From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id E5D173858D20; Tue, 15 Mar 2022 22:18:32 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E5D173858D20
From: "dmalcolm at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug analyzer/104943] New: Analyzer fails to purge state for local
 structs
Date: Tue, 15 Mar 2022 22:18:32 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: analyzer
X-Bugzilla-Version: 12.0
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: dmalcolm at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: dmalcolm at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter target_milestone
Message-ID: <bug-104943-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Mar 2022 22:18:33 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D104943

            Bug ID: 104943
           Summary: Analyzer fails to purge state for local structs
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
  Target Milestone: ---

State purging only happens for SSA names, and locals of struct type aren't =
SSA
names.

Given e.g.:

struct boxed {
  int value;
};

extern struct boxed boxed_add (struct boxed a, struct boxed b);
extern struct boxed boxed_mul (struct boxed a, struct boxed b);

struct boxed
test (struct boxed a, struct boxed b)
{
  struct boxed result =3D boxed_add (boxed_mul (a, a),
                                   boxed_mul (b, b));
  return result;
}

without optimization we have this gimple:

struct boxed test (struct boxed a, struct boxed b)
{
  struct boxed result;
  struct boxed D.1994;
  struct boxed D.1993;
  struct boxed D.1992;

  <bb 2> :
  D.1992 =3D boxed_mul (b, b);
  D.1993 =3D boxed_mul (a, a);
  result =3D boxed_add (D.1993, D.1992);
  D.1994 =3D result;
  result =3D{v} {CLOBBER(eol)};

  <bb 3> :
<L1>:
  return D.1994;

}

and this final exploded node:

EN 11:
preds: EN: 10
succs:=20
callstring: []
after SN: 3
rmodel:
stack depth: 1
  frame (index 0): frame: =E2=80=98test=E2=80=99@1
clusters within frame: =E2=80=98test=E2=80=99@1
  cluster for: <anonymous>: CONJURED(D.1992 =3D boxed_mul (b, b);, <anonymo=
us>)
  cluster for: <anonymous>: CONJURED(D.1993 =3D boxed_mul (a, a);, <anonymo=
us>)
  cluster for: <anonymous>: CONJURED(result =3D boxed_add (D.1993, D.1992);,
result)
  cluster for: <anonymous>: CONJURED(result =3D boxed_add (D.1993, D.1992);,
result)
m_called_unknown_fn: TRUE
constraint_manager:
  equiv classes:
  constraints:

where the various <anonymous> are the values of the local temporaries of st=
ruct
type, which ought to be purged; they don't matter anymore.

Seen on linux kernel: drivers/gpu/drm/amd/display/dc/calcs/dce_calcs.c which
amongst other things has:

struct bw_fixed {
  int64_t value;
};

with numerous calls to manipulate values; the states get bloated with bindi=
ngs
for temporaries that persist far longer than they are needed.=