[Bug analyzer/94851] -fanalyzer erroneously reporting NULL dereference - simple test case attached

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94851

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalc...@gcc.gnu.org>:

https://gcc.gnu.org/g:df2b78d407a3fe8685343f7249b9c31c7e3af44d

commit r11-2807-gdf2b78d407a3fe8685343f7249b9c31c7e3af44d
Author: David Malcolm <dmalc...@redhat.com>
Date:   Sat Aug 22 06:30:17 2020 -0400

    analyzer: fix NULL deref false positives [PR94851]

    PR analyzer/94851 reports various false "NULL dereference" diagnostics.
    The first case (comment #1) affects GCC 10.2 but no longer affects
    trunk; I believe it was fixed by the state rewrite of
    r11-2694-g808f4dfeb3a95f50f15e71148e5c1067f90a126d.

    The patch adds a regression test for this case.

    The other cases (comment #3 and comment #4) still affect trunk.
    In both cases, the && in a conditional is optimized to bitwise &
      _1 = p_4 != 0B;
      _2 = p_4 != q_6(D);
      _3 = _1 & _2;
    and the analyzer fails to fold this for the case where one (or both) of
    the conditionals is false, and thus erroneously considers the path where
    "p" is non-NULL despite being passed a NULL value.

    Fix this by implementing folding for this case.

    gcc/analyzer/ChangeLog:
            PR analyzer/94851
            * region-model-manager.cc
            (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.

    gcc/testsuite/ChangeLog:
            PR analyzer/94851
            * gcc.dg/analyzer/pr94851-1.c: New test.
            * gcc.dg/analyzer/pr94851-3.c: New test.
            * gcc.dg/analyzer/pr94851-4.c: New test.