diff options
author | David Malcolm <dmalcolm@redhat.com> | 2020-02-13 21:17:11 -0500 |
---|---|---|
committer | David Malcolm <dmalcolm@redhat.com> | 2020-02-17 02:20:36 -0500 |
commit | f76a88ebf089871dcce215aa0cb1956ccc060895 (patch) | |
tree | 4f8cb05de7bf355d548dc7ce2e8504730058c6bf /gcc/analyzer/exploded-graph.h | |
parent | 0993ad65cc4e462223e9337d9b2d3b82a887c6c8 (diff) |
analyzer: fix ICEs in region_model::get_lvalue_1 [PR 93388]
There have been various ICEs with -fanalyzer involving unhandled tree
codes in region_model::get_lvalue_1; PR analyzer/93388 reports various
others e.g. for IMAGPART_EXPR, REALPART_EXPR, and VIEW_CONVERT_EXPR seen
when running the testsuite with -fanalyzer forcibly enabled.
Whilst we could implement lvalue-handling in the region model for every
tree code, for some of these we're straying far from my primary goal for
GCC 10 of implementing a double-free checker for C.
This patch implements a fallback for unimplemented tree codes: create a
dummy region, but mark the new state as being invalid, and stop
exploring state along this path. It also implements VIEW_CONVERT_EXPR.
Doing so fixes the ICEs, whilst effectively turning off the analyzer
along code paths that use such tree codes. Hopefully this compromise
is sensible for GCC 10.
gcc/analyzer/ChangeLog:
PR analyzer/93388
* engine.cc (impl_region_model_context::on_unknown_tree_code):
New.
(exploded_graph::get_or_create_node): Reject invalid states.
* exploded-graph.h
(impl_region_model_context::on_unknown_tree_code): New decl.
(point_and_state::point_and_state): Assert that the state is
valid.
* program-state.cc (program_state::program_state): Initialize
m_valid to true.
(program_state::operator=): Copy m_valid.
(program_state::program_state): Likewise for move constructor.
(program_state::print): Print m_valid.
(program_state::dump_to_pp): Likewise.
* program-state.h (program_state::m_valid): New field.
* region-model.cc (region_model::get_lvalue_1): Implement the
default case by returning a new symbolic region and calling
the context's on_unknown_tree_code, rather than issuing an
internal_error. Implement VIEW_CONVERT_EXPR.
* region-model.h (region_model_context::on_unknown_tree_code): New
vfunc.
(test_region_model_context::on_unknown_tree_code): New.
gcc/testsuite/ChangeLog:
PR analyzer/93388
* gcc.dg/analyzer/torture/20060625-1.c: New test.
* gcc.dg/analyzer/torture/pr51628-30.c: New test.
* gcc.dg/analyzer/torture/pr59037.c: New test.
Diffstat (limited to 'gcc/analyzer/exploded-graph.h')
-rw-r--r-- | gcc/analyzer/exploded-graph.h | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/gcc/analyzer/exploded-graph.h b/gcc/analyzer/exploded-graph.h index bb1f3ccff1a..614c37ce9af 100644 --- a/gcc/analyzer/exploded-graph.h +++ b/gcc/analyzer/exploded-graph.h @@ -76,6 +76,9 @@ class impl_region_model_context : public region_model_context void on_phi (const gphi *phi, tree rhs) FINAL OVERRIDE; + void on_unknown_tree_code (path_var pv, + const dump_location_t &loc) FINAL OVERRIDE; + exploded_graph *m_eg; log_user m_logger; const exploded_node *m_enode_for_diag; @@ -100,6 +103,9 @@ public: m_state (state), m_hash (m_point.hash () ^ m_state.hash ()) { + /* We shouldn't be building point_and_states and thus exploded_nodes + for states that aren't valid. */ + gcc_assert (state.m_valid); } hashval_t hash () const |