analyzer: fix leak suppression at end of 'main' [PR101983]
authorDavid Malcolm <dmalcolm@redhat.com>
Mon, 7 Mar 2022 19:19:30 +0000 (14:19 -0500)
committerDavid Malcolm <dmalcolm@redhat.com>
Mon, 7 Mar 2022 19:19:30 +0000 (14:19 -0500)
commit0af37ad4422052be4b7f779737e14c80e57d0ad9
treea158d8cba01a01d7529b311ca8f0da57849c0917
parente3ca3e7993696affe95a3ea24c2b133c14a056e4
analyzer: fix leak suppression at end of 'main' [PR101983]

PR analyzer/101983 reports what I thought were false positives
from -Wanalyzer-malloc-leak, but on closer inspection, the
analyzer is correctly reporting heap-allocated buffers that are
no longer reachable.

However, these "leaks" occur at the end of "main".  The analyzer already
has some logic to avoid reporting leaks at the end of main, where the
leak is detected at the end of the EXIT basic block.  However, in this case,
the leak is detected at the clobber in BB 2 here:
  <bb 2> :
  func (&res);
  res ={v} {CLOBBER(eol)};
  _4 = 0;

  <bb 3> :
<L0>:
  return _4;

where we have a chain BB 2 -> BB 3 -> EXIT BB.

This patch generalizes the "are we at the end of 'main'" detection to
handle such cases, silencing -Wanalyzer-malloc-leak on them.

There's a remaining issue where the analyzer unhelpfully describes one
of the leaking values as '<unknown>', rather than 'res.a', but I'm
leaving that for a followup (covered by PR analyzer/99771).

gcc/analyzer/ChangeLog:
PR analyzer/101983
* engine.cc (returning_from_function_p): New.
(impl_region_model_context::on_state_leak): Use it when rejecting
leaks at the return from "main".

gcc/testsuite/ChangeLog:
PR analyzer/101983
* gcc.dg/analyzer/pr101983-main.c: New test.
* gcc.dg/analyzer/pr101983-not-main.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>
gcc/analyzer/engine.cc
gcc/testsuite/gcc.dg/analyzer/pr101983-main.c [new file with mode: 0644]
gcc/testsuite/gcc.dg/analyzer/pr101983-not-main.c [new file with mode: 0644]