From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 401C9385DC23; Thu, 23 Apr 2020 14:58:47 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 401C9385DC23 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1587653927; bh=MwwIkSIYfLbOShQCoJx/K+I7tqhPehdklBob8/1DWuM=; h=From:To:Subject:Date:From; b=KLcE/ZtUf7qeJ44qb3kO37fdChkC9yHlzT3KyLZXrppDlc0BROr6o+FO7r2eRuYGW yQ9bx/G5g8MgdaMFvxLhhoRsocd1Em38M25PI2NMtUJCYsaS5MjDdjzukuwwV28Upo qgcc4Mp4s5uYLbob/NcRx23X47MVuH5t1wpbr+KM= From: "vincent-gcc at vinc17 dot net" To: gcc-bugs@gcc.gnu.org Subject: [Bug analyzer/94732] New: Analyzer: false positive in MPFR's atan.c Date: Thu, 23 Apr 2020 14:58:46 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: analyzer X-Bugzilla-Version: 10.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: vincent-gcc at vinc17 dot net X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: dmalcolm at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter target_milestone attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: gcc-bugs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-bugs mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Apr 2020 14:58:47 -0000 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D94732 Bug ID: 94732 Summary: Analyzer: false positive in MPFR's atan.c Product: gcc Version: 10.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: analyzer Assignee: dmalcolm at gcc dot gnu.org Reporter: vincent-gcc at vinc17 dot net Target Milestone: --- Created attachment 48360 --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=3D48360&action=3Dedit testcase Test with: gcc-10 (Debian 10-20200418-1) 10.0.1 20200418 (experimental) [ma= ster revision 27c171775ab:4c277008be0:c5bac7d127f288fd2f8a1f15c3f30da5903141c6] When I want to compile GNU MPFR with -fanalyzer, the compilation of atan.c fails on what appears to be a false positive. I've managed to reduce the 6000-line preprocessed code to code with fewer than 300 lines (attached bug= .i file). More specifically, I've removed * blank lines and comments; * unused declarations/definitions; * code that could have an influence only after the "error"; * code testing and handling special cases. I order to see where the issue could come from, I've added 2 lines * "((y)->_mpfr_d)[0] =3D 0;" at the beginning of mpfr_atan_aux; * "((tmp2)->_mpfr_d)[0] =3D 0;" just before the call to mpfr_atan_aux. Without these 2 lines, "gcc-10 -c -fanalyzer bug.i" gives: bug.i: In function =E2=80=98set_table=E2=80=99: bug.i:145:9: warning: use of uninitialized value =E2=80=98yp=E2=80=99 [CWE-= 457] [-Wanalyzer-use-of-uninitialized-value] 145 | yp[0] &=3D ~(((void) 0), sh =3D=3D | ^~ where yp is set with mp_limb_t *yp =3D ((y)->_mpfr_d); So I suppose that the analyzer complains that (y)->_mpfr_d is uninitialized. This comes from mpfr_atan_aux, and "((y)->_mpfr_d)[0] =3D 0;" at the beginn= ing of this function should trigger the same error. If I add this line, I get in a consistent way: bug.i: In function =E2=80=98mpfr_atan_aux=E2=80=99: bug.i:154:19: warning: use of uninitialized value =E2=80=98=E2=80= =99 [CWE-457] [-Wanalyzer-use-of-uninitialized-value] 154 | ((y)->_mpfr_d)[0] =3D 0; | ~~~~~~~~~~~~~~~~~~^~~ This mpfr_atan_aux function is called at only one place: mpfr_atan_aux (tmp2, ukz, twopoweri, n0 - i, tabz); So I added "((tmp2)->_mpfr_d)[0] =3D 0;" just before this call. I thought t= hat I would get an error on this, but I still get an error only on "((y)->_mpfr_d= )[0] =3D 0;" in mpfr_atan_aux. If I remove this line (just keeping the one befor= e the call to mpfr_atan_aux), I get the error in set_table only, just like in the first test. Now, this appears to be a false positif since (tmp2)->_mpfr_d was initializ= ed earlier. I could probably simplify the code even further, focusing on (tmp2)->_mpfr_d only.=