https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94732
Bug ID: 94732
Summary: Analyzer: false positive in MPFR's atan.c
Product: gcc
Version: 10.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: vincent-gcc at vinc17 dot net
Target Milestone: ---
Created attachment 48360
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48360&action=edit
testcase
Test with: gcc-10 (Debian 10-20200418-1) 10.0.1 20200418 (experimental) [master
revision 27c171775ab:4c277008be0:c5bac7d127f288fd2f8a1f15c3f30da5903141c6]
When I want to compile GNU MPFR with -fanalyzer, the compilation of atan.c
fails on what appears to be a false positive. I've managed to reduce the
6000-line preprocessed code to code with fewer than 300 lines (attached bug.i
file). More specifically, I've removed
* blank lines and comments;
* unused declarations/definitions;
* code that could have an influence only after the "error";
* code testing and handling special cases.
I order to see where the issue could come from, I've added 2 lines
* "((y)->_mpfr_d)[0] = 0;" at the beginning of mpfr_atan_aux;
* "((tmp2)->_mpfr_d)[0] = 0;" just before the call to mpfr_atan_aux.
Without these 2 lines, "gcc-10 -c -fanalyzer bug.i" gives:
bug.i: In function ‘set_table’:
bug.i:145:9: warning: use of uninitialized value ‘yp’ [CWE-457]
[-Wanalyzer-use-of-uninitialized-value]
145 | yp[0] &= ~(((void) 0), sh ==
| ^~
where yp is set with
mp_limb_t *yp = ((y)->_mpfr_d);
So I suppose that the analyzer complains that (y)->_mpfr_d is uninitialized.
This comes from mpfr_atan_aux, and "((y)->_mpfr_d)[0] = 0;" at the beginning of
this function should trigger the same error. If I add this line, I get in a
consistent way:
bug.i: In function ‘mpfr_atan_aux’:
bug.i:154:19: warning: use of uninitialized value ‘<unknown>’ [CWE-457]
[-Wanalyzer-use-of-uninitialized-value]
154 | ((y)->_mpfr_d)[0] = 0;
| ~~~~~~~~~~~~~~~~~~^~~
This mpfr_atan_aux function is called at only one place:
mpfr_atan_aux (tmp2, ukz, twopoweri, n0 - i, tabz);
So I added "((tmp2)->_mpfr_d)[0] = 0;" just before this call. I thought that I
would get an error on this, but I still get an error only on "((y)->_mpfr_d)[0]
= 0;" in mpfr_atan_aux. If I remove this line (just keeping the one before the
call to mpfr_atan_aux), I get the error in set_table only, just like in the
first test.
Now, this appears to be a false positif since (tmp2)->_mpfr_d was initialized
earlier.
I could probably simplify the code even further, focusing on (tmp2)->_mpfr_d
only.
