[gcc r13-1807] analyzer: fix state explosion on va_arg [PR106413]

[gcc r13-1807] analyzer: fix state explosion on va_arg [PR106413]

[David Malcolm]

https://gcc.gnu.org/g:6d5194a10dc103031b9c8a03091ca70f6db33c8b

commit r13-1807-g6d5194a10dc103031b9c8a03091ca70f6db33c8b
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Fri Jul 22 19:50:54 2022 -0400

    analyzer: fix state explosion on va_arg [PR106413]
    
    Fix state explosion on va_arg when the call to va_start is in the
    top-level function of the analysis.
    
    gcc/analyzer/ChangeLog:
            PR analyzer/106413
            * varargs.cc (region_model::impl_call_va_start): Avoid iterating
            through non-existant variadic arguments by initializing the
            impl_region to "UNKNOWN" if the va_start occurs in the top-level
            function to the analysis.
    
    gcc/testsuite/ChangeLog:
            PR analyzer/106413
            * gcc.dg/analyzer/torture/stdarg-4.c: New test.
    
    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

Diff:
---
 gcc/analyzer/varargs.cc                          |  26 +-
 gcc/testsuite/gcc.dg/analyzer/torture/stdarg-4.c | 329 +++++++++++++++++++++++
 2 files changed, 350 insertions(+), 5 deletions(-)

diff --git a/gcc/analyzer/varargs.cc b/gcc/analyzer/varargs.cc
index c45585ce457..9400086b10e 100644
--- a/gcc/analyzer/varargs.cc
+++ b/gcc/analyzer/varargs.cc
@@ -667,11 +667,27 @@ region_model::impl_call_va_start (const call_details &cd)
   const svalue *ptr_to_impl_reg = m_mgr->get_ptr_svalue (NULL_TREE, impl_reg);
   set_value (out_reg, ptr_to_impl_reg, cd.get_ctxt ());
 
-  /* "*(&IMPL_REGION) = VA_LIST_VAL (0);".  */
-  const region *init_var_arg_reg
-    = m_mgr->get_var_arg_region (get_current_frame (), 0);
-  const svalue *ap_sval = m_mgr->get_ptr_svalue (NULL_TREE, init_var_arg_reg);
-  set_value (impl_reg, ap_sval, cd.get_ctxt ());
+  if (get_stack_depth () > 1)
+    {
+      /* The interprocedural case: the frame containing the va_start call
+	 will have been populated with any variadic aruguments.
+	 Initialize IMPL_REGION with a ptr to var_arg_region 0.  */
+      const region *init_var_arg_reg
+	= m_mgr->get_var_arg_region (get_current_frame (), 0);
+      const svalue *ap_sval
+	= m_mgr->get_ptr_svalue (NULL_TREE, init_var_arg_reg);
+      set_value (impl_reg, ap_sval, cd.get_ctxt ());
+    }
+  else
+    {
+      /* The frame containing va_start is an entry-point to the analysis,
+	 so there won't be any specific var_arg_regions populated within it.
+	 Initialize IMPL_REGION as the UNKNOWN_SVALUE to avoid state
+	 explosions on repeated calls to va_arg.  */
+      const svalue *unknown_sval
+	= m_mgr->get_or_create_unknown_svalue (NULL_TREE);
+      set_value (impl_reg, unknown_sval, cd.get_ctxt ());
+    }
 }
 
