[Bug analyzer/95006] New: Reimplement -Wanalyzer-use-of-uninitialized-value

[Bug analyzer/95006] New: Reimplement -Wanalyzer-use-of-uninitialized-value

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95006

            Bug ID: 95006
           Summary: Reimplement -Wanalyzer-use-of-uninitialized-value
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Keywords: meta-bug
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
        Depends on: 94447, 94639, 94732, 94754
  Target Milestone: ---

I removed -Wanalyzer-use-of-uninitialized-value in
r10-8012-g78b9783774bfd3540f38f5b1e3c7fc9f719653d7 as it had too many false
positives:
  https://gcc.gnu.org/pipermail/gcc-patches/2020-April/544726.html

This is a tracker bug, for keeping track of what needs fixing in order to
reimplement it.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94447
[Bug 94447] Not handling CONSTRUCTOR tree code
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94639
[Bug 94639] false-positive uninitialized value on fixed sized array
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94732
[Bug 94732] Analyzer: false positive in MPFR's atan.c
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94754
[Bug 94754] -fanalyzer false positive due to it ignoring previous if

[Bug analyzer/95006] Reimplement -Wanalyzer-use-of-uninitialized-value

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95006
Bug 95006 depends on bug 94999, which changed state.

Bug 94999 Summary: internal compiler error: in saved_diagnostic
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94999

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |DUPLICATE

[Bug analyzer/95006] Reimplement -Wanalyzer-use-of-uninitialized-value

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95006
Bug 95006 depends on bug 94447, which changed state.

Bug 94447 Summary: Not handling CONSTRUCTOR tree code
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94447

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

[Bug analyzer/95006] RFE: Reimplement -Wanalyzer-use-of-uninitialized-value

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95006

--- Comment #1 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:e61ffa201403e3814a43b176883e176716b1492f

commit r12-1931-ge61ffa201403e3814a43b176883e176716b1492f
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Wed Jun 30 09:39:04 2021 -0400

    analyzer: eliminate enum binding_key [PR95006]

    I rewrote the way the analyzer's region_model tracks the state of memory
    in GCC 11 (in 808f4dfeb3a95f50f15e71148e5c1067f90a126d), which
    introduced a store with a binding_map class, mapping binding keys to
    symbolic values.

    The GCC 11 implementation of binding keys has an enum binding_kind,
    which can be "default" vs "direct"; the idea being that direct
    bindings take priority over default bindings, where the latter could
    be used to represent e.g. a zero-fill of a buffer, and the former
    expresses those subregions that have since been touched.

    This doesn't work well: it doesn't express the idea of filling
    different subregions with different values, or a memset that only
    touches part of a buffer, leading to numerous XFAILs in the memset
    test cases (and elsewhere).

    As preparatory work towards tracking uninitialized values, this patch
    eliminates the enum binding_kind, so that all bindings have
    equal weight; the order in which they happen is all that matters.
    If a write happens which partially overwrites an existing binding,
    the new code can partially overwrite a binding, potentially punching a
    hole so that an existing binding is split into two parts.

    The patch adds some new classes:
    - a new "bits_within_svalue" symbolic value to support extracting
      parts of an existing value when its binding is partially clobbered
    - a new "repeated_svalue" symbolic value to better express filling
      a region with repeated copies of a symbolic value (e.g. constant
      zero)
    - a new "sized_region" region to express accessing a subregion
      with a symbolic size in bytes
    and it rewrites e.g. how memset is implemented, so that we can precisely
    track which bits in a region have not been touched.

    That said, the patch doesn't actually implement "uninitialized" values;
    I'm saving that for a followup.

