The analyzer follows branches that are incompatible (sometimes). Code to reproduce the bug: [[gnu::nonnull]] static void init_x(int cond, int **x, int *y) { if (!cond) return; *x = y; } int foo(int cond) { int *x; int y = 7; if (cond < 2) return -1; /* cond >= 2 != 0, so it will initialize x */ init_x(cond, &x, &y); return *x; } $ gcc-10 -c false_positive.c -o foo -fanalyzer In function ‘foo’: false_positive.c:22:9: warning: use of uninitialized value ‘x’ [CWE-457] [-Wanalyzer-use-of-uninitialized-value] 22 | return *x; | ^~ ‘foo’: events 1-4 | | 11 | int foo(int cond) | | ^~~ | | | | | (1) entry to ‘foo’ |...... | 16 | if (cond < 2) | | ~ | | | | | (2) following ‘false’ branch (when ‘cond > 1’)... |...... | 20 | init_x(cond, &x, &y); | | ~~~~~~~~~~~~~~~~~~~~ | | | | | (3) ...to here | | (4) calling ‘init_x’ from ‘foo’ | +--> ‘init_x’: events 5-7 | | 3 | void init_x(int cond, int **x, int *y) | | ^~~~~~ | | | | | (5) entry to ‘init_x’ |...... | 6 | if (!cond) | | ~ | | | | | (6) following ‘true’ branch (when ‘cond == 0’)... !!! cond == 0, but previously it assumed cond > 1 !!! | 7 | return; | | ~~~~~~ | | | | | (7) ...to here | <------+ | ‘foo’: events 8-9 | | 20 | init_x(cond, &x, &y); | | ^~~~~~~~~~~~~~~~~~~~ | | | | | (8) returning to ‘foo’ from ‘init_x’ | 21 | | 22 | return *x; | | ~~ | | | | | (9) use of uninitialized value ‘x’ here | $ ___________________________________________________ But. - If I copy&paste (manual inline) `init_x` code inside `foo`, the warning goes away. - If I use pointers instead of double pointers (`void init_x(int cond, int *x, int y)`), the warning goes away.
__builin_unreachable() helped silencing that specific bug, as a temporary workaround: [[gnu::nonnull]] static int init_x(int cond, int **x, int *y) { if (!cond) return -1; *x = y; return 0; } int foo(int cond) { int *x; int y = 7; if (cond < 2) return -1; /* cond >= 2 != 0, so it will initialize x and return 0 */ if (init_x(cond, &x, &y)) __builtin_unreachable(); return *x; }
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>: https://gcc.gnu.org/g:78b9783774bfd3540f38f5b1e3c7fc9f719653d7 commit r10-8012-g78b9783774bfd3540f38f5b1e3c7fc9f719653d7 Author: David Malcolm <dmalcolm@redhat.com> Date: Thu Apr 23 21:31:22 2020 -0400 analyzer: remove -Wanalyzer-use-of-uninitialized-value for GCC 10 From what I can tell -Wanalyzer-use-of-uninitialized-value has not yet found a true diagnostic in real-world code, and seems to be particularly susceptible to false positives. These relate to bugs in the region_model code. For GCC 10 it seems best to remove this warning, which this patch does. Internally it also removes POISON_KIND_UNINIT. I'm working on a rewrite of the region_model code for GCC 11 that I hope will fix these issues, and allow this warning to be reintroduced. gcc/analyzer/ChangeLog: PR analyzer/94447 PR analyzer/94639 PR analyzer/94732 PR analyzer/94754 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete. * program-state.cc (selftest::test_program_state_dumping): Update expected dump result for removal of "uninit". * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT case. (root_region::ensure_stack_region): Initialize stack with null svalue_id rather than with a typeless POISON_KIND_UNINIT value. (root_region::ensure_heap_region): Likewise for the heap. (region_model::dump_summary_of_rep_path_vars): Remove summarization of uninit values. (region_model::validate): Remove check that the stack has a POISON_KIND_UNINIT value. (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT case. (poisoned_value_diagnostic::describe_final_event): Likewise. (selftest::test_dump): Update expected dump result for removal of "uninit". (selftest::test_svalue_equality): Remove "uninit" and "freed". * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT. gcc/ChangeLog: PR analyzer/94447 PR analyzer/94639 PR analyzer/94732 PR analyzer/94754 * doc/invoke.texi (Static Analyzer Options): Remove -Wanalyzer-use-of-uninitialized-value. (-Wno-analyzer-use-of-uninitialized-value): Remove item. gcc/testsuite/ChangeLog: PR analyzer/94447 PR analyzer/94639 PR analyzer/94732 PR analyzer/94754 * gcc.dg/analyzer/data-model-1.c: Mark "use of uninitialized value" warnings as xfail for now. * gcc.dg/analyzer/data-model-5b.c: Remove uninitialized warning. * gcc.dg/analyzer/pr94099.c: Mark "uninitialized" warning as xfail for now. * gcc.dg/analyzer/pr94447.c: New test. * gcc.dg/analyzer/pr94639.c: New test. * gcc.dg/analyzer/pr94732.c: New test. * gcc.dg/analyzer/pr94754.c: New test. * gcc.dg/analyzer/zlib-6.c: Mark "uninitialized" warning as xfail for now.
Should be fixed by r10-8012-g78b9783774bfd3540f38f5b1e3c7fc9f719653d7.