analyzer: fix false leaks when writing through unknown ptrs [PR97072]

gcc/analyzer/ChangeLog:
	PR analyzer/97072
	* region-model-reachability.cc (reachable_regions::init_cluster):
	Convert symbolic region handling to a switch statement.  Add cases
	to handle SK_UNKNOWN and SK_CONJURED.

gcc/testsuite/ChangeLog:
	PR analyzer/97072
	* gcc.dg/analyzer/pr97072.c: New test.

diff --git a/gcc/analyzer/region-model-reachability.cc b/gcc/analyzer/region-model-reachability.cc
index daf785254ea9d47a85e9a26adfdc86376c9a5f19..a988ffc14399a256443908574289aa255ac0e723 100644 (file)
--- a/gcc/analyzer/region-model-reachability.cc
+++ b/gcc/analyzer/region-model-reachability.cc
@@ -88,20 +88,38 @@ reachable_regions::init_cluster (const region *base_reg)
   if (m_store->escaped_p (base_reg))
     add (base_reg, true);
 
-  /* If BASE_REG is *INIT_VAL(REG) for some other REG, see if REG is
-     unbound and untouched.  If so, then add BASE_REG as a root.  */
   if (const symbolic_region *sym_reg = base_reg->dyn_cast_symbolic_region ())
     {
       const svalue *ptr = sym_reg->get_pointer ();
-      if (const initial_svalue *init_sval = ptr->dyn_cast_initial_svalue ())
+      switch (ptr->get_kind ())
        {
-         const region *init_sval_reg = init_sval->get_region ();
-         const region *other_base_reg = init_sval_reg->get_base_region ();
-         const binding_cluster *other_cluster
-           = m_store->get_cluster (other_base_reg);
-         if (other_cluster == NULL
-             || !other_cluster->touched_p ())
+       default:
+         break;
+       case SK_INITIAL:
+         {
+           /* If BASE_REG is *INIT_VAL(REG) for some other REG, see if REG is
+              unbound and untouched.  If so, then add BASE_REG as a root.  */
+           const initial_svalue *init_sval
+             = as_a <const initial_svalue *> (ptr);
+           const region *init_sval_reg = init_sval->get_region ();
+           const region *other_base_reg = init_sval_reg->get_base_region ();
+           const binding_cluster *other_cluster
+             = m_store->get_cluster (other_base_reg);
+           if (other_cluster == NULL
+               || !other_cluster->touched_p ())
+             add (base_reg, true);
+         }
+         break;
+
+       case SK_UNKNOWN:
+       case SK_CONJURED:
+         {
+           /* If this cluster is due to dereferencing an unknown/conjured
+              pointer, any values written through the pointer could still
+              be live.  */
            add (base_reg, true);
+         }
+         break;
        }
     }
 }

diff --git a/gcc/testsuite/gcc.dg/analyzer/pr97072.c b/gcc/testsuite/gcc.dg/analyzer/pr97072.c
new file mode 100644 (file)
index 0000000..4024124
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/pr97072.c
@@ -0,0 +1,9 @@
+void unknown_fn_1 (void *);
+
+void test_1 (int co, int y)
+{
+  void *p = __builtin_malloc (1024);
+  void **q;
+  unknown_fn_1 (&q);
+  *q = p;
+}