    gcc/analyzer/ChangeLog:
            PR analyzer/95006
            * analyzer.h (class repeated_svalue): New forward decl.
            (class bits_within_svalue): New forward decl.
            (class sized_region): New forward decl.
            (get_field_at_bit_offset): New forward decl.
            * engine.cc (exploded_graph::get_or_create_node): Validate the
            merged state.
            (exploded_graph::maybe_process_run_of_before_supernode_enodes):
            Validate the states at each stage.
            * program-state.cc (program_state::validate): Validate
            m_region_model.
            * region-model-impl-calls.cc (region_model::impl_call_memset):
            Replace special-case logic for handling constant sizes with
            a call to fill_region of a sized_region with the given fill value.
            * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
            Drop DK_direct.
            (region_model_manager::maybe_fold_sub_svalue):  Fold element-based
            subregions of an initial value into initial values of an element.
            Fold subvalues of repeated svalues.
            (region_model_manager::maybe_fold_repeated_svalue): New.
            (region_model_manager::get_or_create_repeated_svalue): New.
            (get_bit_range_for_field): New.
            (get_byte_range_for_field): New.
            (get_field_at_byte_range): New.
            (region_model_manager::maybe_fold_bits_within_svalue): New.
            (region_model_manager::get_or_create_bits_within): New.
            (region_model_manager::get_sized_region): New.
            (region_model_manager::log_stats): Update for addition of
            m_repeated_values_map, m_bits_within_values_map, and
            m_sized_regions.
            * region-model.cc (region_model::validate): New.
            (region_model::on_assignment): Drop enum binding_kind.
            (region_model::get_initial_value_for_global): Likewise.
            (region_model::get_rvalue_for_bits): Replace body with call to
            get_or_create_bits_within.
            (region_model::get_capacity): Handle RK_SIZED.
            (region_model::set_value): Drop enum binding_kind.
            (region_model::fill_region): New.
            (region_model::get_representative_path_var_1): Handle RK_SIZED.
            * region-model.h (visitor::visit_repeated_svalue): New.
            (visitor::visit_bits_within_svalue): New.
            (region_model_manager::get_or_create_repeated_svalue): New decl.
            (region_model_manager::get_or_create_bits_within): New decl.
            (region_model_manager::get_sized_region): New decl.
            (region_model_manager::maybe_fold_repeated_svalue): New decl.
            (region_model_manager::maybe_fold_bits_within_svalue): New decl.
            (region_model_manager::repeated_values_map_t): New typedef.
            (region_model_manager::m_repeated_values_map): New field.
            (region_model_manager::bits_within_values_map_t): New typedef.
            (region_model_manager::m_bits_within_values_map): New field.
            (region_model_manager::m_sized_regions): New field.
            (region_model::fill_region): New decl.
            * region.cc (region::get_base_region): Handle RK_SIZED.
            (region::base_region_p): Likewise.
            (region::get_byte_size_sval): New.
            (get_field_at_bit_offset): Make non-static.
            (region::calc_offset): Move implementation of cases to
            get_relative_concrete_offset vfunc implementations.  Handle
            RK_SIZED.
            (region::get_relative_concrete_offset): New.
            (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
            (field_region::get_relative_concrete_offset): New, from
            region::calc_offset.
            (element_region::get_relative_concrete_offset): Likewise.
            (offset_region::get_relative_concrete_offset): Likewise.
            (sized_region::accept): New.
            (sized_region::dump_to_pp): New.
            (sized_region::get_byte_size): New.
            (sized_region::get_bit_size): New.
            * region.h (enum region_kind): Add RK_SIZED.
            (region::dyn_cast_sized_region): New.
            (region::get_byte_size): Make virtual.
            (region::get_bit_size): Likewise.
            (region::get_byte_size_sval): New decl.
            (region::get_relative_concrete_offset): New decl.
            (field_region::get_relative_concrete_offset): New decl.
            (element_region::get_relative_concrete_offset): Likewise.
            (offset_region::get_relative_concrete_offset): Likewise.
            (class sized_region): New.
            * store.cc (binding_kind_to_string): Delete.
            (binding_key::make): Drop enum binding_kind.
            (binding_key::dump_to_pp): Delete.
            (binding_key::cmp_ptrs): Drop enum binding_kind.
            (bit_range::contains_p): New.
            (byte_range::dump): New.
            (byte_range::contains_p): New.
            (byte_range::cmp): New.
            (concrete_binding::dump_to_pp): Drop enum binding_kind.
            (concrete_binding::cmp_ptr_ptr): Likewise.
            (symbolic_binding::dump_to_pp): Likewise.
            (symbolic_binding::cmp_ptr_ptr): Likewise.
            (binding_map::apply_ctor_val_to_range): Likewise.
            (binding_map::apply_ctor_pair_to_child_region): Likewise.
            (binding_map::get_overlapping_bindings): New.
            (binding_map::remove_overlapping_bindings): New.
            (binding_cluster::validate): New.
            (binding_cluster::bind): Drop enum binding_kind.
            (binding_cluster::bind_compound_sval): Likewise.
            (binding_cluster::purge_region): Likewise.
            (binding_cluster::zero_fill_region): Reimplement in terms of...
            (binding_cluster::fill_region): New.
            (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
            (binding_cluster::get_binding): Likewise.
            (binding_cluster::get_binding_recursive): Likewise.
            (binding_cluster::get_any_binding): Likewise.
            (binding_cluster::maybe_get_compound_binding): Reimplement.
            (binding_cluster::get_overlapping_bindings): Delete.
            (binding_cluster::remove_overlapping_bindings): Reimplement in
            terms of binding_map::remove_overlapping_bindings.
            (binding_cluster::can_merge_p): Update for removal of
            enum binding_kind.
            (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
