analyzer: ensure that we purge state when reusing a conjured_svalue [PR105087]

PR analyzer/105087 describes a false positive from
-Wanalyzer-double-free in which the analyzer erroneously considers two
successive inlined vasprintf calls to have allocated the same pointer.

The root cause is that the result written back from vasprintf is a
conjured_svalue, and that we normally purge state when reusing a
conjured_svalue, but various places in the code were calling
region_model_manager::get_or_create_conjured_svalue but failing to
then call region_model::purge_state_involving on the result.

This patch fixes things by moving responsibility for calling
region_model::purge_state_involving into
region_model_manager::get_or_create_conjured_svalue, so that it is
always called when reusing a conjured_svalue, fixing the false positive.

gcc/analyzer/ChangeLog:
	PR analyzer/105087
	* analyzer.h (class conjured_purge): New forward decl.
	* region-model-asm.cc (region_model::on_asm_stmt): Add
	conjured_purge param to calls binding_cluster::on_asm and
	region_model_manager::get_or_create_conjured_svalue.
	* region-model-impl-calls.cc
	(call_details::get_or_create_conjured_svalue): Likewise for call
	to region_model_manager::get_or_create_conjured_svalue.
	(region_model::impl_call_fgets): Remove call to
	region_model::purge_state_involving, as this is now done
	implicitly by call_details::get_or_create_conjured_svalue.
	(region_model::impl_call_fread): Likewise.
	(region_model::impl_call_strchr): Pass conjured_purge param to
	call to region_model_manager::get_or_create_conjured_svalue.
	* region-model-manager.cc (conjured_purge::purge): New.
	(region_model_manager::get_or_create_conjured_svalue): Add
	param "p".  Use it to purge state when reusing an existing
	conjured_svalue.
	* region-model.cc (region_model::on_call_pre): Replace call to
	region_model::purge_state_involving with passing conjured_purge
	to region_model_manager::get_or_create_conjured_svalue.
	(region_model::handle_unrecognized_call): Pass conjured_purge to
	store::on_unknown_fncall.
	* region-model.h
	(region_model_manager::get_or_create_conjured_svalue): Add param
	"p".
	* store.cc (binding_cluster::on_unknown_fncall): Likewise.  Pass
	it on to region_model_manager::get_or_create_conjured_svalue.
	(binding_cluster::on_asm): Likewise.
	(store::on_unknown_fncall): Add param "p" and pass it on to
	binding_cluster::on_unknown_fncall.
	* store.h (binding_cluster::on_unknown_fncall): Add param p.
	(binding_cluster::on_asm): Likewise.
	(store::on_unknown_fncall): Likewise.
	* svalue.h (class conjured_purge): New.

gcc/testsuite/ChangeLog:
	* gcc.dg/analyzer/pr105087-1.c: New test.
	* gcc.dg/analyzer/pr105087-2.c: New test.
	* gcc.dg/analyzer/vasprintf-1.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/gcc/analyzer/region-model.h b/gcc/analyzer/region-model.h
index 13a2ea94a3f..23841718b5c 100644
--- a/gcc/analyzer/region-model.h
+++ b/gcc/analyzer/region-model.h
@@ -277,7 +277,8 @@ public:
   const svalue *get_or_create_compound_svalue (tree type,
 					       const binding_map &map);
   const svalue *get_or_create_conjured_svalue (tree type, const gimple *stmt,
-					       const region *id_reg);
+					       const region *id_reg,
+					       const conjured_purge &p);
   const svalue *
   get_or_create_asm_output_svalue (tree type,
 				   const gasm *asm_stmt,