[Bug analyzer/95758] Various issues when compiling glibc regex.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95758

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |99390
            Summary|-Wanalyzer-use-after-free   |Various issues when
                   |false positive when         |compiling glibc regex.c
                   |compiling glibc regex.c     |

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this.

I tried again with GCC 11 HEAD and I don't see the use-after-free.  If there
are use-after-free bugs, the above looks likely to be another dup of bug 93695.

Adding -Wanalyzer-too-complex shows that the analyzer is hitting complexity
limits and giving up at numerous places in the code (it takes a *long* time on
the attachment) - which could be masking the use-after-free false positive.  It
looks like the call summarization logic is failing, leading to blog-up of the
analysis when all of the various nested function calls are expanded.

I also see many -Wanalyzer-malloc-leak reports, which may or may not be false
positives; difficult to tell without diving into the code.

Updating "Summary" accordingly, and adding to the call summarization tracker.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99390
[Bug 99390] [meta-bug] tracker bug for call summaries in -fanalyzer