gnu.org
2023-02-07 23:30 ` dmalcolm at gcc dot gnu.org
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2023-02-07 23:14 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108704
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|--- |13.0
Status|UNCONFIRMED |ASSIGNED
Last reconfirmed| |2023-02-07
Summary|Many |[13 Regression] Many
|-Wanalyzer-use-of-uninitial |-Wanalyzer-use-of-uninitial
|ized-value false positives |ized-value false positives
|seen in qemu's softfloat.c |seen in qemu's softfloat.c
Ever confirmed|0 |1
--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Doesn't seem to affect gcc 12.2 so marking as a regression.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug analyzer/108704] [13 Regression] Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c
2023-02-07 23:13 [Bug analyzer/108704] New: Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c dmalcolm at gcc dot gnu.org
2023-02-07 23:14 ` [Bug analyzer/108704] [13 Regression] " dmalcolm at gcc dot gnu.org
@ 2023-02-07 23:30 ` dmalcolm at gcc dot gnu.org
2023-02-08 18:48 ` cvs-commit at gcc dot gnu.org
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2023-02-07 23:30 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108704
--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Adding -fno-analyzer-state-purge fixes the false positive, looks like it's
erroneously pruning the value of fp0 immediately after the first assignment.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug analyzer/108704] [13 Regression] Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c
2023-02-07 23:13 [Bug analyzer/108704] New: Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c dmalcolm at gcc dot gnu.org
2023-02-07 23:14 ` [Bug analyzer/108704] [13 Regression] " dmalcolm at gcc dot gnu.org
2023-02-07 23:30 ` dmalcolm at gcc dot gnu.org
@ 2023-02-08 18:48 ` cvs-commit at gcc dot gnu.org
2023-02-08 18:58 ` [Bug analyzer/108704] " dmalcolm at gcc dot gnu.org
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2023-02-08 18:48 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108704
--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:
https://gcc.gnu.org/g:77bb54b1b07add45007c664724b726541d672ef3
commit r13-5745-g77bb54b1b07add45007c664724b726541d672ef3
Author: David Malcolm <dmalcolm@redhat.com>
Date: Wed Feb 8 13:47:36 2023 -0500
analyzer: fix overzealous state purging with on-stack structs [PR108704]
PR analyzer/108704 reports many false positives seen from
-Wanalyzer-use-of-uninitialized-value on qemu's softfloat.c on code like
the following:
struct st s;
s = foo ();
s = bar (s); // bogusly reports that s is uninitialized here
where e.g. "struct st" is "floatx80" in the qemu examples.
The root cause is overzealous purging of on-stack structs in the code I
added in r12-7718-gfaacafd2306ad7, where at:
s = bar (s);
state_purge_per_decl::process_point_backwards "sees" the assignment to 's'
and stops processing, effectively treating 's' as unneeded before this
stmt, not noticing the use of 's' in the argument.
Fixed thusly.
The patch greatly reduces the number of
-Wanalyzer-use-of-uninitialized-value warnings from my integration tests:
ImageMagick-7.1.0-57: 10 -> 6 (-4)
qemu-7.2: 858 -> 87 (-771)
haproxy-2.7.1: 1 -> 0 (-1)
All of the above that I've examined appear to be false positives.
gcc/analyzer/ChangeLog:
PR analyzer/108704
* state-purge.cc (state_purge_per_decl::process_point_backwards):
Don't stop processing the decl if it's fully overwritten by
this stmt if it's also used by this stmt.
gcc/testsuite/ChangeLog:
PR analyzer/108704
* gcc.dg/analyzer/uninit-7.c: New test.
* gcc.dg/analyzer/uninit-pr108704.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug analyzer/108704] Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c
2023-02-07 23:13 [Bug analyzer/108704] New: Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c dmalcolm at gcc dot gnu.org
` (2 preceding siblings ...)
2023-02-08 18:48 ` cvs-commit at gcc dot gnu.org
@ 2023-02-08 18:58 ` dmalcolm at gcc dot gnu.org
2023-03-29 18:19 ` cvs-commit at gcc dot gnu.org
2023-03-29 19:31 ` dmalcolm at gcc dot gnu.org
5 siblings, 0 replies; 7+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2023-02-08 18:58 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108704
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|[13 Regression] Many |Many
|-Wanalyzer-use-of-uninitial |-Wanalyzer-use-of-uninitial
|ized-value false positives |ized-value false positives
|seen in qemu's softfloat.c |seen in qemu's softfloat.c
--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed on trunk for GCC 13 by the above commit.
