From 0c652ebbf79bd168766097f3ac4c1b3b79d68a43 Mon Sep 17 00:00:00 2001 From: David Malcolm Date: Wed, 22 Mar 2023 08:40:34 -0400 Subject: analyzer: fix false +ves from -Wanalyzer-deref-before-check due to inlining [PR109239] The patch has this effect on my integration tests of -fanalyzer: Comparison: GOOD: 129 (17.70% -> 17.92%) BAD: 600 -> 591 (-9) which is purely due to improvements to -Wanalyzer-deref-before-check on the Linux kernel: -Wanalyzer-deref-before-check: GOOD: 1 (4.55% -> 7.69%) BAD: 21 -> 12 (-9) Known false positives: 16 -> 10 (-6) linux-5.10.162: 7 -> 1 (-6) Suspected false positives: 3 -> 0 (-3) linux-5.10.162: 3 -> 0 (-3) gcc/analyzer/ChangeLog: PR analyzer/109239 * program-point.cc: Include "analyzer/inlining-iterator.h". (program_point::effectively_intraprocedural_p): New function. * program-point.h (program_point::effectively_intraprocedural_p): New decl. * sm-malloc.cc (deref_before_check::emit): Use it when rejecting interprocedural cases, so that we reject interprocedural cases that have become intraprocedural due to inlining. gcc/testsuite/ChangeLog: PR analyzer/109239 * gcc.dg/analyzer/deref-before-check-pr109239-linux-bus.c: New test. Signed-off-by: David Malcolm --- gcc/analyzer/program-point.cc | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) (limited to 'gcc/analyzer/program-point.cc') diff --git a/gcc/analyzer/program-point.cc b/gcc/analyzer/program-point.cc index 0ab55fa..f2d6490 100644 --- a/gcc/analyzer/program-point.cc +++ b/gcc/analyzer/program-point.cc @@ -52,6 +52,7 @@ along with GCC; see the file COPYING3. If not see #include "shortest-paths.h" #include "analyzer/exploded-graph.h" #include "analyzer/analysis-plan.h" +#include "analyzer/inlining-iterator.h" #if ENABLE_ANALYZER @@ -719,6 +720,47 @@ program_point::get_next () const } } +/* Return true iff POINT_A and POINT_B share the same function and + call_string, both directly, and when attempting to undo inlining + information. */ + +bool +program_point::effectively_intraprocedural_p (const program_point &point_a, + const program_point &point_b) +{ + /* First, compare without considering inlining info. */ + if (point_a.get_function () + != point_b.get_function ()) + return false; + if (&point_a.get_call_string () + != &point_b.get_call_string ()) + return false; + + /* Consider inlining info; they must have originally come from + the same function and have been inlined in the same way. */ + location_t loc_a = point_a.get_location (); + location_t loc_b = point_b.get_location (); + inlining_iterator iter_a (loc_a); + inlining_iterator iter_b (loc_b); + while (!(iter_a.done_p () || iter_b.done_p ())) + { + if (iter_a.done_p () || iter_b.done_p ()) + return false; + + if (iter_a.get_fndecl () != iter_b.get_fndecl ()) + return false; + if (iter_a.get_callsite () != iter_b.get_callsite ()) + return false; + if (iter_a.get_block () != iter_b.get_block ()) + return false; + + iter_a.next (); + iter_b.next (); + } + + return true; +} + #if CHECKING_P namespace selftest { -- cgit v1.1