 /* Handle the on_call_pre part of "__builtin_va_copy".  */
diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/stdarg-4.c b/gcc/testsuite/gcc.dg/analyzer/torture/stdarg-4.c
new file mode 100644
index 00000000000..8275b0fa9ba
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/torture/stdarg-4.c
@@ -0,0 +1,329 @@
+/* { dg-skip-if "" { *-*-* } { "-fno-fat-lto-objects" } { "" } } */
+
+#include "../analyzer-decls.h"
+
+/* va_arg in loop, with no caller to function containing va_start.  */
+
+int test_1a (const char *fmt, ...)
+{
+  __builtin_va_list args;
+  int sum = 0;
+  char ch;
+
+  __builtin_va_start(args, fmt);
+
+  while (ch = *fmt++)
+    if (ch == '%')
+      sum += __builtin_va_arg(args, int);
+
+  __builtin_va_end(args);
+
+  return sum;
+}
+
+/* va_arg in loop, with no caller to function containing va_start.  */
+
+static int test_1b_callee (const char *fmt, __builtin_va_list args)
+{
+  int sum = 0;
+  char ch;
+
+  while (ch = *fmt++)
+    if (ch == '%')
+      sum += __builtin_va_arg(args, int);
+
+  return sum;
+}
+
+int test_1b_caller (const char *fmt, ...)
+{
+  __builtin_va_list args;
+  int sum = 0;
+
+  __builtin_va_start(args, fmt);
+
+  sum = test_1b_callee (fmt, args);
+
+  __builtin_va_end(args);
+
+  return sum;
+}
+
+/* va_arg in loop, with a caller to the function containing va_start,
+   with specific args.  */
+
+static int
+test_1c_inner (const char *fmt, __builtin_va_list args)
+{
+  int sum = 0;
+  char ch;
+
+  while (ch = *fmt++)
+    if (ch == '%')
+      sum += __builtin_va_arg(args, int);
+
+  return sum;
+}
+
+static int
+test_1c_middle (const char *fmt, ...)
+{
+  __builtin_va_list args;
+  int sum = 0;
+
+  __builtin_va_start(args, fmt);
+
+  sum = test_1c_inner (fmt, args);
+
+  __builtin_va_end(args);
+
+  return sum;
+}
+
+void test_1c_outer (void)
+{
+  int sum = test_1c_middle ("%%", 42, 17);
+
+  __analyzer_describe (0, sum); /* { dg-message "'\\(int\\)59'" } */
+}
+
+/* va_arg in loop, with no caller to function containing va_start.  */
+
+int test_2a (int count, ...)
+{
+  __builtin_va_list args;
+  int sum = 0;
+  char ch;
+
+  __builtin_va_start(args, count);
+
+  while (count-- > 0)
+    sum += __builtin_va_arg(args, int);
+
+  __builtin_va_end(args);
+
+  return sum;
+}
+
+/* va_arg in loop, with no caller to function containing va_start.  */
+
+static int test_2b_callee (int count, __builtin_va_list args)
+{
+  int sum = 0;
+
+  while (count-- > 0)
+    sum += __builtin_va_arg(args, int);
+
+  return sum;
+}
+
+int test_2b_caller (int count, ...)
+{
+  __builtin_va_list args;
+  int sum = 0;
+
+  __builtin_va_start(args, count);
+
+  sum = test_2b_callee (count, args);
+
+  __builtin_va_end(args);
+
+  return sum;
+}
+
+/* va_arg in loop, with a caller to the function containing va_start,
+   with specific args.  */
+
+static int test_2c_inner (int count, __builtin_va_list args)
+{
+  int sum = 0;
+
+  while (count-- > 0)
+    sum += __builtin_va_arg(args, int);
+
+  return sum;
+}
+
+int test_2c_middle (int count, ...)
+{
+  __builtin_va_list args;
+  int sum = 0;
+
+  __builtin_va_start(args, count);
+
+  sum = test_2c_inner (count, args);
+
+  __builtin_va_end(args);
+
+  return sum;
+}
+
+void test_2c_outer (void)
+{
+  int sum = test_2c_middle (2, 50, 42);
+
