analyzer: fix state explosion on va_arg [PR106413]
Fix state explosion on va_arg when the call to va_start is in the top-level function of the analysis. gcc/analyzer/ChangeLog: PR analyzer/106413 * varargs.cc (region_model::impl_call_va_start): Avoid iterating through non-existant variadic arguments by initializing the impl_region to "UNKNOWN" if the va_start occurs in the top-level function to the analysis. gcc/testsuite/ChangeLog: PR analyzer/106413 * gcc.dg/analyzer/torture/stdarg-4.c: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
This commit is contained in:
David Malcolm
parent
0fb35a45a2
commit
6d5194a10d
2 changed files with 350 additions and 5 deletions
|
|
@ -667,11 +667,27 @@ region_model::impl_call_va_start (const call_details &cd)
|
|||
const svalue *ptr_to_impl_reg = m_mgr->get_ptr_svalue (NULL_TREE, impl_reg);
|
||||
set_value (out_reg, ptr_to_impl_reg, cd.get_ctxt ());
|
||||
|
||||
/* "*(&IMPL_REGION) = VA_LIST_VAL (0);". */
|
||||
const region *init_var_arg_reg
|
||||
= m_mgr->get_var_arg_region (get_current_frame (), 0);
|
||||
const svalue *ap_sval = m_mgr->get_ptr_svalue (NULL_TREE, init_var_arg_reg);
|
||||
set_value (impl_reg, ap_sval, cd.get_ctxt ());
|
||||
if (get_stack_depth () > 1)
|
||||
{
|
||||
/* The interprocedural case: the frame containing the va_start call
|
||||
will have been populated with any variadic aruguments.
|
||||
Initialize IMPL_REGION with a ptr to var_arg_region 0. */
|
||||
const region *init_var_arg_reg
|
||||
= m_mgr->get_var_arg_region (get_current_frame (), 0);
|
||||
const svalue *ap_sval
|
||||
= m_mgr->get_ptr_svalue (NULL_TREE, init_var_arg_reg);
|
||||
set_value (impl_reg, ap_sval, cd.get_ctxt ());
|
||||
}
|
||||
else
|
||||
{
|
||||
/* The frame containing va_start is an entry-point to the analysis,
|
||||
so there won't be any specific var_arg_regions populated within it.
|
||||
Initialize IMPL_REGION as the UNKNOWN_SVALUE to avoid state
|
||||
explosions on repeated calls to va_arg. */
|
||||
const svalue *unknown_sval
|
||||
= m_mgr->get_or_create_unknown_svalue (NULL_TREE);
|
||||
set_value (impl_reg, unknown_sval, cd.get_ctxt ());
|
||||
}
|
||||
}
|
||||
|
||||
/* Handle the on_call_pre part of "__builtin_va_copy". */
|
||||
|
|
|
|||
329
gcc/testsuite/gcc.dg/analyzer/torture/stdarg-4.c
Normal file
329
gcc/testsuite/gcc.dg/analyzer/torture/stdarg-4.c
Normal file
|
|
@ -0,0 +1,329 @@
|
|||
/* { dg-skip-if "" { *-*-* } { "-fno-fat-lto-objects" } { "" } } */
|
||||
|
||||
#include "../analyzer-decls.h"
|
||||
|
||||
/* va_arg in loop, with no caller to function containing va_start. */
|
||||
|
||||
int test_1a (const char *fmt, ...)
|
||||
{
|
||||
__builtin_va_list args;
|
||||
int sum = 0;
|
||||
char ch;
|
||||
|
||||
__builtin_va_start(args, fmt);
|
||||
|
||||
while (ch = *fmt++)
|
||||
if (ch == '%')
|
||||
sum += __builtin_va_arg(args, int);
|
||||
|
||||
__builtin_va_end(args);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
/* va_arg in loop, with no caller to function containing va_start. */
|
||||
|
||||
static int test_1b_callee (const char *fmt, __builtin_va_list args)
|
||||
{
|
||||
int sum = 0;
|
||||
char ch;
|
||||
|
||||
while (ch = *fmt++)
|
||||
if (ch == '%')
|
||||
sum += __builtin_va_arg(args, int);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
int test_1b_caller (const char *fmt, ...)
