https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109014
Saksham Gupta <io.sakshamgupta at gmail dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |io.sakshamgupta at gmail dot
com
--- Comment #7 from Saksham Gupta <io.sakshamgupta at gmail dot com> ---
I investigated attachment 54579 on current trunk (x86_64-pc-linux-gnu) by
inserting __analyzer_dump() in display_properties right before line 4549:
format_list_item(found[k], buff1, wantscripts);
Regarding Comment 1: on the execution paths where the 'for (size_t i = 0; i <
utt_size; i++)' loop actually reaches line 4525 ('fv = found[fc++];') and line
4539 ('fv[m] = -1;'), the store binds:
cluster for: found: UNKNOWN(int16_t[256][6]) (TOUCHED)
which does not trigger -Wanalyzer-use-of-uninitialized-value in
format_list_item.
Instead, the false positive is emitted on the path where 'found' has no binding
cluster at all in display_properties:
clusters within frame: ‘display_properties’@2
cluster for: wantscripts_68(D): (BOOL)0
cluster for: colwidth_67: (int)40
cluster for: n_50: (int)52
cluster for: k_56: (int)0
Because the first concrete elements of the static utt[] table (utt[0], utt[1])
have 't->type != 13', the initial loop iterations deterministically take the
'if (t->type != 13) continue;' branch (events 20-22 in Description; events
18-24 on current trunk). Once the loop index 'i' is widened, the analyzer
considers the loop-exit edge (i >= utt_size) feasible immediately after those
'continue' iterations, exiting the first loop with 'found' completely untouched
and warning on the first read (k = 0, count = 0) in format_list_item.