            (binding_cluster::maybe_get_simple_value): Likewise.
            (store_manager::get_concrete_binding): Likewise.
            (store_manager::get_symbolic_binding): Likewise.
            (store::validate): New.
            (store::set_value): Drop enum binding_kind.
            (store::zero_fill_region): Reimplement in terms of...
            (store::fill_region): New.
            (selftest::test_binding_key_overlap): Drop enum binding_kind.
            * store.h (enum binding_kind): Delete.
            (binding_kind_to_string): Delete decl.
            (binding_key::make): Drop enum binding_kind.
            (binding_key::dump_to_pp): Make pure virtual.
            (binding_key::get_kind): Delete.
            (binding_key::mark_deleted): Delete.
            (binding_key::mark_empty): Delete.
            (binding_key::is_deleted): Delete.
            (binding_key::is_empty): Delete.
            (binding_key::binding_key): Delete.
            (binding_key::impl_hash): Delete.
            (binding_key::impl_eq): Delete.
            (binding_key::m_kind): Delete.
            (bit_range::get_last_bit_offset): New.
            (bit_range::contains_p): New.
            (byte_range::contains_p): New.
            (byte_range::operator==): New.
            (byte_range::get_start_byte_offset): New.
            (byte_range::get_next_byte_offset): New.
            (byte_range::get_last_byte_offset): New.
            (byte_range::as_bit_range): New.
            (byte_range::cmp): New.
            (concrete_binding::concrete_binding): Drop enum binding_kind.
            (concrete_binding::hash): Likewise.
            (concrete_binding::operator==): Likewise.
            (concrete_binding::mark_deleted): New.
            (concrete_binding::mark_empty): New.
            (concrete_binding::is_deleted): New.
            (concrete_binding::is_empty): New.
            (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make
false.
            (symbolic_binding::symbolic_binding): Drop enum binding_kind.
            (symbolic_binding::hash): Likewise.
            (symbolic_binding::operator==): Likewise.
            (symbolic_binding::mark_deleted): New.
            (symbolic_binding::mark_empty): New.
            (symbolic_binding::is_deleted): New.
            (symbolic_binding::is_empty): New.
            (binding_map::remove_overlapping_bindings): New decl.
            (binding_map::get_overlapping_bindings): New decl.
            (binding_cluster::validate): New decl.
            (binding_cluster::bind): Drop enum binding_kind.
            (binding_cluster::fill_region): New decl.
            (binding_cluster::get_binding): Drop enum binding_kind.
            (binding_cluster::get_binding_recursive): Likewise.
            (binding_cluster::get_overlapping_bindings): Delete.
            (store::validate): New decl.
            (store::set_value): Drop enum binding_kind.
            (store::fill_region): New decl.
            (store_manager::get_concrete_binding): Drop enum binding_kind.
            (store_manager::get_symbolic_binding): Likewise.
            * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
            SK_BITS_WITHIN.
            (svalue::extract_bit_range): New.
            (svalue::maybe_fold_bits_within): New.
            (constant_svalue::maybe_fold_bits_within): New.
            (unknown_svalue::maybe_fold_bits_within): New.
            (unaryop_svalue::maybe_fold_bits_within): New.
            (repeated_svalue::repeated_svalue): New.
            (repeated_svalue::dump_to_pp): New.
            (repeated_svalue::accept): New.
            (repeated_svalue::all_zeroes_p): New.
            (repeated_svalue::maybe_fold_bits_within): New.
            (bits_within_svalue::bits_within_svalue): New.
            (bits_within_svalue::dump_to_pp): New.
            (bits_within_svalue::maybe_fold_bits_within): New.
            (bits_within_svalue::accept): New.
            (bits_within_svalue::implicitly_live_p): New.
            (compound_svalue::maybe_fold_bits_within): New.
            * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
            (svalue::dyn_cast_repeated_svalue): New.
            (svalue::dyn_cast_bits_within_svalue): New.
            (svalue::extract_bit_range): New decl.
            (svalue::maybe_fold_bits_within): New vfunc decl.
            (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
            (region_svalue::key_t::is_empty): Likewise.
            (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make
false.
            (constant_svalue::maybe_fold_bits_within): New.
            (unknown_svalue::maybe_fold_bits_within): New.
            (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
            (poisoned_svalue::key_t::is_empty): Likewise.
            (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
            false.
            (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
            (setjmp_svalue::key_t::is_empty): Likewise.
            (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
            false.
            (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
            (unaryop_svalue::key_t::is_empty): Likewise.
            (unaryop_svalue::maybe_fold_bits_within): New.
            (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
            false.
            (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
            (binop_svalue::key_t::is_empty): Likewise.
            (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
            false.
            (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
            (sub_svalue::key_t::is_empty): Likewise.
            (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
            false.
            (class repeated_svalue): New.
            (is_a_helper <const repeated_svalue *>::test): New.
            (struct default_hash_traits<repeated_svalue::key_t>): New.
            (class bits_within_svalue): New.
            (is_a_helper <const bits_within_svalue *>::test): New.
            (struct default_hash_traits<bits_within_svalue::key_t>): New.
            (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
            (widening_svalue::key_t::is_empty): Likewise.
            (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
            false.
            (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
            (compound_svalue::key_t::is_empty): Likewise.
            (compound_svalue::maybe_fold_bits_within): New.
            (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
            false.

