From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id 046F23858430 for ; Wed, 10 Aug 2022 18:44:05 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 046F23858430 Received: from mail-qk1-f198.google.com (mail-qk1-f198.google.com [209.85.222.198]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-557-6Vj9vx_dMHGvWWh6DphaHQ-1; Wed, 10 Aug 2022 14:44:02 -0400 X-MC-Unique: 6Vj9vx_dMHGvWWh6DphaHQ-1 Received: by mail-qk1-f198.google.com with SMTP id n15-20020a05620a294f00b006b5768a0ed0so13078611qkp.7 for ; Wed, 10 Aug 2022 11:44:01 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:user-agent:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-message-state :from:to:cc; bh=bR3ezdl3DKdZS9E5qOUDD3o/E2+fdhH4dFNo01rJfvI=; b=0YPgBUm4BhSF6I3Fk3G+VVXsNge8FdqStJzEbBoeGhdsJK0bvI7fFtlIJZuVhC7m/l dwqcuE9gMWzUeUYyqjxwGkeEwQ7ivCy330lNSna85tB2EBdcaj10KHV2HfM3ruefX4KW fDW4iOONEj5AYttKiAMypIKr44qlU2OB7MZuiwQ/zsuHeoyCkRUZx0vMBwc4AxVNkqIb qVDkkgkbjJiqUQF2mjJPkHwUGZuwQb/IXgIwaAgBXZrU27moMrz908//7q11R68bUStH qJ4cSNLru8pOjp3F1junAbmEfkXcxlzf5rnQ+bBMT7hjodUnDG/VBJ5BDllrDnFotGJc 1Ucw== X-Gm-Message-State: ACgBeo2/5+pD6ibp0qt28YSW6dv16uJuV5PsEo+eMdMTcQZacQFkO44+ oiFGPTA+K7drU7qW9HPEequ5EXWuzir0NDZ4I+nHQhAjdTL8GXbj9UXwCt624pnL8nwjcXSSwRd 4xu4qxMnVV5AAYoWiRA== X-Received: by 2002:ac8:5ad1:0:b0:343:5e13:795d with SMTP id d17-20020ac85ad1000000b003435e13795dmr2662166qtd.625.1660157041232; Wed, 10 Aug 2022 11:44:01 -0700 (PDT) X-Google-Smtp-Source: AA6agR6IKD1/Q2dQn4158c9YhXMQHYHb4KQmML9qS9YR0NhJTRXANjJZAMU3aCaLAJItV0wjxeTBGA== X-Received: by 2002:ac8:5ad1:0:b0:343:5e13:795d with SMTP id d17-20020ac85ad1000000b003435e13795dmr2662155qtd.625.1660157040999; Wed, 10 Aug 2022 11:44:00 -0700 (PDT) Received: from t14s.localdomain (c-73-69-212-193.hsd1.nh.comcast.net. [73.69.212.193]) by smtp.gmail.com with ESMTPSA id ay33-20020a05620a17a100b006b8d9d53605sm348763qkb.125.2022.08.10.11.43.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 10 Aug 2022 11:44:00 -0700 (PDT) Message-ID: Subject: Re: [PATCH] analyzer: fix ICE casued by dup2 in sm-fd.cc[PR106551] From: David Malcolm To: Mir Immad Cc: gcc-patches@gcc.gnu.org Date: Wed, 10 Aug 2022 14:43:59 -0400 In-Reply-To: References: <2022febb8297564e4cd6f349f16bba6e8b91509b.camel@redhat.com> User-Agent: Evolution 3.38.4 (3.38.4-1.fc33) MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-11.0 required=5.0 tests=BAYES_00, BODY_8BITS, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_LOW, SPF_HELO_NONE, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2022 18:44:07 -0000 On Wed, 2022-08-10 at 22:51 +0530, Mir Immad wrote: >  > Can you please rebase and see if your patch > > does fix it? > > No, the patch that I sent did not attempt to fix this. Now that I > have made > the correction, XFAIL in fd-uninit-1.c has changed to XPASS. Great - that means that, with your fix, we no longer bogusly emit that false positive. > > Should i remove the dg-bogus warning from fd-uninit-1.c test_1? Yes please. Thanks Dave > > Thanks. > Immad. > > > On Wed, Aug 10, 2022 at 10:26 PM David Malcolm > wrote: > > > On Wed, 2022-08-10 at 20:34 +0530, Mir Immad wrote: > > >  > if you convert the "int m;" locals into an extern global, like > > > in > > > > comment #0 of bug 106551, does that still trigger the crash on > > > > the > > > > unpatched sm-fd.cc? > > > > > > Yes, it does, since m would be in "m_start" state. I'm sending an > > > updated > > > patch. > > > > Great! > > > > Note that I recently committed a fix for bug 106573, which has an > > xfail > > on a dg-bogus to mark a false positive which your patch hopefully > > also > > fixes (in fd-uninit-1.c).  