From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2209) id E5496385803D; Thu, 6 Jan 2022 22:43:12 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E5496385803D MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="utf-8" From: David Malcolm To: gcc-cvs@gcc.gnu.org Subject: [gcc r12-6323] analyzer: make use of may_be_aliased in alias detection [PR103546] X-Act-Checkin: gcc X-Git-Author: David Malcolm X-Git-Refname: refs/heads/master X-Git-Oldrev: 8e2771069ed0c157cca825d6af5792e94c4407c1 X-Git-Newrev: d564a83d14252d7db01381f71900b7a68357803b Message-Id: <20220106224312.E5496385803D@sourceware.org> Date: Thu, 6 Jan 2022 22:43:12 +0000 (GMT) X-BeenThere: gcc-cvs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-cvs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Jan 2022 22:43:13 -0000 https://gcc.gnu.org/g:d564a83d14252d7db01381f71900b7a68357803b commit r12-6323-gd564a83d14252d7db01381f71900b7a68357803b Author: David Malcolm Date: Thu Jan 6 11:39:54 2022 -0500 analyzer: make use of may_be_aliased in alias detection [PR103546] Whilst debugging PR analyzer/103546 (false +ve in flex-generated lexers) I noticed that the analyzer was considering that writes through symbolic pointers could be treated as clobbering static globals such as: static YY_BUFFER_STATE * yy_buffer_stack = NULL; even for such variables that never have their address taken. This patch fixes this issue at least, so that the analyzer can preserve knowledge of such globals on code paths with writes through symbolic pointers. It does not fix the false +ve in the lexer code. gcc/analyzer/ChangeLog: PR analyzer/103546 * store.cc (store::eval_alias_1): Refactor handling of decl regions, adding a test for may_be_aliased, rejecting those for which it returns false. gcc/testsuite/ChangeLog: PR analyzer/103546 * gcc.dg/analyzer/aliasing-3.c: New test. Signed-off-by: David Malcolm Diff: --- gcc/analyzer/store.cc | 18 ++++--- gcc/testsuite/gcc.dg/analyzer/aliasing-3.c | 75 ++++++++++++++++++++++++++++++ 2 files changed, 86 insertions(+), 7 deletions(-) diff --git a/gcc/analyzer/store.cc b/gcc/analyzer/store.cc index 8729aa8dab6..3f91b6107a9 100644 --- a/gcc/analyzer/store.cc +++ b/gcc/analyzer/store.cc @@ -2456,13 +2456,17 @@ store::eval_alias_1 (const region *base_reg_a, = base_reg_a->dyn_cast_symbolic_region ()) { const svalue *sval_a = sym_reg_a->get_pointer (); - if (sval_a->get_kind () == SK_INITIAL) - if (tree decl_b = base_reg_b->maybe_get_decl ()) - if (!is_global_var (decl_b)) - { - /* The initial value of a pointer can't point to a local. */ - return tristate::TS_FALSE; - } + if (tree decl_b = base_reg_b->maybe_get_decl ()) + { + if (!may_be_aliased (decl_b)) + return tristate::TS_FALSE; + if (sval_a->get_kind () == SK_INITIAL) + if (!is_global_var (decl_b)) + { + /* The initial value of a pointer can't point to a local. */ + return tristate::TS_FALSE; + } + } if (sval_a->get_kind () == SK_INITIAL && base_reg_b->get_kind () == RK_HEAP_ALLOCATED) { diff --git a/gcc/testsuite/gcc.dg/analyzer/aliasing-3.c b/gcc/testsuite/gcc.dg/analyzer/aliasing-3.c new file mode 100644 index 00000000000..003077ad5c1 --- /dev/null +++ b/gcc/testsuite/gcc.dg/analyzer/aliasing-3.c @@ -0,0 +1,75 @@ +#include "analyzer-decls.h" + +#define NULL ((void *)0) + +struct s1 +{ + int f1; +}; + +static struct s1 *p1_glob = NULL; + +void test_1 (struct s1 **pp1, struct s1 *p1_parm) +{ + struct s1 *init_p1_glob = p1_glob; + + __analyzer_eval (p1_glob == init_p1_glob); /* { dg-warning "TRUE" } */ + + if (!p1_glob) + return; + + __analyzer_eval (p1_glob == init_p1_glob); /* { dg-warning "TRUE" } */ + __analyzer_eval (p1_glob != NULL); /* { dg-warning "TRUE" } */ + + *pp1 = p1_parm; + + /* The write through *pp1 can't have changed p1_glob, because + we never take a pointer to p1_glob (and it's static to this TU). */ + __analyzer_eval (p1_glob == init_p1_glob); /* { dg-warning "TRUE" } */ + __analyzer_eval (p1_glob != NULL); /* { dg-warning "TRUE" } */ +} + +struct s2 +{ + int f1; +}; + +static struct s2 *p2_glob = NULL; + +void test_2 (struct s2 **pp2, struct s2 *p2_parm) +{ + /* Ensure that p2_glob is modified. */ + p2_glob = __builtin_malloc (sizeof (struct s2)); + if (!p2_glob) + return; + + __analyzer_eval (p2_glob != NULL); /* { dg-warning "TRUE" } */ + + *pp2 = p2_parm; + + /* The write through *pp2 can't have changed p2_glob, because + we never take a pointer to p2_glob (and it's static to this TU). */ + __analyzer_eval (p2_glob != NULL); /* { dg-warning "TRUE" } */ +} + +struct s3 +{ + int f1; +}; + +struct s3 *p3_glob = NULL; + +void test_3 (struct s3 **pp3, struct s3 *p3_parm) +{ + p3_glob = __builtin_malloc (sizeof (struct s3)); + if (!p3_glob) + return; + + __analyzer_eval (p3_glob != NULL); /* { dg-warning "TRUE" } */ + + *pp3 = p3_parm; + + /* The write through *pp3 could have changed p3_glob, because + another TU could take a pointer to p3_glob. */ + __analyzer_eval (p3_glob != NULL); /* { dg-warning "UNKNOWN" } */ +}