Re: [GSoC][Static Analyzer] Some questions and request for a small patch to work on

[Shengyu Huang <kumom.huang@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 4232 bytes --]

Hi Dave,

> On 1 Mar 2023, at 00:59, David Malcolm <dmalcolm@redhat.com> wrote:
> 
> Did you get it to output your messages?
> 


Yes, I chose to emit the warning before the supergraph or exploded graph is created (I guess this is enough, right?). I checked out from the trunk a week ago, and I checked out from the latest trunk just now and built from modified source again, by adding a line in the following code in analyzer/engine.cc:

FOR_EACH_FUNCTION_WITH_GIMPLE_BODY (node) {
  node->get_untransformed_body ();
  warning_at (DECL_SOURCE_LOCATION (node->decl), 0, "hello world, I’m compiling %qE", node->decl); // ADDED
}

Compiling my own test script without optimizations, I got the output (surprisingly no warning from -Wanalyzer-shift-count-negative anymore):

test.c: In function 'main':
test.c:42:9: warning: left shift count is negative [-Wshift-count-negative]
   42 |   b = b << -1;
      |         ^~
test.c: At top level:
test.c:36:5: warning: hello world, I'm compiling 'main'
   36 | int main()
      |     ^~~~
test.c:27:6: warning: hello world, I'm compiling 're'
   27 | void re (int c)
      |      ^~
test.c:12:6: warning: hello world, I'm compiling 'f'
   12 | void f (unsigned long *p, int r, int i)
      |      ^
test.c:9:5: warning: hello world, I'm compiling 'fun2'
    9 | int fun2()
      |     ^~~~
test.c:4:5: warning: hello world, I'm compiling 'fun1'
    4 | int fun1()
      |     ^~~~
test.c: In function 'main':
test.c:40:8: warning: use of uninitialized value 'a' [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
   40 |   int* c = a;
      |        ^
  'main': events 1-3
    |
    |   38 |   int* a;
    |      |        ^
    |      |        |
    |      |        (1) region created on stack here
    |      |        (2) capacity: 8 bytes
    |   39 |   int b = 'c';
    |   40 |   int* c = a;
    |      |        ~
    |      |        |
    |      |        (3) use of uninitialized value 'a' here
    |
~~

If I compiled it with -O2, I got additionally 

test.c: In function 'f':
test.c:20:34: warning: shift by count ('64') >= precision of type ('64') [-Wanalyzer-shift-count-overflow]
   20 |       p[i--] = b + 1 >= 64 ? 0UL : 1UL << (b + 1);
      |                ~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~
  'f': events 1-5
    |
    |   16 |   while (i >= 0)
    |      |          ~~^~~~
    |      |            |
    |      |            (1) following 'true' branch (when 'i >= 0')...
    |   17 |   {
    |   18 |     if (n > b)
    |      |        ~    
    |      |        |
    |      |        (2) ...to here
    |      |        (3) following 'true' branch (when 'b < n')...
    |   19 |     {
    |   20 |       p[i--] = b + 1 >= 64 ? 0UL : 1UL << (b + 1);
    |      |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                                  |           |
    |      |                                  |           (4) ...to here
    |      |                                  (5) shift by count '64' here
    |


which is documented as a false positive in PR98447.


> 
> The next thing to do might be to try stepping through the code in the
> debugger; that's often a good way to learn about a new codebase.  See:
>  https://gcc-newbies-guide.readthedocs.io/en/latest/debugging.html
> and maybe have a look at the support scripts mentioned on that page.
> 

I did try to use gdb more to inspect the internals, but one thing I noticed when using it is that I got `??()` in the backtrace, which I’ve never seen before. Some online sources say it happened due to “corrupted stack”, but I don’t know how that can happen either…However, after pulling changes from the trunk and rebuilding from the source, “??()” disappeared and now I can step through the execution without any problem (previously `step` and `continue` did not work as expected…). Do you have any clues what happened so that I can fix it myself later if that happens again?

Best,
Shengyu

> BTW, are you building trunk, or GCC 12?  I've made a *lot* of changes
> to the analyzer in trunk, so it would be good for you to be working
> with something that's reasonably up-to-date.