[Bug analyzer/112955] New: Valgrind error in ana::feasibility_state::maybe_update_for_edge

[Bug analyzer/112955] New: Valgrind error in ana::feasibility_state::maybe_update_for_edge

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112955

            Bug ID: 112955
           Summary: Valgrind error in
                    ana::feasibility_state::maybe_update_for_edge
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: jakub at gcc dot gnu.org
  Target Milestone: ---

I'm doing --enable-checking=release,valgrind --enable-valgrind-annotations
build, make check still running (for 30 hours already), but even from partial
results the most common failure is in analyzer tests.
grep ana::feasibility_state::maybe_update_for_edge obj88/gcc/testsuite/*/*.log
| wc -l
1186
E.g.
FAIL: gcc.dg/analyzer/data-model-20.c (test for excess errors)
Excess errors:
==386864== Conditional jump or move depends on uninitialised value(s)
==386864==    at 0x1058B52:
ana::feasibility_state::maybe_update_for_edge(ana::logger*, ana::exploded_edge
const*, ana::region_model_context*, std::unique_ptr<ana::rejected_constraint,
std::default_delete<ana::rejected_constraint> >*) (engine.cc:4996)
==386864==    by 0x106C48F: starts_infinite_loop_p (infinite-loop.cc:461)
==386864==    by 0x106C48F: ana::exploded_graph::detect_infinite_loops()
(infinite-loop.cc:536)
==386864==    by 0x10640D9: ana::impl_run_checkers(ana::logger*)
(engine.cc:6211)
==386864==    by 0x1064AA6: ana::run_checkers() (engine.cc:6299)
==386864==    by 0x1054C98: (anonymous
namespace)::pass_analyzer::execute(function*) (analyzer-pass.cc:87)
==386864==    by 0xC02D3A: execute_one_pass(opt_pass*) (passes.cc:2646)
==386864==    by 0xC03AD6: execute_ipa_pass_list(opt_pass*) (passes.cc:3095)
==386864==    by 0x8A41CD: ipa_passes (cgraphunit.cc:2269)
==386864==    by 0x8A41CD: symbol_table::compile() [clone .part.0]
(cgraphunit.cc:2332)
==386864==    by 0x8A6617: compile (cgraphunit.cc:2312)
==386864==    by 0x8A6617: symbol_table::finalize_compilation_unit()
(cgraphunit.cc:2584)
==386864==    by 0xCFFA61: compile_file() (toplev.cc:473)
==386864==    by 0x704D23: do_compile (toplev.cc:2150)
==386864==    by 0x704D23: toplev::main(int, char**) (toplev.cc:2306)
==386864==    by 0x7064BA: main (main.cc:39)
with
/home/jakub/src/gcc/obj88/gcc/xgcc -B/home/jakub/src/gcc/obj88/gcc/
/home/jakub/src/gcc/gcc/testsuite/gcc.dg/analyzer/data-model-20.c
-fdiagnostics-plain-output 
-fanalyzer -Wanalyzer-too-complex -Wanalyzer-symbol-too-complex
-fanalyzer-call-summaries -Wno-analyzer-too-complex -S -o data-model-20.s
Should be also reproducible with just --enable-valgrind-annotations
--enable-checking=release and adding -wrapper valgrind,-q

[Bug analyzer/112955] Valgrind error in ana::feasibility_state::maybe_update_for_edge

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112955

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2023-12-11
     Ever confirmed|0                           |1

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks; am testing a fix.

[Bug analyzer/112955] Valgrind error in ana::feasibility_state::maybe_update_for_edge

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112955

--- Comment #2 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:6008b80b25d71827fb26ce49f49aae02b645bb12

commit r14-6434-g6008b80b25d71827fb26ce49f49aae02b645bb12
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Dec 11 16:18:56 2023 -0500

    analyzer: fix uninitialized bitmap [PR112955]

    In r14-5566-g841008d3966c0f I added a new ctor for
    feasibility_state, but failed to call bitmap_clear
    on m_snodes_visited.

    Fixed thusly.

    gcc/analyzer/ChangeLog:
            PR analyzer/112955
            * engine.cc (feasibility_state::feasibility_state): Initialize
            m_snodes_visited.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/112955] Valgrind error in ana::feasibility_state::maybe_update_for_edge

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112955

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above patch.

[Bug analyzer/112955] Valgrind error in ana::feasibility_state::maybe_update_for_edge

[tschwinge at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112955

Thomas Schwinge <tschwinge at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |danglin at gcc dot gnu.org

--- Comment #4 from Thomas Schwinge <tschwinge at gcc dot gnu.org> ---
*** Bug 112704 has been marked as a duplicate of this bug. ***