[Bug analyzer/109789] analyzer-use-of-uninitialized-value false positive inside function when array passed to the function is pre-initialized

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109789

--- Comment #8 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Jonathan Wakely from comment #7)
> It also seems to depend on array-to-pointer decay from float[nframes] to
> float* across the function boundary, because if the loop using the size_t
> index is moved into the same function as the array initialization, the
> analyzer doesn't complain.

Ah no, this still complains without a separate function:

void sink(int);

void export_audio(int nframes, int init, int count) {
  do {
    int tmp_l[nframes];
    for (int i = 0; i < nframes; i++)
      tmp_l[i] = init;
    unsigned size = nframes;
    sink(tmp_l[size - 1]);
  } while (--count);
}


a.c: In function ‘export_audio’:
a.c:9:5: error: use of uninitialized value ‘*tmp_l[<unknown>]’ [CWE-457]
[-Werror=analyzer-use-of-uninitialized-value]
    9 |     sink(tmp_l[size - 1]);
      |     ^~~~~~~~~~~~~~~~~~~~~
  ‘export_audio’: events 1-4
    |
    |    5 |     int tmp_l[nframes];
    |      |         ^~~~~
    |      |         |
    |      |         (1) region created on stack here
    |    6 |     for (int i = 0; i < nframes; i++)
    |      |                     ~~~~~~~~~~~
    |      |                       |
    |      |                       (2) following ‘false’ branch (when ‘i >=
nframes’)...
    |    7 |       tmp_l[i] = init;
    |    8 |     unsigned size = nframes;
    |      |              ~~~~
    |      |              |
    |      |              (3) ...to here
    |    9 |     sink(tmp_l[size - 1]);
    |      |     ~~~~~~~~~~~~~~~~~~~~~
    |      |     |
    |      |     (4) use of uninitialized value ‘*tmp_l[<unknown>]’ here
    |
cc1: some warnings being treated as errors