[Bug analyzer/110529] New: -Wanalyzer-null-dereference false nagetive with `*arr[0] = 10086`

[Bug analyzer/110529] New: -Wanalyzer-null-dereference false nagetive with `*arr[0] = 10086`

[dale.mengli.ming at proton dot me]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110529

            Bug ID: 110529
           Summary: -Wanalyzer-null-dereference false nagetive with
                    `*arr[0] = 10086`
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dale.mengli.ming at proton dot me
  Target Milestone: ---

Hi,

```c
void foo(int pc) {
    int *arr[2] = {&&x, &&y};
    int var = 0;
    goto *arr[pc];

x:
    arr[0] = (void *)0;
    *arr[0] = 10086;
    return;
y:
    return;
}

int main() { foo(0); }
```

in this case, the analyzer with `-O3` doesn't report an NPD about `*arr[0] =
10086`.

See it live: https://godbolt.org/z/1E9e5oKdE.

Thanks for taking the time to review this case.

[Bug analyzer/110529] -Wanalyzer-null-dereference false nagetive with `*arr[0] = 10086`

[dale.mengli.ming at proton dot me]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110529

--- Comment #1 from mengli ming <dale.mengli.ming at proton dot me> ---
It's a little odd that there is no output (https://godbolt.org/z/GhshzvaTq) for
`_analyzer_eval(1)` in line 9 and line 13.

[Bug analyzer/110529] -Wanalyzer-null-dereference false nagetive with `*arr[0] = 10086`

[dale.mengli.ming at proton dot me]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110529

--- Comment #2 from mengli ming <dale.mengli.ming at proton dot me> ---
Um, would you be available to take a look at this case? Your insights would be
greatly appreciated!

[Bug analyzer/110529] Analyzer fails to handle computed goto

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110529

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
            Summary|-Wanalyzer-null-dereference |Analyzer fails to handle
                   |false nagetive with         |computed goto
                   |`*arr[0] = 10086`           |
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-09-02

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug.

Looking at
  -fdump-analyzer-exploded-graph -fanalyzer-fine-grained
it looks like the analyzer gives up exploring execution paths at the computed
goto.

The supergraph shows that the CFG at the goto has out-edges to x and y, with
the flag "ABNORMAL".

[Bug analyzer/110529] Analyzer fails to handle computed goto

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110529

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:1b761fede44afac5fa72e77caced9beda93fb381

commit r14-3796-g1b761fede44afac5fa72e77caced9beda93fb381
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Sep 7 18:43:05 2023 -0400

    analyzer: basic support for computed gotos (PR analyzer/110529)

    PR analyzer/110529 notes that -fanalyzer was giving up on execution
    paths that follow a computed goto, due to ignoring CFG edges with the
    flag EDGE_ABNORMAL set.

    This patch implements enough handling for them to allow analysis of
    such execution paths to continue.

    gcc/analyzer/ChangeLog:
            PR analyzer/110529
            * program-point.cc (program_point::on_edge): Don't reject
            EDGE_ABNORMAL for computed gotos.
            * region-model.cc (region_model::maybe_update_for_edge): Handle
            computed goto statements.
            (region_model::apply_constraints_for_ggoto): New.
            * region-model.h (region_model::apply_constraints_for_ggoto): New
decl.
            * supergraph.cc (supernode::get_label): New.
            * supergraph.h (supernode::get_label): New decl.

    gcc/testsuite/ChangeLog:
            PR analyzer/110529
            * c-c++-common/analyzer/computed-goto-1.c: New test.
            * gcc.dg/analyzer/computed-goto-pr110529.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/110529] Analyzer fails to handle computed goto

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110529

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #5 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed on trunk for gcc 14 by the above commit.

[Bug analyzer/110529] Analyzer fails to handle computed goto

[dale.mengli.ming at proton dot me]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110529

--- Comment #6 from mengli ming <dale.mengli.ming at proton dot me> ---
(In reply to David Malcolm from comment #5)
> Should be fixed on trunk for gcc 14 by the above commit.

Thanks a lot for your hard work!