analyzer: fix ICE on region creation during get_referenced_base_regions [PR108003]

gcc/analyzer/ChangeLog:
	PR analyzer/108003
	* call-summary.cc
	(call_summary_replay::convert_region_from_summary_1): Convert
	heap_regs_in_use from auto_sbitmap to auto_bitmap.
	* region-model-manager.cc
	(region_model_manager::get_or_create_region_for_heap_alloc):
	Convert from sbitmap to bitmap.
	* region-model-manager.h: Likewise.
	* region-model.cc
	(region_model::get_or_create_region_for_heap_alloc): Convert from
	auto_sbitmap to auto_bitmap.
	(region_model::get_referenced_base_regions): Likewise.
	* region-model.h: Include "bitmap.h" rather than "sbitmap.h".
	(region_model::get_referenced_base_regions): Convert from
	auto_sbitmap to auto_bitmap.

gcc/testsuite/ChangeLog:
	PR analyzer/108003
	* g++.dg/analyzer/pr108003.C: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>
This commit is contained in:
David Malcolm 2022-12-08 21:19:23 -05:00
parent cf80a23e19
commit 7dc0ecafe6
6 changed files with 44 additions and 7 deletions

View file

@ -726,7 +726,7 @@ call_summary_replay::convert_region_from_summary_1 (const region *summary_reg)
/* If we have a heap-allocated region in the summary, then
it was allocated within the callee.
Create a new heap-allocated region to summarize this. */
auto_sbitmap heap_regs_in_use (mgr->get_num_regions ());
auto_bitmap heap_regs_in_use;
get_caller_model ()->get_referenced_base_regions (heap_regs_in_use);
return mgr->get_or_create_region_for_heap_alloc (heap_regs_in_use);
}

View file

@ -1698,7 +1698,7 @@ get_region_for_unexpected_tree_code (region_model_context *ctxt,
const region *
region_model_manager::
get_or_create_region_for_heap_alloc (const sbitmap &base_regs_in_use)
get_or_create_region_for_heap_alloc (const bitmap &base_regs_in_use)
{
/* Try to reuse an existing region, if it's unreferenced in the
client state. */

View file

@ -155,7 +155,7 @@ public:
The number of these within the analysis can grow arbitrarily.
They are still owned by the manager. */
const region *
get_or_create_region_for_heap_alloc (const sbitmap &base_regs_in_use);
get_or_create_region_for_heap_alloc (const bitmap &base_regs_in_use);
const region *create_region_for_alloca (const frame_region *frame);
void log_stats (logger *logger, bool show_objs) const;

View file

@ -4904,7 +4904,7 @@ region_model::get_or_create_region_for_heap_alloc (const svalue *size_in_bytes,
/* Determine which regions are referenced in this region_model, so that
we can reuse an existing heap_allocated_region if it's not in use on
this path. */
auto_sbitmap base_regs_in_use (m_mgr->get_num_regions ());
auto_bitmap base_regs_in_use;
get_referenced_base_regions (base_regs_in_use);
const region *reg
= m_mgr->get_or_create_region_for_heap_alloc (base_regs_in_use);
@ -4917,7 +4917,7 @@ region_model::get_or_create_region_for_heap_alloc (const svalue *size_in_bytes,
reachable in this region_model. */
void
region_model::get_referenced_base_regions (auto_sbitmap &out_ids) const
region_model::get_referenced_base_regions (auto_bitmap &out_ids) const
{
reachable_regions reachable_regs (const_cast<region_model *> (this));
m_store.for_each_cluster (reachable_regions::init_cluster_cb,

View file

@ -26,7 +26,7 @@ along with GCC; see the file COPYING3. If not see
(Zhongxing Xu, Ted Kremenek, and Jian Zhang)
http://lcs.ios.ac.cn/~xuzb/canalyze/memmodel.pdf */
#include "sbitmap.h"
#include "bitmap.h"
#include "selftest.h"
#include "analyzer/svalue.h"
#include "analyzer/region.h"
@ -390,7 +390,7 @@ class region_model
region_model_context *ctxt);
const region *create_region_for_alloca (const svalue *size_in_bytes,
region_model_context *ctxt);
void get_referenced_base_regions (auto_sbitmap &out_ids) const;
void get_referenced_base_regions (auto_bitmap &out_ids) const;
tree get_representative_tree (const svalue *sval) const;
tree get_representative_tree (const region *reg) const;

View file

@ -0,0 +1,37 @@
/* Regression test for ICE. */
/* { dg-additional-options "-Wno-analyzer-possible-null-argument" } */
/* { dg-additional-options "-Wno-analyzer-malloc-leak" } */
/* { dg-additional-options "-Wno-analyzer-possible-null-dereference" } */
/* { dg-additional-options "-O1 --param analyzer-max-svalue-depth=5" } */
struct locale {
class _Impl;
_Impl *_M_impl;
template <typename _Facet>
locale (const locale &, _Facet *);
static locale
classic ();
};
struct locale::_Impl {
_Impl (_Impl, int);
};
template <typename _Facet>
locale::locale (const locale &, _Facet *)
{
new _Impl (*_M_impl, 1);
}
struct codecvt {
virtual void do_max_lengththrow ();
};
void
test01 ()
{
locale (locale::classic (), new codecvt);
}