analyzer: fix leak suppression at end of 'main' [PR101983]

PR analyzer/101983 reports what I thought were false positives
from -Wanalyzer-malloc-leak, but on closer inspection, the
analyzer is correctly reporting heap-allocated buffers that are
no longer reachable.

However, these "leaks" occur at the end of "main".  The analyzer already
has some logic to avoid reporting leaks at the end of main, where the
leak is detected at the end of the EXIT basic block.  However, in this case,
the leak is detected at the clobber in BB 2 here:
  <bb 2> :
  func (&res);
  res ={v} {CLOBBER(eol)};
  _4 = 0;

  <bb 3> :
<L0>:
  return _4;

where we have a chain BB 2 -> BB 3 -> EXIT BB.

This patch generalizes the "are we at the end of 'main'" detection to
handle such cases, silencing -Wanalyzer-malloc-leak on them.

There's a remaining issue where the analyzer unhelpfully describes one
of the leaking values as '<unknown>', rather than 'res.a', but I'm
leaving that for a followup (covered by PR analyzer/99771).

gcc/analyzer/ChangeLog:
	PR analyzer/101983
	* engine.cc (returning_from_function_p): New.
	(impl_region_model_context::on_state_leak): Use it when rejecting
	leaks at the return from "main".

gcc/testsuite/ChangeLog:
	PR analyzer/101983
	* gcc.dg/analyzer/pr101983-main.c: New test.
	* gcc.dg/analyzer/pr101983-not-main.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

gcc/analyzer/engine.cc

@@ -740,6 +740,51 @@ readability_comparator (const void *p1, const void *p2)
   return 0;
 }
 
+/* Return true is SNODE is the EXIT node of a function, or is one
+   of the final snodes within its function.
+
+   Specifically, handle the final supernodes before the EXIT node,
+   for the case of clobbers that happen immediately before exiting.
+   We need a run of snodes leading to the return_p snode, where all edges are
+   intraprocedural, and every snode has just one successor.
+
+   We use this when suppressing leak reports at the end of "main".  */
+
+static bool
+returning_from_function_p (const supernode *snode)
+{
+  if (!snode)
+    return false;
+
+  unsigned count = 0;
+  const supernode *iter = snode;
+  while (true)
+    {
+      if (iter->return_p ())
+	return true;
+      if (iter->m_succs.length () != 1)
+	return false;
+      const superedge *sedge = iter->m_succs[0];
+      if (sedge->get_kind () != SUPEREDGE_CFG_EDGE)
+	return false;
+      iter = sedge->m_dest;
+
+      /* Impose a limit to ensure we terminate for pathological cases.
+
+	 We only care about the final 3 nodes, due to cases like:
+	   BB:
+	     (clobber causing leak)
+
+	   BB:
+	   <label>:
+	   return _val;
+
+	   EXIT BB.*/
+      if (++count > 3)
+	return false;
+    }
+}
+
 /* Find the best tree for SVAL and call SM's on_leak vfunc with it.
    If on_leak returns a pending_diagnostic, queue it up to be reported,
    so that we potentially complain about a leak of SVAL in the given STATE.  */
@@ -794,8 +839,7 @@ impl_region_model_context::on_state_leak (const state_machine &sm,
   gcc_assert (m_enode_for_diag);
 
   /* Don't complain about leaks when returning from "main".  */
-  if (m_enode_for_diag->get_supernode ()
-      && m_enode_for_diag->get_supernode ()->return_p ())
+  if (returning_from_function_p (m_enode_for_diag->get_supernode ()))
     {
       tree fndecl = m_enode_for_diag->get_function ()->decl;
       if (id_equal (DECL_NAME (fndecl), "main"))

gcc/testsuite/gcc.dg/analyzer/pr101983-main.c

@@ -0,0 +1,38 @@
+/* { dg-additional-options "-Wno-analyzer-too-complex -fno-analyzer-call-summaries" } */
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdlib.h>
+
+struct list {
+	struct list* next;
+	void *a;
+};
+
+void func(struct list **res)
+{
+	struct list *cur = NULL;
+	do {
+		struct list *n = malloc(sizeof(struct list));
+		void *a = malloc(1);
+		if (n == NULL || a == NULL) {
+			if (n != NULL) free(n);
+			if (a != NULL) free(a);
+			break;
+		}
+
+		if (cur == NULL) {
+			*res = cur = n;
+		} else {
+			cur->next = n;
+			cur = n;
+		}
+		n->a = a;
+	} while (true);
+}
+
+int main()
+{
+	struct list *res;
+	func(&res);
+}

gcc/testsuite/gcc.dg/analyzer/pr101983-not-main.c

@@ -0,0 +1,40 @@
+/* { dg-additional-options "-Wno-analyzer-too-complex -fno-analyzer-call-summaries" } */
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdlib.h>
+
+struct list {
+	struct list* next;
+	void *a;
+};
+
+void func(struct list **res)
+{
+	struct list *cur = NULL;
+	do {
+		struct list *n = malloc(sizeof(struct list));
+		void *a = malloc(1);
+		if (n == NULL || a == NULL) {
+			if (n != NULL) free(n);
+			if (a != NULL) free(a);
+			break;
+		}
+
+		if (cur == NULL) {
+			*res = cur = n;
+		} else {
+			cur->next = n;
+			cur = n;
+		}
+		n->a = a;
+	} while (true);
+}
+
+int not_main()
+{
+	struct list *res;
+	func(&res);
+} /* { dg-warning "leak of 'res'" "leak of res" } */
+/* { dg-warning "leak of '<unknown>'" "leak of res->a" { target *-*-* } .-1 } */
+/* TODO: we should emit 'res->a' rather than '<unknown>' here.  */