[analyzer] [fuchsia.HandleChecker] Leak node is generated at wrong place

[pskrgag]

Consider following code:

#include <stdint.h>
#include <stdio.h>

typedef int zx_status_t;
typedef __typeof__(sizeof(int)) zx_handle_t;

#define ZX_HANDLE_ACQUIRE __attribute__((acquire_handle("Fuchsia")))
#define ZX_HANDLE_RELEASE __attribute__((release_handle("Fuchsia")))

zx_status_t create_handle(zx_handle_t *out0 ZX_HANDLE_ACQUIRE);
zx_status_t handle_close(zx_handle_t handle ZX_HANDLE_RELEASE);

void foo(void)
{
	zx_handle_t handle;
	zx_status_t res = create_handle(&handle);

	if (res == 0) {
		printf("error\n");  // leak reported here
		printf("error1\n");
		printf("error1\n");
	}
}

Error node reported on some very unrelated node. I'd expect error to be report at the end of the function, since there actual leak happens.

This happens, since handle symbol indeed becomes dead. Note, that leak node is generated at the right place if condition is changed to res == 1 (which indicates allocation failure in terms of this checker).

Godbolt https://godbolt.org/z/33xPszdd6

[llvmbot]

@llvm/issue-subscribers-clang-static-analyzer

Author: Pavel Skripkin (pskrgag)

Consider following code:

#include <stdint.h>
#include <stdio.h>

typedef int zx_status_t;
typedef __typeof__(sizeof(int)) zx_handle_t;

#define ZX_HANDLE_ACQUIRE __attribute__((acquire_handle("Fuchsia")))
#define ZX_HANDLE_RELEASE __attribute__((release_handle("Fuchsia")))

zx_status_t create_handle(zx_handle_t *out0 ZX_HANDLE_ACQUIRE);
zx_status_t handle_close(zx_handle_t handle ZX_HANDLE_RELEASE);

void foo(void)
{
	zx_handle_t handle;
	zx_status_t res = create_handle(&handle);

	if (res == 0) {
		printf("error\n");  // leak reported here
		printf("error1\n");
		printf("error1\n");
	}
}

Error node reported on some very unrelated node. I'd expect error to be report at the end of the function, since there actual leak happens.

This happens, since handle symbol indeed becomes dead. Note, that leak node is generated at the right place if condition is changed to res == 1 (which indicates allocation failure in terms of this checker).

Godbolt https://godbolt.org/z/33xPszdd6

[pskrgag]

I am not sure where to look at =(. Handle symbol indeed become dead, so seems like problem is not at checker level.

Any tips would be appreciated