From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id CDC073858C5E; Mon, 20 Mar 2023 20:44:33 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org CDC073858C5E
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1679345073;
	bh=G//lT5lqW7WciQM/8nyVq2yHPBEDTDyjEntSzA8GjNc=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=J/FzlcvwTLatqt9LWp1Wae7oJbfBiFgjcmsI3PibnPJrugdggp/h+oXdftfKghsGM
	 bSQ99dP1a/bA+XVU91i49Iv5t6LYMhcr9V07pzwLbPZeaXasB7DKnGI6ILSHtc/Ctr
	 Ww3ncsZ8BMLoyjsvb3rE3hVX3eVqV2KX8s1au4Po=
From: "dmalcolm at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug analyzer/109196] GSA evaluates
 `__analyzer_eval(((a())<(0))||((a())==(0)));` to be TRUE, but function `a()`
 is a unknown function
Date: Mon, 20 Mar 2023 20:44:33 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: analyzer
X-Bugzilla-Version: 13.0
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: dmalcolm at gcc dot gnu.org
X-Bugzilla-Status: RESOLVED
X-Bugzilla-Resolution: WONTFIX
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: dmalcolm at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: resolution bug_status
Message-ID: <bug-109196-4-S6e1LwRVV7@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-109196-4@http.gcc.gnu.org/bugzilla/>
References: <bug-109196-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D109196

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |WONTFIX
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Simpler reproducer:
  https://godbolt.org/z/h3WcPP9q8

Looking at the gimple dump, I see:

  <bb 5> :
  iftmp.0_14 =3D 1;
  goto <bb 7>; [INV]

  <bb 6> :
  iftmp.0_13 =3D 0;

  <bb 7> :
  # iftmp.0_4 =3D PHI <iftmp.0_14(5), iftmp.0_13(6)>
  __analyzer_eval (iftmp.0_4);

i.e. that __analyzer_eval is being called with either 0 or 1.  What you're
seeing here is a result of how the analyzer is merging state along different
paths.

Adding  -fno-analyzer-state-merge:
  https://godbolt.org/z/7Tn5xqo4x
converts the output to:
  <source>: In function 'b':
  <source>:9:9: warning: TRUE
      9 |         __analyzer_eval(((a())<(0))||((a())=3D=3D(0)));
        |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  <source>:9:9: warning: FALSE

i.e. the result of ||-ing the conditions could be true, and it could be fal=
se.

__analyzer_eval is intended as a feature for debugging the analyzer, rather
than being end-user-facing, so I'm going to mark this as WONTFIX.  Hope this
makes sense.=