|
||||
{
|
||||
__builtin_va_list args;
|
||||
int sum = 0;
|
||||
|
||||
__builtin_va_start(args, fmt);
|
||||
|
||||
sum = test_1b_callee (fmt, args);
|
||||
|
||||
__builtin_va_end(args);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
/* va_arg in loop, with a caller to the function containing va_start,
|
||||
with specific args. */
|
||||
|
||||
static int
|
||||
test_1c_inner (const char *fmt, __builtin_va_list args)
|
||||
{
|
||||
int sum = 0;
|
||||
char ch;
|
||||
|
||||
while (ch = *fmt++)
|
||||
if (ch == '%')
|
||||
sum += __builtin_va_arg(args, int);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
static int
|
||||
test_1c_middle (const char *fmt, ...)
|
||||
{
|
||||
__builtin_va_list args;
|
||||
int sum = 0;
|
||||
|
||||
__builtin_va_start(args, fmt);
|
||||
|
||||
sum = test_1c_inner (fmt, args);
|
||||
|
||||
__builtin_va_end(args);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
void test_1c_outer (void)
|
||||
{
|
||||
int sum = test_1c_middle ("%%", 42, 17);
|
||||
|
||||
__analyzer_describe (0, sum); /* { dg-message "'\\(int\\)59'" } */
|
||||
}
|
||||
|
||||
/* va_arg in loop, with no caller to function containing va_start. */
|
||||
|
||||
int test_2a (int count, ...)
|
||||
{
|
||||
__builtin_va_list args;
|
||||
int sum = 0;
|
||||
char ch;
|
||||
|
||||
__builtin_va_start(args, count);
|
||||
|
||||
while (count-- > 0)
|
||||
sum += __builtin_va_arg(args, int);
|
||||
|
||||
__builtin_va_end(args);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
/* va_arg in loop, with no caller to function containing va_start. */
|
||||
|
||||
static int test_2b_callee (int count, __builtin_va_list args)
|
||||
{
|
||||
int sum = 0;
|
||||
|
||||
while (count-- > 0)
|
||||
sum += __builtin_va_arg(args, int);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
int test_2b_caller (int count, ...)
|
||||
{
|
||||
__builtin_va_list args;
|
||||
int sum = 0;
|
||||
|
||||
__builtin_va_start(args, count);
|
||||
|
||||
sum = test_2b_callee (count, args);
|
||||
|
||||
__builtin_va_end(args);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
/* va_arg in loop, with a caller to the function containing va_start,
|
||||
with specific args. */
|
||||
|
||||
static int test_2c_inner (int count, __builtin_va_list args)
|
||||
{
|
||||
int sum = 0;
|
||||
|
||||
while (count-- > 0)
|
||||
sum += __builtin_va_arg(args, int);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
int test_2c_middle (int count, ...)
|
||||
{
|
||||
__builtin_va_list args;
|
||||
int sum = 0;
|
||||
|
||||
__builtin_va_start(args, count);
|
||||
|
||||
sum = test_2c_inner (count, args);
|
||||
|
||||
__builtin_va_end(args);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
void test_2c_outer (void)
|
||||
{
|
||||
int sum = test_2c_middle (2, 50, 42);
|
||||
|
||||
__analyzer_describe (0, sum); /* { dg-message "'\\(int\\)92'" } */
|
||||
}
|
||||
|
||||
/* va_arg in loop, with no caller to function containing va_start. */
|
||||
|
||||
int test_3a (int placeholder, ...)
|
||||
{
|
||||
__builtin_va_list args;
|
||||
int sum = 0;
|
||||
int val;
|
||||
|
||||
__builtin_va_start(args, placeholder);
|
||||
|
||||
while (val = __builtin_va_arg(args, int))
|
||||
sum += val;
|
||||
|
||||
__builtin_va_end(args);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
/* va_arg in loop, with no caller to function containing va_start. */
|
||||
|
||||
static int test_3b_callee (__builtin_va_list args)
|
||||
{
|
||||
int sum = 0;
|
||||
int val;
|
||||
while (val = __builtin_va_arg(args, int))
|
||||
sum += val;
|
||||
return sum;
|
||||
}
|
||||
|
||||
int test_3b_caller (int placeholder, ...)