+  __analyzer_describe (0, sum); /* { dg-message "'\\(int\\)92'" } */
+}
+
+/* va_arg in loop, with no caller to function containing va_start.  */
+
+int test_3a (int placeholder, ...)
+{
+  __builtin_va_list args;
+  int sum = 0;
+  int val;
+
+  __builtin_va_start(args, placeholder);
+
+  while (val = __builtin_va_arg(args, int))
+    sum += val;
+
+  __builtin_va_end(args);
+
+  return sum;
+}
+
+/* va_arg in loop, with no caller to function containing va_start.  */
+
+static int test_3b_callee (__builtin_va_list args)
+{
+  int sum = 0;
+  int val;
+  while (val = __builtin_va_arg(args, int))
+    sum += val;
+  return sum;
+}
+
+int test_3b_caller (int placeholder, ...)
+{
+  __builtin_va_list args;
+  int sum = 0;
+
+  __builtin_va_start(args, placeholder);
+
+  sum = test_3b_callee (args);
+
+  __builtin_va_end(args);
+
+  return sum;
+}
+
+/* va_arg in loop, with a caller to the function containing va_start,
+   with specific args.  */
+
+static int test_3c_inner (__builtin_va_list args)
+{
+  int sum = 0;
+  int val;
+  while (val = __builtin_va_arg(args, int))
+    sum += val;
+  return sum;
+}
+
+int test_3c_middle (int placeholder, ...)
+{
+  __builtin_va_list args;
+  int sum = 0;
+
+  __builtin_va_start(args, placeholder);
+
+  sum = test_3c_inner (args);
+
+  __builtin_va_end(args);
+
+  return sum;
+}
+
+void test_3c_outer (void)
+{
+  int sum = test_3c_middle (0, 5, 12, 0);
+  __analyzer_describe (0, sum); /* { dg-message "'\\(int\\)17'" } */
+}
+
+/* va_arg in loop, with no caller to function containing va_start,
+   with a va_copy.  */
+
+static int test_3d_callee (__builtin_va_list args)
+{
+  int sum = 0;
+  int val;
+  while (val = __builtin_va_arg(args, int))
+    sum += val;
+  return sum;
+}
+
+int test_3d_caller (int placeholder, ...)
+{
+  __builtin_va_list args1, args2;
+  int sum = 0;
+
+  __builtin_va_start(args1, placeholder);
+  __builtin_va_copy (args2, args1);
+
+  sum = test_3d_callee (args1);
+  __builtin_va_end(args1);
+
+  sum += test_3d_callee (args2);
+  __builtin_va_end(args2);
+
+  return sum;
+}
+
+/* va_arg in loop, with a caller to the function containing va_start,
+   with specific args, with a va_copy.  */
+
+static int test_3e_inner (__builtin_va_list args)
+{
+  int sum = 0;
+  int val;
+  while (val = __builtin_va_arg(args, int))
+    sum += val;
+  return sum;
+}
+
+int test_3e_middle (int placeholder, ...)
+{
+  __builtin_va_list args1, args2;
+  int sum = 0;
+
+  __builtin_va_start(args1, placeholder);
+  __builtin_va_copy (args2, args1);
+
+  sum = test_3e_inner (args1);
+  __builtin_va_end(args1);
+
+  sum += test_3e_inner (args2);
+  __builtin_va_end(args2);
+
+  return sum;
+}
+
+void test_3e_outer (void)
+{
+  int sum = test_3e_middle (0, 5, 6, 0);
+  __analyzer_describe (0, sum); /* { dg-message "'\\(int\\)22'" } */
+}
+
+/* va_arg in loop, with specific symbolic args.  */
+
+static int test_3f_callee (int placeholder, ...)
+{
+  __builtin_va_list args;
+  int sum = 0;
+  int val;
+
+  __builtin_va_start(args, placeholder);
+
+  while (val = __builtin_va_arg(args, int))
+    sum += val;
+
+  __builtin_va_end(args);
+
+  return sum;
+}
+
+void test_3f_caller (int x, int y, int z)
+{
+  int sum = test_3f_callee (0, x, y, z, 0);
+  __analyzer_describe (0, sum); /* { dg-message "'UNKNOWN\\(int\\)'" } */
+}