    gcc/testsuite/ChangeLog:
            PR analyzer/95006
            * gcc.dg/analyzer/clobbers-1.c: New test.
            * gcc.dg/analyzer/clobbers-2.c: New test.
            * gcc.dg/analyzer/data-model-1.c (test_26): Mark xfail as fixed.
            (test_28): Likewise.
            (test_52): Likewise.  Add coverage for end of buffer.
            * gcc.dg/analyzer/explode-1.c: Add leak warning.
            * gcc.dg/analyzer/memset-1.c (test_3): Mark xfail as fixed.
            (test_4): Use char.  Mark xfail as fixed.
            (test_6b): New.
            (test_7): Mark xfail as fixed.  Add coverage for start of buffer.
            (test_8): New.
            (test_9): New.
            * gcc.dg/analyzer/memset-CVE-2017-18549-1.c: New test.
            * gcc.dg/analyzer/symbolic-8.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/95006] RFE: Reimplement -Wanalyzer-use-of-uninitialized-value

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95006

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:33255ad3ac14e3953750fe0f2d82b901c2852ff6

commit r12-2337-g33255ad3ac14e3953750fe0f2d82b901c2852ff6
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Jul 15 15:07:07 2021 -0400

    analyzer: reimplement -Wanalyzer-use-of-uninitialized-value [PR95006 et al]

    The initial gcc 10 era commit of the analyzer (in
    757bf1dff5e8cee34c0a75d06140ca972bfecfa7) had an implementation of
    -Wanalyzer-use-of-uninitialized-value, but was sufficiently buggy
    that I removed it in 78b9783774bfd3540f38f5b1e3c7fc9f719653d7 before
    the release of gcc 10.1

    This patch reintroduces the warning, heavily rewritten, with (I hope)
    a less buggy implementation this time, for GCC 12.

