analyzer: fixes to side-effects for built-in functions [PR107565]

Previously, if the analyzer saw a call to a non-pure and non-const
built-in function that it didn't have explicit knowledge of the behavior
of, it would fall back to assuming that the builtin could have arbitrary
behavior, similar to a function defined outside of the current TU.

However, this only worked for BUILTIN_NORMAL functions that matched
gimple_builtin_call_types_compatible_p; for BUILT_IN_FRONTEND and
BUILT_IN_MD, and for mismatched types the analyzer would erroneously
assume that the builtin had no side-effects, leading e.g. to
PR analyzer/107565, where the analyzer falsely reported that x
was still uninitialized after this target-specific builtin:

  _1 = __builtin_ia32_rdrand64_step (&x);

This patch generalizes the handling to cover all classes of builtin,
fixing the above false positive.

Unfortunately this patch regresses gcc.dg/analyzer/pr99716-1.c due to
the:
  fprintf (fp, "hello");
being optimized to:
   __builtin_fwrite ("hello", 1, (ssizetype)5, fp_6);
and the latter has gimple_builtin_call_types_compatible_p return false,
whereas the original call had it return true.  I'm assuming that this is
an optimization bug, and have filed it as PR middle-end/108988.  The
effect on the analyzer is that it fails to recognize the call to
__builtin_fwrite and instead assumes arbitraty side-effects (including
that it could call fclose on fp, hence the report about the leak goes
away).

I tried various more involved fixes with new heuristics for handling
built-ins that aren't explicitly covered by the analyzer, but those
fixes tended to introduce many more regressions, so I'm going with this
simpler fix.

gcc/analyzer/ChangeLog:
	PR analyzer/107565
	* region-model.cc (region_model::on_call_pre): Flatten logic by
	returning early.  Consolidate logic for detecting const and pure
	functions.  When considering whether an unhandled built-in
	function has side-effects, consider all kinds of builtin, rather
	than just BUILT_IN_NORMAL, and don't require
	gimple_builtin_call_types_compatible_p.

gcc/testsuite/ChangeLog:
	PR analyzer/107565
	* gcc.dg/analyzer/builtins-pr107565.c: New test.
	* gcc.dg/analyzer/pr99716-1.c (test_2): Mark the leak as xfailing.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

0 files changed, 0 insertions, 0 deletions