[Bug analyzer/113314] [14/15/16/17 Regression] -Wanalyzer-infinite-loop false positive seen on haproxy's fd.c

[io.sakshamgupta at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113314

Saksham Gupta <io.sakshamgupta at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |io.sakshamgupta at gmail dot com

--- Comment #8 from Saksham Gupta <io.sakshamgupta at gmail dot com> ---
Hi David,

I submitted the CPython GSoC proposal a few months back. I'd like to take a
look at this bug to get more familiar with the core analyzer.

Looking at the trace, the region model is caching fdtab[fd].update.next and
ignoring external mutation. We presumably need to teach the analyzer to drop
those assumptions in two cases:

    • volatile memory: If the region has a volatile qualifier (as Drea noted),
we shouldn't trust the cached value.

    • Atomics: If the function contains __atomic builtins, it implies a
multi-threaded context, so shared memory might mutate between iterations.

For the volatile case, would the right approach be to intercept this in
region_model::get_rvalue and just return an unknown sval? Or should the
invalidation happen directly inside the infinite-loop checker?