[Bug analyzer/109197] New: GCC Static Analyzer does not kown `c || b.d` is false with the fact that `c=0` and `b.d=0`

[Bug analyzer/109197] New: GCC Static Analyzer does not kown `c || b.d` is false with the fact that `c=0` and `b.d=0`

[geoffreydgr at icloud dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109197

            Bug ID: 109197
           Summary: GCC Static Analyzer does not kown `c || b.d` is false
                    with the fact that `c=0` and `b.d=0`
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: geoffreydgr at icloud dot com
  Target Milestone: ---

GSA does not kown `c || b.d` is false with the fact that `c=0` and
`b.d=0`leading to a flase positive, but CSA kowns.

See it live:
GSA: https://godbolt.org/z/vd3Tvdods
CSA: https://godbolt.org/z/PEnv6Ece4

Input:
```c
void __analyzer_eval();


struct a
{
    int d : 10;
}

e(){
    struct a b;
    int c;

    c = 0;
    b.d = 0;
    int *p = (int *)0;
    if (c || b.d)
    {
        __analyzer_eval(c || b.d);
        __analyzer_eval(c);
        __analyzer_eval(b.d);
        *p = 42;
    }
}
```

[Bug analyzer/109197] Analyzer gets confused about conditionals involving bitfields

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109197

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|GCC Static Analyzer does    |Analyzer gets confused
                   |not kown `c || b.d` is      |about conditionals
                   |false with the fact that    |involving bitfields
                   |`c=0` and `b.d=0`           |
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-03-20

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this.

Simpler reproducer:
  https://godbolt.org/z/qe5cEY9Kh

struct a
{
    int d : 10;
} b;

void e()
{
    b.d = 0;
    if (b.d)
    {
        __analyzer_eval (b.d);
        __analyzer_dump_path ();
    }
}


[skipping -Wimplicit-function-declaration warnings]

<source>:11:9: warning: FALSE
   11 |         __analyzer_eval (b.d);
      |         ^~~~~~~~~~~~~~~~~~~~~
<source>:12:9: note: path
   12 |         __analyzer_dump_path ();
      |         ^~~~~~~~~~~~~~~~~~~~~~~
  'e': events 1-3
    |
    |    9 |     if (b.d)
    |      |        ^
    |      |        |
    |      |        (1) following 'true' branch...
    |   10 |     {
    |   11 |         __analyzer_eval (b.d);
    |      |                          ~~~
    |      |                           |
    |      |                           (2) ...to here
    |   12 |         __analyzer_dump_path ();
    |      |         ~~~~~~~~~~~~~~~~~~~~~~~
    |      |         |
    |      |         (3) here
    |

where it's erronesously considering the case where b.d is 0, but then b.d is
somehow true.