[Bug analyzer/124451] Analyzer generates false positives when bool from stdbool.h is used

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124451

--- Comment #6 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:a1ff23e3727cce21833171dfecdd46edabc76e55

commit r16-8020-ga1ff23e3727cce21833171dfecdd46edabc76e55
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Wed Mar 11 20:45:29 2026 -0400

    analyzer: fix false +ves when testing <stdbool.h>/_Bool values [PR124451]

    PR analyzer/124451 reports false positives from -Wanalyzer-malloc-leak
    when using inverted "bool" values to track whether an allocation
    happened.

    The root cause is that with _Bool, the inversion is a bitwise not,
    and this leads to the test of the condition against 0 to not be
    recognized by malloc_state_machine::on_condition.  Hence on_condition
    fails to transition the state machine for the pointer from "unchecked"
    to "null" or "nonnull", leaving it in the "unchecked" state.

    This patch generalizes the folding logic in the analyzer that folds
      "!(x CMP y)" => "x !CMP y"
    so that it also folds
      "~(x CMP y)" => "x !CMP y"
    when the bitwise not is on a boolean type, fixing the false positives.

    gcc/analyzer/ChangeLog:
            PR analyzer/124451
            * region-model-manager.cc
            (region_model_manager::maybe_invert_comparison_in_unaryop): New,
            adapted from...
            (region_model_manager::maybe_fold_unaryop): ...here, splitting out
            the comparison inversion case for TRUTH_NOT_EXPR.  Add a case for
            BIT_NOT_EXPR, reusing the inversion logic when dealing with
            boolean types.
            * region-model-manager.h
            (region_model_manager::maybe_invert_comparison_in_unaryop): New
decl.

    gcc/testsuite/ChangeLog:
            PR analyzer/124451
            * gcc.dg/analyzer/conditionals-pr124451-_Bool.c: New test.
            * gcc.dg/analyzer/conditionals-pr124451-enum.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>