analyzer: Handle nonnull_if_nonzero attribute [PR117023]

On top of the
https://gcc.gnu.org/pipermail/gcc-patches/2024-November/668554.html
patch which introduces the nonnull_if_nonzero attribute (because
C2Y is allowing NULL arguments on various calls like memcpy, memset,
strncpy etc. as long as the count is 0) the following patch adds just
limited handling of the attribute in the analyzer.

For nonnull attribute(s) we have the get_nonnull_args helper which
returns a bitmap, for nonnull_if_nonzero a function would need to
return a hash_map or something similar, I think it is better to
handle the attributes one by one.  This patch just handles the
non-zero INTEGER_CST (integer_nonzerop) count arguments, in other places
the above patch uses ranger to some extent, but I'm not familiar enough
with the analyzer to know if one can use the ranger, or should somehow
explain in data structures the conditional nature of the nonnull property,
the argument is nonnull only if some other argument is nonzero.

Also, analyzer uses get_nonnull_args in another spot when entering a frame,
not sure if anything can be done there (note the conditional nonnull
somehow, pass from callers if the argument is nonzero, ...).

Note, the testsuite changes aren't strictly necessary with just
the above and this patch, but will be with a patch I'm going to post
soon.

2025-02-24  Jakub Jelinek  <jakub@redhat.com>

	PR c/117023
gcc/analyzer/
	* sm-malloc.cc (malloc_state_machine::handle_nonnull): New private
	method.
	(malloc_state_machine::on_stmt): Use it for nonnull attribute arguments.
	Handle also nonnull_if_nonzero attributes.
gcc/testsuite/
	* c-c++-common/analyzer/call-summaries-malloc.c
	(test_use_without_check): Pass 4 rather than sz to memset.
	* c-c++-common/analyzer/strncpy-1.c (test_null_dst,
	test_null_src): Pass 42 rather than count to strncpy.

2 files changed, 3 insertions, 3 deletions

diff --git a/gcc/testsuite/c-c++-common/analyzer/call-summaries-malloc.c b/gcc/testsuite/c-c++-common/analyzer/call-summaries-malloc.c
index 6522c37..d9d9ced 100644
--- a/gcc/testsuite/c-c++-common/analyzer/call-summaries-malloc.c
+++ b/gcc/testsuite/c-c++-common/analyzer/call-summaries-malloc.c
@@ -67,7 +67,7 @@ void test_use_after_free (void)
 void test_use_without_check (size_t sz)
 {
   char *buf = (char *) wrapped_malloc (sz); /* { dg-message "this call could return NULL" } */
-  memset (buf, 'x', sz); /* { dg-warning "use of possibly-NULL 'buf' where non-null expected" } */
+  memset (buf, 'x', 4); /* { dg-warning "use of possibly-NULL 'buf' where non-null expected" } */
   wrapped_free (buf);
 }
 
diff --git a/gcc/testsuite/c-c++-common/analyzer/strncpy-1.c b/gcc/testsuite/c-c++-common/analyzer/strncpy-1.c
index 8edaf26..f8b38a5 100644
--- a/gcc/testsuite/c-c++-common/analyzer/strncpy-1.c
+++ b/gcc/testsuite/c-c++-common/analyzer/strncpy-1.c
@@ -20,13 +20,13 @@ test_passthrough (char *dst, const char *src, size_t count)
 char *
 test_null_dst (const char *src, size_t count)
 {
-  return strncpy (NULL, src, count); /* { dg-warning "use of NULL where non-null expected" } */
+  return strncpy (NULL, src, 42); /* { dg-warning "use of NULL where non-null expected" } */
 }
 
 char *
 test_null_src (char *dst, size_t count)
 {
-  return strncpy (dst, NULL, count); /* { dg-warning "use of NULL where non-null expected" } */
+  return strncpy (dst, NULL, 42); /* { dg-warning "use of NULL where non-null expected" } */
 }
 
 void