[Bug analyzer/108733] New: -Wanalyzer-use-of-uninitialized-value false positives seen with __attribute__((cleanup))

["dmalcolm at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108733

            Bug ID: 108733
           Summary: -Wanalyzer-use-of-uninitialized-value false positives
                    seen with __attribute__((cleanup))
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
  Target Milestone: ---

Created attachment 54439
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54439&action=edit
Reproducer

Am seeing various false positives in qemu from
-Wanalyzer-use-of-uninitialized-value with __attribute__((cleanup))

Seems to happen at -O1 and above with the attached reproducer, with both trunk
and gcc 12.2:
  Trunk: https://godbolt.org/z/GdrY49151
  12.2:  https://godbolt.org/z/rjzvjd3qG

In function 'g_autoptr_cleanup_generic_gfree',
    inlined from 'spapr_cap_get_string' at <source>:60:67:
<source>:15:3: warning: use of uninitialized value '*(void **)&val' [CWE-457]
[-Wanalyzer-use-of-uninitialized-value]
   15 |   g_free(*pp);
      |   ^~~~~~~~~~~
  'spapr_cap_get_string': events 1-4
    |
    |   60 |   __attribute__((cleanup(g_autoptr_cleanup_generic_gfree))) char*
val = NULL;
    |      |                                                                  
^~~
    |      |                                                                  
|
    |      |                                                                  
(1) region created on stack here
    |      |                                                                  
(4) inlined call to 'g_autoptr_cleanup_generic_gfree' from
'spapr_cap_get_string'
    |......
    |   63 |   if (value >= cap->possible->num) {
    |      |      ~                                                             
    |      |      |
    |      |      (2) following 'true' branch...
    |   64 |     error_setg_internal((errp),
    |      |     ~~~~~~~~~~~~~~~~~~~                                            
    |      |     |
    |      |     (3) ...to here
    |
    +--> 'g_autoptr_cleanup_generic_gfree': event 5
           |
           |   15 |   g_free(*pp);
           |      |   ^~~~~~~~~~~
           |      |   |
           |      |   (5) use of uninitialized value '*(void **)&val' here
           |
Compiler returned: 0