|
||||
{
|
||||
__builtin_va_list args;
|
||||
int sum = 0;
|
||||
|
||||
__builtin_va_start(args, placeholder);
|
||||
|
||||
sum = test_3b_callee (args);
|
||||
|
||||
__builtin_va_end(args);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
/* va_arg in loop, with a caller to the function containing va_start,
|
||||
with specific args. */
|
||||
|
||||
static int test_3c_inner (__builtin_va_list args)
|
||||
{
|
||||
int sum = 0;
|
||||
int val;
|
||||
while (val = __builtin_va_arg(args, int))
|
||||
sum += val;
|
||||
return sum;
|
||||
}
|
||||
|
||||
int test_3c_middle (int placeholder, ...)
|
||||
{
|
||||
__builtin_va_list args;
|
||||
int sum = 0;
|
||||
|
||||
__builtin_va_start(args, placeholder);
|
||||
|
||||
sum = test_3c_inner (args);
|
||||
|
||||
__builtin_va_end(args);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
void test_3c_outer (void)
|
||||
{
|
||||
int sum = test_3c_middle (0, 5, 12, 0);
|
||||
__analyzer_describe (0, sum); /* { dg-message "'\\(int\\)17'" } */
|
||||
}
|
||||
|
||||
/* va_arg in loop, with no caller to function containing va_start,
|
||||
with a va_copy. */
|
||||
|
||||
static int test_3d_callee (__builtin_va_list args)
|
||||
{
|
||||
int sum = 0;
|
||||
int val;
|
||||
while (val = __builtin_va_arg(args, int))
|
||||
sum += val;
|
||||
return sum;
|
||||
}
|
||||
|
||||
int test_3d_caller (int placeholder, ...)
|
||||
{
|
||||
__builtin_va_list args1, args2;
|
||||
int sum = 0;
|
||||
|
||||
__builtin_va_start(args1, placeholder);
|
||||
__builtin_va_copy (args2, args1);
|
||||
|
||||
sum = test_3d_callee (args1);
|
||||
__builtin_va_end(args1);
|
||||
|
||||
sum += test_3d_callee (args2);
|
||||
__builtin_va_end(args2);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
/* va_arg in loop, with a caller to the function containing va_start,
|
||||
with specific args, with a va_copy. */
|
||||
|
||||
static int test_3e_inner (__builtin_va_list args)
|
||||
{
|
||||
int sum = 0;
|
||||
int val;
|
||||
while (val = __builtin_va_arg(args, int))
|
||||
sum += val;
|
||||
return sum;
|
||||
}
|
||||
|
||||
int test_3e_middle (int placeholder, ...)
|
||||
{
|
||||
__builtin_va_list args1, args2;
|
||||
int sum = 0;
|
||||
|
||||
__builtin_va_start(args1, placeholder);
|
||||
__builtin_va_copy (args2, args1);
|
||||
|
||||
sum = test_3e_inner (args1);
|
||||
__builtin_va_end(args1);
|
||||
|
||||
sum += test_3e_inner (args2);
|
||||
__builtin_va_end(args2);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
void test_3e_outer (void)
|
||||
{
|
||||
int sum = test_3e_middle (0, 5, 6, 0);
|
||||
__analyzer_describe (0, sum); /* { dg-message "'\\(int\\)22'" } */
|
||||
}
|
||||
|
||||
/* va_arg in loop, with specific symbolic args. */
|
||||
|
||||
static int test_3f_callee (int placeholder, ...)
|
||||
{
|
||||
__builtin_va_list args;
|
||||
int sum = 0;
|
||||
int val;
|
||||
|
||||
__builtin_va_start(args, placeholder);
|
||||
|
||||
while (val = __builtin_va_arg(args, int))
|
||||
sum += val;
|
||||
|
||||
__builtin_va_end(args);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
void test_3f_caller (int x, int y, int z)
|
||||
{
|
||||
int sum = test_3f_callee (0, x, y, z, 0);
|
||||
__analyzer_describe (0, sum); /* { dg-message "'UNKNOWN\\(int\\)'" } */
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue