From patchwork Tue Mar 19 20:11:34 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 1913766 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=Cc7UP7v6; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=gcc.gnu.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=server2.sourceware.org; envelope-from=gcc-patches-bounces+incoming=patchwork.ozlabs.org@gcc.gnu.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4TzjYf29k2z1yXD for ; Wed, 20 Mar 2024 07:12:05 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 4C6263858418 for ; Tue, 19 Mar 2024 20:12:03 +0000 (GMT) X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id 10E423858D37 for ; Tue, 19 Mar 2024 20:11:44 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 10E423858D37 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 10E423858D37 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1710879105; cv=none; b=FiGqHnH+D1QaCw8gqrCCtl+Z66BW2aF50hQSJJsPwiXUCOxmXrtyMDpssmEBMW6tO61hf9uqykDeuotROkG4Klq8EFseNi8p9Pc/cSKWB8Spz2lcOeD9pBBXafxHqSiUfO5eKbfp1LxXK1tUQaEVaTVK3aYvknQeJAl9jOCJqHM= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1710879105; c=relaxed/simple; bh=27Nr+fZbQXdSb1Q8BdXx/Qas/f9vklpzjsplHQEx70A=; h=DKIM-Signature:From:To:Subject:Date:Message-Id:MIME-Version; b=L96Go0jW15Dn/vJscaxxx3dgPmAC1ih4/5rV9KfBnJKixs0y/XrdODNZ4MWLR3DJvS527Q7scEBC0GoaRuxKpYcmcKbAwYwIfeFDKrN+BBP3wAtiYICxLsMy+RHlidFwzKhSftOYXfnNxdgXe1qRhs7W/vm6Co3W0RRoC+7jRjE= ARC-Authentication-Results: i=1; server2.sourceware.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1710879103; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ctuM1jP8IEN5aWdP1/ZOrFHw7gTzY/mTlG/N8yoUMcY=; b=Cc7UP7v6ZFz/dDMROQSaajV8gMwYslE8RXeLhtojpLYVroRhR7P6i0m8xkQ2pQk28DxDah TogAgZC42GIbTef2O8rBjPIvioVzGw1uXrJuKyTnx7DgQPV7Y1ByZvBbhz6RIPfNKBeqkf MLYLteoecN9tJvLnWXToyRHvLQX7Zlw= Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-365--ytOLfw-MYmNhLVFXz2Vxg-1; Tue, 19 Mar 2024 16:11:41 -0400 X-MC-Unique: -ytOLfw-MYmNhLVFXz2Vxg-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 10CA41C04339 for ; Tue, 19 Mar 2024 20:11:41 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.32.20]) by smtp.corp.redhat.com (Postfix) with ESMTP id DCD25202451F; Tue, 19 Mar 2024 20:11:40 +0000 (UTC) From: David Malcolm To: gcc-patches@gcc.gnu.org Cc: Jakub Jelinek Subject: [pushed] analyzer: fix ICE due to corrupt MEM_REFs [PR113505] Date: Tue, 19 Mar 2024 16:11:34 -0400 Message-Id: <20240319201134.731864-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.4 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-11.9 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gcc-patches-bounces+incoming=patchwork.ozlabs.org@gcc.gnu.org From: Jakub Jelinek Jakub wrote this patch for PR analyzer/113505. Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu. Successful run of analyzer integration tests on x86_64-pc-linux-gnu. Pushed to trunk as r14-9555-gc87f1f3d660f41. gcc/analyzer/ChangeLog PR analyzer/113505 * region-model.cc (get_tree_for_byte_offset, region_model::get_representative_path_var_1, test_mem_ref, test_POINTER_PLUS_EXPR_then_MEM_REF): Use char __attribute__((may_alias)) * as type of MEM_REF second argument. gcc/testsuite/ChangeLog PR analyzer/113505 * gcc.dg/analyzer/pr113505.c: New test. --- gcc/analyzer/region-model.cc | 16 ++++++++++------ gcc/testsuite/gcc.dg/analyzer/pr113505.c | 24 ++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 6 deletions(-) create mode 100644 gcc/testsuite/gcc.dg/analyzer/pr113505.c diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc index f079d1fb37e..8fff5324173 100644 --- a/gcc/analyzer/region-model.cc +++ b/gcc/analyzer/region-model.cc @@ -3967,9 +3967,10 @@ static tree get_tree_for_byte_offset (tree ptr_expr, byte_offset_t byte_offset) { gcc_assert (ptr_expr); + tree ptype = build_pointer_type_for_mode (char_type_node, ptr_mode, true); return fold_build2 (MEM_REF, char_type_node, - ptr_expr, wide_int_to_tree (size_type_node, byte_offset)); + ptr_expr, wide_int_to_tree (ptype, byte_offset)); } /* Simulate a series of reads of REG until we find a 0 byte @@ -5360,9 +5361,10 @@ region_model::get_representative_path_var_1 (const region *reg, tree addr_parent = build1 (ADDR_EXPR, build_pointer_type (reg->get_type ()), parent_pv.m_tree); - return path_var (build2 (MEM_REF, - reg->get_type (), - addr_parent, offset_pv.m_tree), + tree ptype = build_pointer_type_for_mode (char_type_node, ptr_mode, + true); + return path_var (build2 (MEM_REF, reg->get_type (), addr_parent, + fold_convert (ptype, offset_pv.m_tree)), parent_pv.m_stack_depth); } @@ -9024,7 +9026,8 @@ test_mem_ref () tree int_17 = build_int_cst (integer_type_node, 17); tree addr_of_x = build1 (ADDR_EXPR, int_star, x); - tree offset_0 = build_int_cst (integer_type_node, 0); + tree ptype = build_pointer_type_for_mode (char_type_node, ptr_mode, true); + tree offset_0 = build_int_cst (ptype, 0); tree star_p = build2 (MEM_REF, integer_type_node, p, offset_0); region_model_manager mgr; @@ -9074,7 +9077,8 @@ test_POINTER_PLUS_EXPR_then_MEM_REF () tree a = build_global_decl ("a", int_star); tree offset_12 = build_int_cst (size_type_node, 12); tree pointer_plus_expr = build2 (POINTER_PLUS_EXPR, int_star, a, offset_12); - tree offset_0 = build_int_cst (integer_type_node, 0); + tree ptype = build_pointer_type_for_mode (char_type_node, ptr_mode, true); + tree offset_0 = build_int_cst (ptype, 0); tree mem_ref = build2 (MEM_REF, integer_type_node, pointer_plus_expr, offset_0); region_model_manager mgr; diff --git a/gcc/testsuite/gcc.dg/analyzer/pr113505.c b/gcc/testsuite/gcc.dg/analyzer/pr113505.c new file mode 100644 index 00000000000..58a2b6cd6f4 --- /dev/null +++ b/gcc/testsuite/gcc.dg/analyzer/pr113505.c @@ -0,0 +1,24 @@ +/* PR analyzer/113505 */ +/* { dg-additional-options "-O -fdump-analyzer" } */ + +enum E **foo () __attribute__((__const__)); +char a[2]; +void bar (char *); + +void +baz (void) +{ + char *s, *l; + for (;;) + { + bar (a); + s = a; + while (foo ()[*s]) + s++; + l = s; + *l++ = '\0'; + while (foo ()[*l]) + l++; + bar (s); + } +}