analyzer: fix uninit false positive with -ftrivial-auto-var-init= [PR106204]

(cherry picked from r13-1517-gb33dd7874523af)

-fanalyzer handles -ftrivial-auto-var-init= by special-casing
IFN_DEFERRED_INIT to be a no-op, so that e.g.:

  len_2 = .DEFERRED_INIT (4, 2, &"len"[0]);

is treated as a no-op, so that len_2 is still uninitialized after the
stmt.

PR analyzer/106204 reports that -fanalyzer gives false positives from
-Wanalyzer-use-of-uninitialized-value on locals that have their address
taken, due to e.g.:

  _1 = .DEFERRED_INIT (4, 2, &"len"[0]);
  len = _1;

where -fanalyzer leaves _1 uninitialized, and then complains about
the assignment to "len".

Fixed thusly by suppressing the warning when assigning from such SSA
names.

gcc/analyzer/ChangeLog:
	PR analyzer/106204
	* region-model.cc (within_short_circuited_stmt_p): Move extraction
	of assign_stmt to caller.
	(due_to_ifn_deferred_init_p): New.
	(region_model::check_for_poison): Move extraction of assign_stmt
	from within_short_circuited_stmt_p to here.  Share logic with
	call to due_to_ifn_deferred_init_p.

gcc/testsuite/ChangeLog:
	PR analyzer/106204
	* gcc.dg/analyzer/torture/uninit-pr106204.c: New test.
	* gcc.dg/analyzer/uninit-pr106204.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

1 files changed, 17 insertions, 0 deletions

diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-pr106204.c b/gcc/testsuite/gcc.dg/analyzer/uninit-pr106204.c
new file mode 100644
index 00000000000..7d7cf7bfc7e
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/uninit-pr106204.c
@@ -0,0 +1,17 @@
+/* { dg-additional-options "-ftrivial-auto-var-init=zero" } */
+
+int foo(unsigned *len);
+
+/* Modified version of reproducer that does use "len" before init.  */
+
+int test_2()
+{
+ unsigned len;
+ int rc;
+
+ rc = len; /* { dg-warning "use of uninitialized value 'len'" } */
+ rc = foo(&len);
+ if (!rc)
+  rc = len;
+ return rc;
+}