[Bug analyzer/98918] Analyzer false positives due to sm-state involving UNKNOWN pointers

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98918

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-02-01
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Confirmed.

The issue occurs due to state-merger in the loop, where we eventually have
various symbolic values involving UNKNOWN in the iteration
e.g. at EN 69 a free(_1) where
    cluster for: _1: INIT_VAL((*UNKNOWN(struct marker *)).ref)
and the analyzer treats the various UNKNOWNs as being the same, hence
eventually a double free when this symbolic value reoccurs.


There are also warnings from -Wanalyzer-too-complex:

t.c:16:17: warning: terminating analysis for this program point: callstring: []
before (SN: 3 stmt: 0):  if (m_2 != 0B)EN: 7, EN: 17, EN: 26, EN: 35, EN: 45,
EN: 55, EN: 64, EN: 73 [-Wanalyzer-too-complex]
       16 |          while (m) {
          |                 ^
t.c: At top level:
t.c:22:1: warning: analysis bailed out early (32 'after-snode' enodes; 110
enodes) [-Wanalyzer-too-complex]
       22 | }
          | ^