analyzer: fix false leak reports when merging states [PR97074]

gcc/analyzer/ChangeLog:
	PR analyzer/97074
	* store.cc (binding_cluster::can_merge_p): Add "out_store" param
	and pass to calls to binding_cluster::make_unknown_relative_to.
	(binding_cluster::make_unknown_relative_to): Add "out_store"
	param.  Use it to mark base regions that are pointed to by
	pointers that become unknown as having escaped.
	(store::can_merge_p): Pass out_store to
	binding_cluster::can_merge_p.
	* store.h (binding_cluster::can_merge_p): Add "out_store" param.
	(binding_cluster::make_unknown_relative_to): Likewise.
	* svalue.cc (region_svalue::implicitly_live_p): New vfunc.
	* svalue.h (region_svalue::implicitly_live_p): New vfunc decl.

gcc/testsuite/ChangeLog:
	PR analyzer/97074
	* gcc.dg/analyzer/pr97074.c: New test.

1 files changed, 16 insertions, 0 deletions

diff --git a/gcc/analyzer/svalue.cc b/gcc/analyzer/svalue.cc
index b2d98cf..5bbd05e 100644
--- a/gcc/analyzer/svalue.cc
+++ b/gcc/analyzer/svalue.cc
@@ -509,6 +509,22 @@ region_svalue::accept (visitor *v) const
   m_reg->accept (v);
 }
 
+/* Implementation of svalue::implicitly_live_p vfunc for region_svalue.  */
+
+bool
+region_svalue::implicitly_live_p (const svalue_set &,
+				  const region_model *model) const
+{
+  /* Pointers into clusters that have escaped should be treated as live.  */
+  const region *base_reg = get_pointee ()->get_base_region ();
+  const store *store = model->get_store ();
+  if (const binding_cluster *c = store->get_cluster (base_reg))
+    if (c->escaped_p ())
+	return true;
+
+  return false;
+}
+
 /* Evaluate the condition LHS OP RHS.
    Subroutine of region_model::eval_condition for when we have a pair of
    pointers.  */