https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93355
--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> --- The master branch has been updated by David Malcolm <dmalc...@gcc.gnu.org>: https://gcc.gnu.org/g:15e7b93ba4256884c90198c678ed7eded4e73464 commit r11-3340-g15e7b93ba4256884c90198c678ed7eded4e73464 Author: David Malcolm <dmalc...@redhat.com> Date: Fri Sep 18 17:34:50 2020 -0400 analyzer: decls are not on the heap Whilst debugging the remaining state explosion in PR analyzer/93355 I noticed that half of the states at an exploding program point had: 'malloc': {'&buf': 'non-heap'} whereas the other half didn't, presumably depending on whether the path to each enode had used this local buffer: char buf[400]; This patch tweaks malloc_state_machine::get_default_state to be smarter about this, so that we can implicitly treat pointers to decls as non-heap, preventing pointless differences between sm_state_map instances. With that, all of the states in question have equal (empty) malloc sm-state - though the state explosion continues for other reasons. gcc/analyzer/ChangeLog: PR analyzer/93355 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at the base region when considering pointers. Treat pointers to decls as being non-heap.