    gcc/analyzer/ChangeLog:
            PR analyzer/95006
            PR analyzer/94713
            PR analyzer/94714
            * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
            GIMPLE_ASSIGN case into...
            (get_diagnostic_tree_for_gassign_1): New.
            (get_diagnostic_tree_for_gassign): New.
            * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
            * analyzer.opt (Wanalyzer-write-to-string-literal): New.
            * constraint-manager.cc (class svalue_purger): New.
            (constraint_manager::purge_state_involving): New.
            * constraint-manager.h
            (constraint_manager::purge_state_involving): New.
            * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
            (dedupe_winners::handle_interactions): New.
            (diagnostic_manager::emit_saved_diagnostics): Call it.
            * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
            * engine.cc (impl_region_model_context::warn): Convert return type
            to bool.  Return false if the diagnostic isn't saved.
            (impl_region_model_context::purge_state_involving): New.
            (impl_sm_context::get_state): Use NULL ctxt when querying old
            rvalue.
            (impl_sm_context::set_next_state): Use new sval when querying old
            state.
            (class dump_path_diagnostic): Move to region-model.cc
            (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
            Remove call to purge_state_involving.
            (exploded_node::on_stmt_pre): New, based on the above.  Move most
            of it to region_model::on_stmt_pre.
            (exploded_node::on_stmt_post): Likewise, moving to
            region_model::on_stmt_post.
            (class stale_jmp_buf): Fix parent class to use curiously recurring
            template pattern.
            (feasibility_state::maybe_update_for_edge): Call on_call_pre and
            on_call_post on gcalls.
            * exploded-graph.h (impl_region_model_context::warn): Return bool.
            (impl_region_model_context::purge_state_involving): New decl.
            (exploded_node::on_stmt_pre): New decl.
            (exploded_node::on_stmt_post): New decl.
            * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
            (pending_diagnostic::supercedes_p): New.
            * program-state.cc (sm_state_map::get_state): Inherit state for
            conjured_svalue as well as initial_svalue.
            (sm_state_map::purge_state_involving): Also support SK_CONJURED.
            * region-model-impl-calls.cc (call_details::get_uncertainty):
            Handle m_ctxt being NULL.
            (call_details::get_or_create_conjured_svalue): New.
            (region_model::impl_call_fgets): New.
            (region_model::impl_call_fread): New.
            * region-model-manager.cc
            (region_model_manager::get_or_create_initial_value): Return an
            uninitialized poisoned value for regions that can't have initial
            values.
            * region-model-reachability.cc
            (reachable_regions::mark_escaped_clusters): Handle ctxt being
            NULL.
            * region-model.cc (region_to_value_map::purge_state_involving):
New.
            (poisoned_value_diagnostic::use_of_uninit_p): New.
            (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
            (poisoned_value_diagnostic::describe_final_event): Likewise.
            (region_model::check_for_poison): New.
            (region_model::on_assignment): Call it.
            (class dump_path_diagnostic): Move here from engine.cc.
            (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
            (region_model::on_call_pre): Move the setting of the LHS to a
            conjured svalue to before the checks for specific functions.
            Handle "fgets", "fgets_unlocked", and "fread".
            (region_model::purge_state_involving): New.
            (region_model::handle_unrecognized_call): Handle ctxt being NULL.
            (region_model::get_rvalue): Call check_for_poison.
            (selftest::test_stack_frames): Use NULL for context when getting
            uninitialized rvalue.
            (selftest::test_alloca): Likewise.
            * region-model.h (region_to_value_map::purge_state_involving): New
            decl.
            (call_details::get_or_create_conjured_svalue): New decl.
            (region_model::on_stmt_pre): New decl.
            (region_model::purge_state_involving): New decl.
            (region_model::impl_call_fgets): New decl.
            (region_model::impl_call_fread): New decl.
            (region_model::check_for_poison): New decl.
            (region_model_context::warn): Return bool.
            (region_model_context::purge_state_involving): New.
            (noop_region_model_context::warn): Return bool.
            (noop_region_model_context::purge_state_involving): New.
            (test_region_model_context:: warn): Return bool.
            * region.cc (region::get_memory_space): New.
            (region::can_have_initial_svalue_p): New.
            (region::involves_p): New.
            * region.h (enum memory_space): New.
            (region::get_memory_space): New decl.
            (region::can_have_initial_svalue_p): New decl.
            (region::involves_p): New decl.
            * sm-malloc.cc (use_after_free::supercedes_p): New.
            * store.cc (binding_cluster::purge_state_involving): New.
            (store::purge_state_involving): New.
            * store.h (class symbolic_binding): New forward decl.
            (binding_key::dyn_cast_symbolic_binding): New.
            (symbolic_binding::dyn_cast_symbolic_binding): New.
            (binding_cluster::purge_state_involving): New.
            (store::purge_state_involving): New.
            * svalue.cc (svalue::can_merge_p): Reject attempts to merge
            poisoned svalues with other svalues, so that we identify
            paths in which a variable is conditionally uninitialized.
            (involvement_visitor::visit_conjured_svalue): New.
            (svalue::involves_p): Also handle SK_CONJURED.
            (poison_kind_to_str): Handle POISON_KIND_UNINIT.
            (poisoned_svalue::maybe_fold_bits_within): New.
            * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
            (poisoned_svalue::maybe_fold_bits_within): New decl.

