mirror/gcc
2
0
Fork 0
mirror of git://gcc.gnu.org/git/gcc.git synced 2025-04-18 16:11:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

analyzer: fix ICEs treeifying offset_region [PR96646, PR96841]

Browse Source 
gcc/analyzer/ChangeLog:
	PR analyzer/96646
	PR analyzer/96841
	* region-model.cc (region_model::get_representative_path_var):
	When handling offset_region, wrap the MEM_REF's first argument in
	an ADDR_EXPR of pointer type, rather than simply using the tree
	for the parent region.  Require the MEM_REF's second argument to
	be an integer constant.

gcc/testsuite/ChangeLog:
	PR analyzer/96646
	PR analyzer/96841
	* gcc.dg/analyzer/pr96646.c: New test.
	* gcc.dg/analyzer/pr96841.c: New test.
This commit is contained in:
David Malcolm 2020-09-25 17:15:42 -04:00
parent cdd8f031c7
commit 29f5db8ef8
3 changed files with 52 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
gcc/analyzer/region-model.cc
View File

@ -2140,11 +2140,14 @@ region_model::get_representative_path_var (const region *reg,
path_var offset_pv
= get_representative_path_var (offset_reg->get_byte_offset (),
visited);
if (!offset_pv)
if (!offset_pv || TREE_CODE (offset_pv.m_tree) != INTEGER_CST)
return path_var (NULL_TREE, 0);
tree addr_parent = build1 (ADDR_EXPR,
build_pointer_type (reg->get_type ()),
parent_pv.m_tree);
return path_var (build2 (MEM_REF,
reg->get_type (),
parent_pv.m_tree, offset_pv.m_tree),
addr_parent, offset_pv.m_tree),
parent_pv.m_stack_depth);
}

24
gcc/testsuite/gcc.dg/analyzer/pr96646.c Normal file
View File

@ -0,0 +1,24 @@
/* { dg-additional-options "-O1" } */
struct zx {
struct zx *b4, *g0;
};
struct oo {
void *ph;
struct zx el;
};
inline void
k7 (struct zx *xj)
{
xj->b4->g0 = 0; /* { dg-warning "dereference of NULL" } */
xj->b4 = 0;
}
void
n8 (struct oo *yx)
{
k7 (&yx->el);
n8 (yx);
}

23
gcc/testsuite/gcc.dg/analyzer/pr96841.c Normal file
View File

@ -0,0 +1,23 @@
/* { dg-additional-options "-O1 -Wno-builtin-declaration-mismatch" } */
int
l8 (void);
__SIZE_TYPE__
malloc (__SIZE_TYPE__);
void
th (int *);
void
bv (__SIZE_TYPE__ ny)
{
int ***mf;
while (l8 ())
{
*mf = 0;
(*mf)[ny] = (int *) malloc (sizeof (int));
th ((*mf)[ny]); /* { dg-warning "leak" } */
}
}