Can you please rebase and see if your > > patch > > does fix it? > > > > Thanks > > Dave > > > > > > > > > > Thanks > > > Immad. > > > > > > On Wed, Aug 10, 2022 at 1:32 AM David Malcolm < > > > dmalcolm@redhat.com> > > > wrote: > > > > > > > On Tue, 2022-08-09 at 21:42 +0530, Immad Mir wrote: > > > > > This patch fixes the ICE caused by valid_to_unchecked_state, > > > > > at analyzer/sm-fd.cc by handling the m_start state in > > > > > check_for_dup. > > > > > > > > > > Tested lightly on x86_64. > > > > > > > > > > gcc/analyzer/ChangeLog: > > > > >         PR analyzer/106551 > > > > >         * sm-fd.cc (check_for_dup): handle the m_start > > > > >         state when transitioning the state of LHS > > > > >         of dup, dup2 and dup3 call. > > > > > > > > > > gcc/testsuite/ChangeLog: > > > > >         * gcc.dg/analyzer/fd-dup-1.c: New testcases. > > > > > > > > > > Signed-off-by: Immad Mir > > > > > --- > > > > >  gcc/analyzer/sm-fd.cc                    |  4 ++-- > > > > >  gcc/testsuite/gcc.dg/analyzer/fd-dup-1.c | 28 > > > > > +++++++++++++++++++++++- > > > > >  2 files changed, 29 insertions(+), 3 deletions(-) > > > > > > > > > > diff --git a/gcc/analyzer/sm-fd.cc b/gcc/analyzer/sm-fd.cc > > > > > index 8bb76d72b05..c8b9930a7b6 100644 > > > > > --- a/gcc/analyzer/sm-fd.cc > > > > > +++ b/gcc/analyzer/sm-fd.cc > > > > > @@ -983,7 +983,7 @@ fd_state_machine::check_for_dup > > > > > (sm_context > > > > > *sm_ctxt, const supernode *node, > > > > >      case DUP_1: > > > > >        if (lhs) > > > > >         { > > > > > -         if (is_constant_fd_p (state_arg_1)) > > > > > +         if (is_constant_fd_p (state_arg_1) || state_arg_1 > > > > > == > > > > > m_start) > > > > >             sm_ctxt->set_next_state (stmt, lhs, > > > > > m_unchecked_read_write); > > > > >           else > > > > >             sm_ctxt->set_next_state (stmt, lhs, > > > > > @@ -1011,7 +1011,7 @@ fd_state_machine::check_for_dup > > > > > (sm_context > > > > > *sm_ctxt, const supernode *node, > > > > >        file descriptor i.e the first argument.  */ > > > > >        if (lhs) > > > > >         { > > > > > -         if (is_constant_fd_p (state_arg_1)) > > > > > +         if (is_constant_fd_p (state_arg_1) || state_arg_1 > > > > > == > > > > > m_start) > > > > >             sm_ctxt->set_next_state (stmt, lhs, > > > > > m_unchecked_read_write); > > > > >           else > > > > >             sm_ctxt->set_next_state (stmt, lhs, > > > > > diff --git a/gcc/testsuite/gcc.dg/analyzer/fd-dup-1.c > > > > > b/gcc/testsuite/gcc.dg/analyzer/fd-dup-1.c > > > > > index eba2570568f..ed4d6de57db 100644 > > > > > --- a/gcc/testsuite/gcc.dg/analyzer/fd-dup-1.c > > > > > +++ b/gcc/testsuite/gcc.dg/analyzer/fd-dup-1.c > > > > > @@ -220,4 +220,30 @@ test_19 (const char *path, void *buf) > > > > >          close (fd); > > > > >      } > > > > > > > > > > -} > > > > > \ No newline at end of file > > > > > +} > > > > > + > > > > > +void > > > > > +test_20 () > > > > > +{ > > > > > +    int m; > > > > > +    int fd = dup (m); /* { dg-warning "'dup' on possibly > > > > > invalid > > > > > file descriptor 'm'" } */ > > > > > +    close (fd); > > > > > +} > > > > > + > > > > > +void > > > > > +test_21 () > > > > > +{ > > > > > +    int m; > > > > > +    int fd = dup2 (m, 1); /* { dg-warning "'dup2' on > > > > > possibly > > > > > invalid file descriptor 'm'" } */ > > > > > +    close (fd); > > > > > +} > > > > > + > > > > > +void > > > > > +test_22 (int flags) > > > > > +{ > > > > > +    int m; > > > > > +    int fd = dup3 (m, 1, flags); /* { dg-warning "'dup3' on > > > > > possibly > > > > > invalid file descriptor 'm'" } */ > > > > > +    close (fd); > > > > > +} > > > > > > > > Thanks for the updated patch. > > > > > > > > The test cases looked suspicious to me - I was wondering why > > > > the > > > > analyzer doesn't complain about the uninitialized values being > > > > passed > > > > to the various dup functions as parameters.  So your test cases > > > > seem to > > > > have uncovered a hidden pre-existing bug in the analyzer's > > > > uninitialized value detection, which I've filed for myself to > > > > deal > > > > with > > > > as PR analyzer/106573. > > > > > > > > If you convert the "int m;" locals into an extern global, like > > > > in > > > > comment #0 of bug 106551, does that still trigger the crash on > > > > the > > > > unpatched sm-fd.cc?  If so, then that's greatly preferable as a > > > > regression test, since otherwise I'll have to modify that test > > > > case > > > > when I fix bug 106573. > > > > > > > > Dave > > > > > > > > > > > > > > > > > > > > > >