[Bug analyzer/94754] New: -fanalyzer false positive due to it ignoring previous if

[Bug analyzer/94754] New: -fanalyzer false positive due to it ignoring previous if

[colomar.6.4.3 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94754

            Bug ID: 94754
           Summary: -fanalyzer false positive due to it ignoring previous
                    if
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: colomar.6.4.3 at gmail dot com
  Target Milestone: ---

The analyzer follows branches that are incompatible (sometimes).

Code to reproduce the bug:

[[gnu::nonnull]]
static
void    init_x(int cond, int **x, int *y)
{

        if (!cond)
                return;
        *x = y;
}

int     foo(int cond)
{
        int     *x;
        int     y = 7;

        if (cond < 2)
                return  -1;

        /* cond >= 2 != 0, so it will initialize x */
        init_x(cond, &x, &y);

        return  *x;
}

$ gcc-10 -c false_positive.c -o foo -fanalyzer
In function ‘foo’:
false_positive.c:22:9: warning: use of uninitialized value ‘x’ [CWE-457]
[-Wanalyzer-use-of-uninitialized-value]
   22 |  return *x;
      |         ^~
  ‘foo’: events 1-4
    |
    |   11 | int foo(int cond)
    |      |     ^~~
    |      |     |
    |      |     (1) entry to ‘foo’
    |......
    |   16 |  if (cond < 2)
    |      |     ~
    |      |     |
    |      |     (2) following ‘false’ branch (when ‘cond > 1’)...
    |......
    |   20 |  init_x(cond, &x, &y);
    |      |  ~~~~~~~~~~~~~~~~~~~~
    |      |  |
    |      |  (3) ...to here
    |      |  (4) calling ‘init_x’ from ‘foo’
    |
    +--> ‘init_x’: events 5-7
           |
           |    3 | void init_x(int cond, int **x, int *y)
           |      |      ^~~~~~
           |      |      |
           |      |      (5) entry to ‘init_x’
           |......
           |    6 |  if (!cond)
           |      |     ~ 
           |      |     |
           |      |     (6) following ‘true’ branch (when ‘cond == 0’)...
!!! cond == 0, but previously it assumed cond > 1 !!!
           |    7 |   return;
           |      |   ~~~~~~
           |      |   |
           |      |   (7) ...to here
           |
    <------+
    |
  ‘foo’: events 8-9
    |
    |   20 |  init_x(cond, &x, &y);
    |      |  ^~~~~~~~~~~~~~~~~~~~
    |      |  |
    |      |  (8) returning to ‘foo’ from ‘init_x’
    |   21 | 
    |   22 |  return *x;
    |      |         ~~
    |      |         |
    |      |         (9) use of uninitialized value ‘x’ here
    |
$

___________________________________________________

But.

 - If I copy&paste (manual inline) `init_x` code inside `foo`, the warning goes
away.
 - If I use pointers instead of double pointers (`void init_x(int cond, int *x,
int y)`), the warning goes away.

[Bug analyzer/94754] -fanalyzer false positive due to it ignoring previous if

[colomar.6.4.3 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94754

--- Comment #1 from Alejandro Colomar <colomar.6.4.3 at gmail dot com> ---
__builin_unreachable() helped silencing that specific bug, as a temporary
workaround:

[[gnu::nonnull]]
static
int     init_x(int cond, int **x, int *y)
{

        if (!cond)
                return  -1;
        *x = y;
        return  0;
}

int     foo(int cond)
{
        int     *x;
        int     y = 7;

        if (cond < 2)
                return  -1;

        /* cond >= 2 != 0, so it will initialize x and return 0 */
        if (init_x(cond, &x, &y))
                __builtin_unreachable();

        return  *x;
}

[Bug analyzer/94754] -fanalyzer false positive due to it ignoring previous if

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94754

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:78b9783774bfd3540f38f5b1e3c7fc9f719653d7

commit r10-8012-g78b9783774bfd3540f38f5b1e3c7fc9f719653d7
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Apr 23 21:31:22 2020 -0400

    analyzer: remove -Wanalyzer-use-of-uninitialized-value for GCC 10

    From what I can tell -Wanalyzer-use-of-uninitialized-value has not
    yet found a true diagnostic in real-world code, and seems to be
    particularly susceptible to false positives.  These relate to bugs in
    the region_model code.

    For GCC 10 it seems best to remove this warning, which this patch does.
    Internally it also removes POISON_KIND_UNINIT.

    I'm working on a rewrite of the region_model code for GCC 11 that I
    hope will fix these issues, and allow this warning to be reintroduced.

    gcc/analyzer/ChangeLog:
            PR analyzer/94447
            PR analyzer/94639
            PR analyzer/94732
            PR analyzer/94754
            * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
            * program-state.cc (selftest::test_program_state_dumping): Update
            expected dump result for removal of "uninit".
            * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
            case.
            (root_region::ensure_stack_region): Initialize stack with null
            svalue_id rather than with a typeless POISON_KIND_UNINIT value.
            (root_region::ensure_heap_region): Likewise for the heap.
            (region_model::dump_summary_of_rep_path_vars): Remove
            summarization of uninit values.
            (region_model::validate): Remove check that the stack has a
            POISON_KIND_UNINIT value.
            (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
            case.
            (poisoned_value_diagnostic::describe_final_event): Likewise.
            (selftest::test_dump): Update expected dump result for removal of
            "uninit".
            (selftest::test_svalue_equality): Remove "uninit" and "freed".
            * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.

    gcc/ChangeLog:
            PR analyzer/94447
            PR analyzer/94639
            PR analyzer/94732
            PR analyzer/94754
            * doc/invoke.texi (Static Analyzer Options): Remove
            -Wanalyzer-use-of-uninitialized-value.
            (-Wno-analyzer-use-of-uninitialized-value): Remove item.

    gcc/testsuite/ChangeLog:
            PR analyzer/94447
            PR analyzer/94639
            PR analyzer/94732
            PR analyzer/94754
            * gcc.dg/analyzer/data-model-1.c: Mark "use of uninitialized
            value" warnings as xfail for now.
            * gcc.dg/analyzer/data-model-5b.c: Remove uninitialized warning.
            * gcc.dg/analyzer/pr94099.c: Mark "uninitialized" warning as xfail
            for now.
            * gcc.dg/analyzer/pr94447.c: New test.
            * gcc.dg/analyzer/pr94639.c: New test.
            * gcc.dg/analyzer/pr94732.c: New test.
            * gcc.dg/analyzer/pr94754.c: New test.
            * gcc.dg/analyzer/zlib-6.c: Mark "uninitialized" warning as xfail
            for now.

[Bug analyzer/94754] -fanalyzer false positive due to it ignoring previous if

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94754

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by r10-8012-g78b9783774bfd3540f38f5b1e3c7fc9f719653d7.