[committed] analyzer: fix false leaks when writing through unknown ptrs [PR97072]

[David Malcolm via Gcc-patches]

Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu.
Pushed to master as r11-6497-gac3966e315ada63eb379d560a012fa77c3909155.

gcc/analyzer/ChangeLog:
        PR analyzer/97072
        * region-model-reachability.cc (reachable_regions::init_cluster):
        Convert symbolic region handling to a switch statement.  Add cases
        to handle SK_UNKNOWN and SK_CONJURED.

gcc/testsuite/ChangeLog:
        PR analyzer/97072
        * gcc.dg/analyzer/pr97072.c: New test.
---
 gcc/analyzer/region-model-reachability.cc | 36 +++++++++++++++++------
 gcc/testsuite/gcc.dg/analyzer/pr97072.c   |  9 ++++++
 2 files changed, 36 insertions(+), 9 deletions(-)
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/pr97072.c

diff --git a/gcc/analyzer/region-model-reachability.cc 
b/gcc/analyzer/region-model-reachability.cc
index daf785254ea..a988ffc1439 100644
--- a/gcc/analyzer/region-model-reachability.cc
+++ b/gcc/analyzer/region-model-reachability.cc
@@ -88,20 +88,38 @@ reachable_regions::init_cluster (const region *base_reg)
   if (m_store->escaped_p (base_reg))
     add (base_reg, true);
 
-  /* If BASE_REG is *INIT_VAL(REG) for some other REG, see if REG is
-     unbound and untouched.  If so, then add BASE_REG as a root.  */
   if (const symbolic_region *sym_reg = base_reg->dyn_cast_symbolic_region ())
     {
       const svalue *ptr = sym_reg->get_pointer ();
-      if (const initial_svalue *init_sval = ptr->dyn_cast_initial_svalue ())
+      switch (ptr->get_kind ())
        {
-         const region *init_sval_reg = init_sval->get_region ();
-         const region *other_base_reg = init_sval_reg->get_base_region ();
-         const binding_cluster *other_cluster
-           = m_store->get_cluster (other_base_reg);
-         if (other_cluster == NULL
-             || !other_cluster->touched_p ())
+       default:
+         break;
+       case SK_INITIAL:
+         {
+           /* If BASE_REG is *INIT_VAL(REG) for some other REG, see if REG is
+              unbound and untouched.  If so, then add BASE_REG as a root.  */
+           const initial_svalue *init_sval
+             = as_a <const initial_svalue *> (ptr);
+           const region *init_sval_reg = init_sval->get_region ();
+           const region *other_base_reg = init_sval_reg->get_base_region ();
+           const binding_cluster *other_cluster
+             = m_store->get_cluster (other_base_reg);
+           if (other_cluster == NULL
+               || !other_cluster->touched_p ())
+             add (base_reg, true);
+         }
+         break;
+
+       case SK_UNKNOWN:
+       case SK_CONJURED:
+         {
+           /* If this cluster is due to dereferencing an unknown/conjured
+              pointer, any values written through the pointer could still
+              be live.  */
            add (base_reg, true);
+         }
+         break;
        }
     }
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr97072.c 
b/gcc/testsuite/gcc.dg/analyzer/pr97072.c
new file mode 100644
index 00000000000..40241248884
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/pr97072.c
@@ -0,0 +1,9 @@
+void unknown_fn_1 (void *);
+
+void test_1 (int co, int y)
+{
+  void *p = __builtin_malloc (1024);
+  void **q;
+  unknown_fn_1 (&q);
+  *q = p;
+}
-- 
2.26.2