I introduced the bug in r12-7718-gfaacafd2306ad7 so in theory it affects GCC 12
as well, but I haven't been able to reproduce it there. The bug is probably
present there but latent, so I'm keeping this bug open to track backporting the
fix to the gcc 12 branch.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug analyzer/108704] Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c
2023-02-07 23:13 [Bug analyzer/108704] New: Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c dmalcolm at gcc dot gnu.org
` (3 preceding siblings ...)
2023-02-08 18:58 ` [Bug analyzer/108704] " dmalcolm at gcc dot gnu.org
@ 2023-03-29 18:19 ` cvs-commit at gcc dot gnu.org
2023-03-29 19:31 ` dmalcolm at gcc dot gnu.org
5 siblings, 0 replies; 7+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2023-03-29 18:19 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108704
--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by David Malcolm
<dmalcolm@gcc.gnu.org>:
https://gcc.gnu.org/g:5da2126c4df8d83c2b2f9de7bb393ab4f5832840
commit r12-9364-g5da2126c4df8d83c2b2f9de7bb393ab4f5832840
Author: David Malcolm <dmalcolm@redhat.com>
Date: Wed Mar 29 14:16:48 2023 -0400
analyzer: fix overzealous state purging with on-stack structs [PR108704]
PR analyzer/108704 reports many false positives seen from
-Wanalyzer-use-of-uninitialized-value on qemu's softfloat.c on code like
the following:
struct st s;
s = foo ();
s = bar (s); // bogusly reports that s is uninitialized here
where e.g. "struct st" is "floatx80" in the qemu examples.
The root cause is overzealous purging of on-stack structs in the code I
added in r12-7718-gfaacafd2306ad7, where at:
s = bar (s);
state_purge_per_decl::process_point_backwards "sees" the assignment to 's'
and stops processing, effectively treating 's' as unneeded before this
stmt, not noticing the use of 's' in the argument.
Fixed thusly.
The patch greatly reduces the number of
-Wanalyzer-use-of-uninitialized-value warnings from my integration tests:
ImageMagick-7.1.0-57: 10 -> 6 (-4)
qemu-7.2: 858 -> 87 (-771)
haproxy-2.7.1: 1 -> 0 (-1)
All of the above that I've examined appear to be false positives.
Cherrypicked from r13-5745-g77bb54b1b07add.
gcc/analyzer/ChangeLog:
PR analyzer/108704
* state-purge.cc (state_purge_per_decl::process_point_backwards):
Don't stop processing the decl if it's fully overwritten by
this stmt if it's also used by this stmt.
gcc/testsuite/ChangeLog:
PR analyzer/108704
* gcc.dg/analyzer/uninit-7.c: New test.
* gcc.dg/analyzer/uninit-pr108704.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug analyzer/108704] Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c
2023-02-07 23:13 [Bug analyzer/108704] New: Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c dmalcolm at gcc dot gnu.org
` (4 preceding siblings ...)
2023-03-29 18:19 ` cvs-commit at gcc dot gnu.org
@ 2023-03-29 19:31 ` dmalcolm at gcc dot gnu.org
5 siblings, 0 replies; 7+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2023-03-29 19:31 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108704
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|ASSIGNED |RESOLVED
--- Comment #6 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed on gcc 12 branch by the above (for the eventual gcc 12.3
release); marking as resolved.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2023-03-29 19:31 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-02-07 23:13 [Bug analyzer/108704] New: Many -Wanalyzer-use-of-uninitialized-value false positives seen in qemu's softfloat.c dmalcolm at gcc dot gnu.org
2023-02-07 23:14 ` [Bug analyzer/108704] [13 Regression] " dmalcolm at gcc dot gnu.org
2023-02-07 23:30 ` dmalcolm at gcc dot gnu.org
2023-02-08 18:48 ` cvs-commit at gcc dot gnu.org
2023-02-08 18:58 ` [Bug analyzer/108704] " dmalcolm at gcc dot gnu.org
2023-03-29 18:19 ` cvs-commit at gcc dot gnu.org
2023-03-29 19:31 ` dmalcolm at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).