analyzer: add svalue::can_have_associated_state_p [PR101503]

PR analyzer/101503 reports an assertion failure due to an unexpected
"UNKNOWN" value (due to using --param analyzer-max-svalue-depth=0).

This patch fixes this by rejecting attempts to purge state involving
unknown/poisoned svalues (in region_model::purge_state_involving),
as these svalues should not have state associated with them - they
are singletons w.r.t each type.

To be more systematic about this, the patch also introduces a new
svalue::can_have_associated_state_p which returns false for
unknown/poisoned svalues, so that we can reject adding constraints
or sm-state on them, or building various kinds of svalue in terms
of them (e.g. unary ops, binary ops, etc).

gcc/analyzer/ChangeLog:
	PR analyzer/101503
	* constraint-manager.cc (constraint_manager::add_constraint): Use
	can_have_associated_state_p rather than testing for unknown.
	(constraint_manager::get_or_add_equiv_class): Likewise.
	* program-state.cc (sm_state_map::set_state): Likewise.
	(sm_state_map::impl_set_state): Add assertion.
	* region-model-manager.cc
	(region_model_manager::maybe_fold_unaryop): Handle poisoned
	values.
	(region_model_manager::maybe_fold_binop): Move handling of unknown
	values...
	(region_model_manager::get_or_create_binop): ...to here, and
	generalize to use can_have_associated_state_p.
	(region_model_manager::maybe_fold_sub_svalue): Use
	can_have_associated_state_p rather than testing for unknown.
	(region_model_manager::maybe_fold_repeated_svalue): Use unknown
	when the size or repeated value is "unknown"/"poisoned".
	* region-model.cc (region_model::purge_state_involving): Reject
	attempts to purge unknown/poisoned svalues, as these svalues
	should not have state associated with them.
	* svalue.cc (sub_svalue::sub_svalue): Assert that we're building
	on top of an svalue with can_have_associated_state_p.
	(repeated_svalue::repeated_svalue): Likewise.
	(bits_within_svalue::bits_within_svalue): Likewise.
	* svalue.h (svalue::can_have_associated_state_p): New.
	(unknown_svalue::can_have_associated_state_p): New.
	(poisoned_svalue::can_have_associated_state_p): New.
	(unaryop_svalue::unaryop_svalue): Assert that we're building on
	top of an svalue with can_have_associated_state_p.
	(binop_svalue::binop_svalue): Likewise.
	(widening_svalue::widening_svalue): Likewise.

gcc/testsuite/ChangeLog:
	PR analyzer/101503
	* gcc.dg/analyzer/pr101503.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

1 files changed, 4 insertions, 2 deletions

diff --git a/gcc/analyzer/program-state.cc b/gcc/analyzer/program-state.cc
index ccfe7b0..5bb8676 100644
--- a/gcc/analyzer/program-state.cc
+++ b/gcc/analyzer/program-state.cc
@@ -453,8 +453,8 @@ sm_state_map::set_state (region_model *model,
   if (model == NULL)
     return;
 
-  /* Reject attempts to set state on UNKNOWN.  */
-  if (sval->get_kind () == SK_UNKNOWN)
+  /* Reject attempts to set state on UNKNOWN/POISONED.  */
+  if (!sval->can_have_associated_state_p ())
     return;
 
   equiv_class &ec = model->get_constraints ()->get_equiv_class (sval);
@@ -492,6 +492,8 @@ sm_state_map::impl_set_state (const svalue *sval,
   if (get_state (sval, ext_state) == state)
     return false;
 
+  gcc_assert (sval->can_have_associated_state_p ());
+
   /* Special-case state 0 as the default value.  */
   if (state == 0)
     {