    gcc/ChangeLog:
            PR analyzer/95006
            PR analyzer/94713
            PR analyzer/94714
            * doc/invoke.texi: Add -Wanalyzer-use-of-uninitialized-value.

    gcc/testsuite/ChangeLog:
            PR analyzer/95006
            PR analyzer/94713
            PR analyzer/94714
            * g++.dg/analyzer/pr93212.C: Update location of warning.
            * g++.dg/analyzer/pr94011.C: Add
            -Wno-analyzer-use-of-uninitialized-value.
            * g++.dg/analyzer/pr94503.C: Likewise.
            * gcc.dg/analyzer/clobbers-1.c: Convert "f" from a local to a
            param to avoid uninitialized warning.
            * gcc.dg/analyzer/data-model-1.c (test_12): Add test for
            uninitialized value on result of alloca.
            (test_12a): Add expected warning.
            (test_12c): Likewise.
            (test_19): Likewise.
            (test_29b): Likewise.
            (test_29c): Likewise.
            (test_37): Remove xfail.
            (test_37a): Likewise.
            * gcc.dg/analyzer/data-model-20.c: Add warning about leak.
            * gcc.dg/analyzer/explode-2.c: Remove params; add
            -Wno-analyzer-too-complex, -Wno-analyzer-malloc-leak, and xfails.
            Initialize the locals.
            * gcc.dg/analyzer/explode-2a.c: Initialize the locals.  Add
            expected leak.
            * gcc.dg/analyzer/fgets-1.c: New test.
            * gcc.dg/analyzer/fread-1.c: New test.
            * gcc.dg/analyzer/malloc-1.c (test_16): Add expected warning.
            (test_40): Likewise.
            * gcc.dg/analyzer/memset-CVE-2017-18549-1.c: Check for
            uninitialized padding.
            * gcc.dg/analyzer/pr93355-localealias-feasibility.c (fread): New
            decl.
            (read_alias_file): Call it.
            * gcc.dg/analyzer/pr94047.c: Add expected warnings.
            * gcc.dg/analyzer/pr94851-2.c: Likewise.
            * gcc.dg/analyzer/pr96841.c: Convert local to a param.
            * gcc.dg/analyzer/pr98628.c: Likewise.
            * gcc.dg/analyzer/pr99042.c: Updated expected location of leak
            diagnostics.
            * gcc.dg/analyzer/symbolic-1.c: Add expected warnings.
            * gcc.dg/analyzer/symbolic-7.c: Likewise.
            * gcc.dg/analyzer/torture/pr93649.c: Add expected warning.  Skip
            with -fno-fat-lto-objects.
            * gcc.dg/analyzer/uninit-1.c: New test.
            * gcc.dg/analyzer/uninit-2.c: New test.
            * gcc.dg/analyzer/uninit-3.c: New test.
            * gcc.dg/analyzer/uninit-4.c: New test.
            * gcc.dg/analyzer/uninit-pr94713.c: New test.
            * gcc.dg/analyzer/uninit-pr94714.c: New test.
            * gcc.dg/analyzer/use-after-free-2.c: New test.
            * gcc.dg/analyzer/use-after-free-3.c: New test.
            * gcc.dg/analyzer/zlib-3.c: Add expected warning.
            * gcc.dg/analyzer/zlib-6.c: Convert locals to params to avoid
            uninitialized warnings.  Remove xfail.
            * gcc.dg/analyzer/zlib-6a.c: New test, based on the old version
            of the above.
            * gfortran.dg/analyzer/pr97668.f: Add
            -Wno-analyzer-use-of-uninitialized-value and
            -Wno-analyzer-too-complex.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/95006] RFE: Reimplement -Wanalyzer-use-of-uninitialized-value

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95006
Bug 95006 depends on bug 94713, which changed state.

Bug 94713 Summary: Analyzer is buggy on uninitialized pointer
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94713

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

[Bug analyzer/95006] RFE: Reimplement -Wanalyzer-use-of-uninitialized-value

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95006
Bug 95006 depends on bug 94714, which changed state.

Bug 94714 Summary: Analyzer: no warning on access of an uninitialized variable of automatic storage duration
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94714

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

[Bug analyzer/95006] RFE: Reimplement -Wanalyzer-use-of-uninitialized-value

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95006

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed on trunk for gcc 12 by the above patch.