analyzer: fix ICE with incorrect lookup of cgraph node [PR105074]

gcc/analyzer/ChangeLog:
	PR analyzer/105074
	* region.cc (ipa_ref_requires_tracking): Drop "context_fndecl",
	instead using the ref->referring to get the cgraph node of the
	caller.
	(symnode_requires_tracking_p): Likewise.

gcc/testsuite/ChangeLog:
	PR analyzer/105074
	* gcc.dg/analyzer/pr105074.c: New test.
	* gcc.dg/analyzer/untracked-1.c (extern_fn_char_ptr): New decl.
	(test_13): New.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

3 files changed, 22 insertions, 6 deletions

diff --git a/gcc/analyzer/region.cc b/gcc/analyzer/region.cc
index 9c9e043..749e618 100644
--- a/gcc/analyzer/region.cc
+++ b/gcc/analyzer/region.cc
@@ -1168,11 +1168,10 @@ decl_region::get_svalue_for_initializer (region_model_manager *mgr) const
 }
 
 /* Subroutine of symnode_requires_tracking_p; return true if REF
-   within CONTEXT_FNDECL might imply that we should be tracking the
-   value of a decl.  */
+   might imply that we should be tracking the value of its decl.  */
 
 static bool
-ipa_ref_requires_tracking (const ipa_ref *ref, tree context_fndecl)
+ipa_ref_requires_tracking (ipa_ref *ref)
 {
   /* If we have a load/store/alias of the symbol, then we'll track
      the decl's value.  */
@@ -1188,8 +1187,10 @@ ipa_ref_requires_tracking (const ipa_ref *ref, tree context_fndecl)
       return true;
     case GIMPLE_CALL:
       {
-	cgraph_node *context_cnode = cgraph_node::get (context_fndecl);
-	cgraph_edge *edge = context_cnode->get_edge (ref->stmt);
+	cgraph_node *caller_cnode = dyn_cast <cgraph_node *> (ref->referring);
+	if (caller_cnode == NULL)
+	  return true;
+	cgraph_edge *edge = caller_cnode->get_edge (ref->stmt);
 	if (!edge)
 	  return true;
 	if (edge->callee == NULL)
@@ -1232,7 +1233,7 @@ symnode_requires_tracking_p (symtab_node *symnode)
   if (TREE_CODE (context_fndecl) != FUNCTION_DECL)
     return true;
   for (auto ref : symnode->ref_list.referring)
-    if (ipa_ref_requires_tracking (ref, context_fndecl))
+    if (ipa_ref_requires_tracking (ref))
       return true;
 
   /* If we get here, then we don't have uses of this decl that require
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr105074.c b/gcc/testsuite/gcc.dg/analyzer/pr105074.c
new file mode 100644
index 0000000..2735854
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/pr105074.c
@@ -0,0 +1,9 @@
+/* { dg-additional-options "-O2 -fdump-analyzer-untracked" } */
+
+void _gnutls_log(const char *);
+static void _gnutls_ocsp_verify_mandatory_stapling(void) {
+  _gnutls_log(__func__); /* { dg-warning "track '__func__': no" } */
+}
+void check_ocsp_response_gnutls_x509_cert_verify_peers(void) {
+  _gnutls_ocsp_verify_mandatory_stapling();
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/untracked-1.c b/gcc/testsuite/gcc.dg/analyzer/untracked-1.c
index b7536c3..d07c297 100644
--- a/gcc/testsuite/gcc.dg/analyzer/untracked-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/untracked-1.c
@@ -11,6 +11,7 @@ typedef struct boxed_int { int value; } boxed_int;
 extern void extern_fn (struct st *);
 static void __attribute__((noinline)) internal_fn (struct st *) {}
 extern int extern_get_int (void);
+extern void extern_fn_char_ptr (const char *);
 
 void test_0 (void)
 {
@@ -97,3 +98,8 @@ int test_12 (void (*fnptr) (struct st *))
   static struct st s12 = { __FILE__, __LINE__ }; /* { dg-warning "track 's12': yes" } */
   fnptr (&s12);
 }
+
+void test_13 (void)
+{
+  extern_fn_char_ptr (__func__); /* { dg-warning "track '__func__': no" } */
+}