From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2066) id E7E6E3944422; Thu, 19 Mar 2020 05:54:40 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E7E6E3944422 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1584597280; bh=k1FrZO+u4cPpZI34mba07mxb0C0ZKccnZUH7I2kjcW8=; h=From:To:Subject:Date:From; b=JqbpHSASIdhpEagJvfyNNLs5KC+jsaLoT3QyXygtiRIQq0fhcDOtCTdVQkw1kSks7 ukzLei3S4WA5dB1WnaeWX093EsZdHJYfOLl6JpoIIcvcBE2VoccD5shRL1AU6c2AZy 8dI9M0HzkgdPFjgD6UHKw3growDWWgSatPT1cG/c= Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Jiu Fu Guo To: gcc-cvs@gcc.gnu.org Subject: [gcc(refs/vendors/ibm/heads/perf)] analyzer: fix ICE on unreachable calls [PR 93947] X-Act-Checkin: gcc X-Git-Author: David Malcolm X-Git-Refname: refs/vendors/ibm/heads/perf X-Git-Oldrev: 89f759ac2ebb9f09ce5655ce5d791793922c612d X-Git-Newrev: 0ba70d1b5ae8df6406a880b2d23e4710b393e8c9 Message-Id: <20200319055440.E7E6E3944422@sourceware.org> Date: Thu, 19 Mar 2020 05:54:40 +0000 (GMT) X-BeenThere: gcc-cvs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-cvs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Mar 2020 05:54:41 -0000 https://gcc.gnu.org/g:0ba70d1b5ae8df6406a880b2d23e4710b393e8c9 commit 0ba70d1b5ae8df6406a880b2d23e4710b393e8c9 Author: David Malcolm Date: Wed Feb 26 09:43:57 2020 -0500 analyzer: fix ICE on unreachable calls [PR 93947] PR analyzer/93947 reports an ICE at -O1 when attempting to analyze a call that has been optimized away as unreachable. The root cause is a NULL dereference due to the fndecl having a NULL cgraph_node: the cgraph_node was created by pass_build_cgraph_edges::execute, but was later removed by symbol_table::remove_unreachable_nodes before the analyzer pass. This patch fixes it by checking for NULL before handling the cgraph_node. The reproducer demonstrates a weakness in the analyzer's constraint handling, where region_model::apply_constraints_for_gswitch fails to spot when the cases fully cover the data type, and thus make the default impossible. For now this is xfail-ed in the testcase. gcc/analyzer/ChangeLog: PR analyzer/93947 * region-model.cc (region_model::get_fndecl_for_call): Gracefully fail for fn_decls that don't have a cgraph_node. gcc/testsuite/ChangeLog: PR analyzer/93947 * gcc.dg/analyzer/torture/pr93947.c: New test. Diff: --- gcc/analyzer/ChangeLog | 6 ++++ gcc/analyzer/region-model.cc | 6 ++-- gcc/testsuite/ChangeLog | 5 ++++ gcc/testsuite/gcc.dg/analyzer/torture/pr93947.c | 40 +++++++++++++++++++++++++ 4 files changed, 55 insertions(+), 2 deletions(-) diff --git a/gcc/analyzer/ChangeLog b/gcc/analyzer/ChangeLog index 982cc3ca9fd..92377be4992 100644 --- a/gcc/analyzer/ChangeLog +++ b/gcc/analyzer/ChangeLog @@ -1,3 +1,9 @@ +2020-02-26 David Malcolm + + PR analyzer/93947 + * region-model.cc (region_model::get_fndecl_for_call): Gracefully + fail for fn_decls that don't have a cgraph_node. + 2020-02-26 David Malcolm * bar-chart.cc: New file. diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc index a71884d7b11..b2179bd220a 100644 --- a/gcc/analyzer/region-model.cc +++ b/gcc/analyzer/region-model.cc @@ -6732,8 +6732,10 @@ region_model::get_fndecl_for_call (const gcall *call, tree fn_decl = code->get_tree_for_child_region (fn_rid); if (!fn_decl) return NULL_TREE; - const cgraph_node *ultimate_node - = cgraph_node::get (fn_decl)->ultimate_alias_target (); + cgraph_node *node = cgraph_node::get (fn_decl); + if (!node) + return NULL_TREE; + const cgraph_node *ultimate_node = node->ultimate_alias_target (); if (ultimate_node) return ultimate_node->decl; } diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog index 105fa854160..c6158b38ca0 100644 --- a/gcc/testsuite/ChangeLog +++ b/gcc/testsuite/ChangeLog @@ -1,3 +1,8 @@ +2020-02-26 David Malcolm + + PR analyzer/93947 + * gcc.dg/analyzer/torture/pr93947.c: New test. + 2020-02-26 Iain Sandoe * g++.dg/coroutines/coro1-refs-and-ctors.h: New. diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/pr93947.c b/gcc/testsuite/gcc.dg/analyzer/torture/pr93947.c new file mode 100644 index 00000000000..73982ef4bd3 --- /dev/null +++ b/gcc/testsuite/gcc.dg/analyzer/torture/pr93947.c @@ -0,0 +1,40 @@ +/* { dg-skip-if "" { *-*-* } { "-fno-fat-lto-objects" } { "" } } */ + +#include "../analyzer-decls.h" + +struct pf { + unsigned int iu : 2; +}; + +enum { + qr, jv, vm, mz, +}; + +int uh; + +void +w9 (struct pf *x2) +{ + /* We ought to know the following based on the bitfield width. */ + __analyzer_eval (x2->iu >= 0 ); /* { dg-warning "TRUE" } */ + __analyzer_eval (x2->iu < 4 ); /* { dg-warning "TRUE" } */ + + switch (x2->iu) + { + case qr: + case jv: + case vm: + uh = 0; + break; + + case mz: + break; + + default: + /* We ought to know from the enum values that this code is unreachable, + and thus not print anything. + TODO(xfail): currently this doesn't work. */ + __analyzer_eval (x2->iu); /* { dg-bogus "" "" { xfail *-*-* } } */ + __builtin_abort (); + } +}