analyzer: fix leak suppression at end of 'main' [PR101983]

PR analyzer/101983 reports what I thought were false positives
from -Wanalyzer-malloc-leak, but on closer inspection, the
analyzer is correctly reporting heap-allocated buffers that are
no longer reachable.

However, these "leaks" occur at the end of "main".  The analyzer already
has some logic to avoid reporting leaks at the end of main, where the
leak is detected at the end of the EXIT basic block.  However, in this case,
the leak is detected at the clobber in BB 2 here:
  <bb 2> :
  func (&res);
  res ={v} {CLOBBER(eol)};
  _4 = 0;

  <bb 3> :
<L0>:
  return _4;

where we have a chain BB 2 -> BB 3 -> EXIT BB.

This patch generalizes the "are we at the end of 'main'" detection to
handle such cases, silencing -Wanalyzer-malloc-leak on them.

There's a remaining issue where the analyzer unhelpfully describes one
of the leaking values as '<unknown>', rather than 'res.a', but I'm
leaving that for a followup (covered by PR analyzer/99771).

gcc/analyzer/ChangeLog:
	PR analyzer/101983
	* engine.cc (returning_from_function_p): New.
	(impl_region_model_context::on_state_leak): Use it when rejecting
	leaks at the return from "main".

gcc/testsuite/ChangeLog:
	PR analyzer/101983
	* gcc.dg/analyzer/pr101983-main.c: New test.
	* gcc.dg/analyzer/pr101983-not-main.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

diff --git a/gcc/analyzer/engine.cc b/gcc/analyzer/engine.cc
index 94c13d4e1cf12b90b749f8bb4ca1ac3d3439f4ef..8c3133e2444ec0056d75c0de9b7a89cc9a3f1fac 100644 (file)
--- a/gcc/analyzer/engine.cc
+++ b/gcc/analyzer/engine.cc
@@ -740,6 +740,51 @@ readability_comparator (const void *p1, const void *p2)
   return 0;
 }
 
+/* Return true is SNODE is the EXIT node of a function, or is one
+   of the final snodes within its function.
+
+   Specifically, handle the final supernodes before the EXIT node,
+   for the case of clobbers that happen immediately before exiting.
+   We need a run of snodes leading to the return_p snode, where all edges are
+   intraprocedural, and every snode has just one successor.
+
+   We use this when suppressing leak reports at the end of "main".  */
+
+static bool
+returning_from_function_p (const supernode *snode)
+{
+  if (!snode)
+    return false;
+
+  unsigned count = 0;
+  const supernode *iter = snode;
+  while (true)
+    {
+      if (iter->return_p ())
+       return true;
+      if (iter->m_succs.length () != 1)
+       return false;
+      const superedge *sedge = iter->m_succs[0];
+      if (sedge->get_kind () != SUPEREDGE_CFG_EDGE)
+       return false;
+      iter = sedge->m_dest;
+
+      /* Impose a limit to ensure we terminate for pathological cases.
+
+        We only care about the final 3 nodes, due to cases like:
+          BB:
+            (clobber causing leak)
+
+          BB:
+          <label>:
+          return _val;
+
+          EXIT BB.*/
+      if (++count > 3)
+       return false;
+    }
+}
+
 /* Find the best tree for SVAL and call SM's on_leak vfunc with it.
    If on_leak returns a pending_diagnostic, queue it up to be reported,
    so that we potentially complain about a leak of SVAL in the given STATE.  */
@@ -794,8 +839,7 @@ impl_region_model_context::on_state_leak (const state_machine &sm,
   gcc_assert (m_enode_for_diag);
 
   /* Don't complain about leaks when returning from "main".  */
-  if (m_enode_for_diag->get_supernode ()
-      && m_enode_for_diag->get_supernode ()->return_p ())
+  if (returning_from_function_p (m_enode_for_diag->get_supernode ()))
     {
       tree fndecl = m_enode_for_diag->get_function ()->decl;
       if (id_equal (DECL_NAME (fndecl), "main"))

diff --git a/gcc/testsuite/gcc.dg/analyzer/pr101983-main.c b/gcc/testsuite/gcc.dg/analyzer/pr101983-main.c
new file mode 100644 (file)
index 0000000..a84353b
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/pr101983-main.c
@@ -0,0 +1,38 @@
+/* { dg-additional-options "-Wno-analyzer-too-complex -fno-analyzer-call-summaries" } */
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdlib.h>
+
+struct list {
+       struct list* next;
+       void *a;
+};
+
+void func(struct list **res)
+{
+       struct list *cur = NULL;
+       do {
+               struct list *n = malloc(sizeof(struct list));
+               void *a = malloc(1);
+               if (n == NULL || a == NULL) {
+                       if (n != NULL) free(n);
+                       if (a != NULL) free(a);
+                       break;
+               }
+
+               if (cur == NULL) {
+                       *res = cur = n;
+               } else {
+                       cur->next = n;
+                       cur = n;
+               }
+               n->a = a;
+       } while (true);
+}
+
+int main()
+{
+       struct list *res;
+       func(&res);
+}

diff --git a/gcc/testsuite/gcc.dg/analyzer/pr101983-not-main.c b/gcc/testsuite/gcc.dg/analyzer/pr101983-not-main.c
new file mode 100644 (file)
index 0000000..fbf3a39
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/pr101983-not-main.c
@@ -0,0 +1,40 @@
+/* { dg-additional-options "-Wno-analyzer-too-complex -fno-analyzer-call-summaries" } */
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdlib.h>
+
+struct list {
+       struct list* next;
+       void *a;
+};
+
+void func(struct list **res)
+{
+       struct list *cur = NULL;
+       do {
+               struct list *n = malloc(sizeof(struct list));
+               void *a = malloc(1);
+               if (n == NULL || a == NULL) {
+                       if (n != NULL) free(n);
+                       if (a != NULL) free(a);
+                       break;
+               }
+
+               if (cur == NULL) {
+                       *res = cur = n;
+               } else {
+                       cur->next = n;
+                       cur = n;
+               }
+               n->a = a;
+       } while (true);
+}
+
+int not_main()
+{
+       struct list *res;
+       func(&res);
+} /* { dg-warning "leak of 'res'" "leak of res" } */
+/* { dg-warning "leak of '<unknown>'" "leak of res->a" { target *-*-* } .-1 } */
+/* TODO: we should emit 'res->a' rather than '<unknown>' here.  */