[Bug analyzer/96894] New: Analyzer assumes pointer is NULL, even if pointer was tested to be non-null before

[Bug analyzer/96894] New: Analyzer assumes pointer is NULL, even if pointer was tested to be non-null before

[vries at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96894

            Bug ID: 96894
           Summary: Analyzer assumes pointer is NULL, even if pointer was
                    tested to be non-null before
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: vries at gcc dot gnu.org
  Target Milestone: ---

Created attachment 49174
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=49174&action=edit
fibheap.c, preprocessed version from gdb/binutils master

Using gcc-11 (SUSE Linux) 11.0.0 20200901 (experimental) [revision
b1850c617b14eedaf60b358f3b7d4707cff73b8a].

Invoked like this:
...
$ gcc-11 fibheap.c -fanalyzer -S
...

We have:
...
fibheap.c: In function ‘fibnode_remove’:
fibheap.c:3122:42: warning: dereference of NULL ‘*(node).parent’ [CWE-690]
[-Wanalyzer-null-dereference]
 3122 |                           && node->parent->child == node)
      |                              ~~~~~~~~~~~~^~~~~~~
...

Looking at the source code, we have:
...
  3118    if (node->parent !=
  3119
  3120                       ((void *)0)
  3121
  3122                            && node->parent->child == node)
  3123      node->parent->child = ret;
...

So, just before dereferencing node->parent, we check that it's non-null, so the
warning that node->parent is dereferenced while it's null makes no sense.

[Bug analyzer/96894] Analyzer assumes pointer is NULL, even if pointer was tested to be non-null before

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96894

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2020-09-02
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this; confirmed.

[Bug analyzer/96894] Analyzer assumes pointer is NULL, even if pointer was tested to be non-null before

[dimhen at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96894

Dmitry G. Dyachenko <dimhen at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dimhen at gmail dot com

--- Comment #2 from Dmitry G. Dyachenko <dimhen at gmail dot com> ---
gcc version 11.0.0 20210212 (experimental) [master revision
0c27fe96f81:d6ccd7dde1c:8c4137c7ead515baaf1ac8340edeb3a442388b5b]

PASS for me

[Bug analyzer/96894] State explosion on gdb's fibheap.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96894

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Analyzer assumes pointer is |State explosion on gdb's
                   |NULL, even if pointer was   |fibheap.c
                   |tested to be non-null       |
                   |before                      |

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
I'm not seeing the false positive any more with trunk.

Enabling -Wanalyzer-too-complex shows that the analyzer is still safety limits
and stopping (both per-program-point limits and the overall node limit).

If I bump up the limits, it fully explores the egraph, without showing any
diagnostics:

./xgcc -B. -S -fanalyzer ../../src/pr96894.c \
  -Wanalyzer-too-complex \
  --param analyzer-max-enodes-per-program-point=200 \
  --param analyzer-bb-explosion-factor=50

So it appears that the false positive from -Wanalyzer-null-dereference is
fixed, but there's some kind of state explosion bug going on; we ought to be
able to explore this file without hitting the safety limits.

Retitling this bug accordingly

[Bug analyzer/96894] State explosion on gdb's fibheap.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96894

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |99390

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
The warnings from -Wanalyzer-too-complex show some deeply nested callstrings
e.g.:

./xgcc -B. -S -fanalyzer ../../src/pr96894.c   -Wanalyzer-too-complex --param
analyzer-bb-explosion-factor=50
../../src/pr96894.c: In function ‘fibheap_consolidate’:
../../src/pr96894.c:3011:23: warning: terminating analysis for this program
point: callstring: [(SN: 89 -> SN: 97 in fibheap_delete), (SN: 59 -> SN: 86 in
fibheap_extr_min_node)] before (SN: 56 stmt: 0):  i_34 = i_16 + 1;EN: 2004, EN:
2014, EN: 2143, EN: 2157, EN: 2275, EN: 2363, EN: 2424, EN: 2697
[-Wanalyzer-too-complex]
 3011 |   for (i = 0; i < D; i++)
      |                      ~^~
../../src/pr96894.c:3011:23: warning: terminating analysis for this program
point: callstring: [(SN: 89 -> SN: 97 in fibheap_delete), (SN: 59 -> SN: 86 in
fibheap_extr_min_node)] before (SN: 56 stmt: 0):  i_34 = i_16 + 1;EN: 2004, EN:
2014, EN: 2143, EN: 2157, EN: 2275, EN: 2363, EN: 2424, EN: 2697
[-Wanalyzer-too-complex]
../../src/pr96894.c:3011:23: warning: terminating analysis for this program
point: callstring: [(SN: 144 -> SN: 106 in fibheap_delete_node), (SN: 89 -> SN:
141 in fibheap_extract_min), (SN: 59 -> SN: 86 in fibheap_extr_min_node)]
before (SN: 56 stmt: 0):  i_34 = i_16 + 1;EN: 4777, EN: 4787, EN: 4916, EN:
4930, EN: 5048, EN: 5136, EN: 5197, EN: 6058 [-Wanalyzer-too-complex]
../../src/pr96894.c:3011:23: warning: terminating analysis for this program
point: callstring: [(SN: 144 -> SN: 106 in fibheap_delete_node), (SN: 89 -> SN:
141 in fibheap_extract_min), (SN: 59 -> SN: 86 in fibheap_extr_min_node)]
before (SN: 56 stmt: 0):  i_34 = i_16 + 1;EN: 4777, EN: 4787, EN: 4916, EN:
4930, EN: 5048, EN: 5136, EN: 5197, EN: 6058 [-Wanalyzer-too-complex]

so this is likely an issue with call summarization failing.  Adding to call
summaries tracker.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99390
[Bug 99390] [meta-bug] tracker bug for call summaries in -fanalyzer