diff options
author | David Malcolm <dmalcolm@redhat.com> | 2022-01-21 09:56:56 -0500 |
---|---|---|
committer | David Malcolm <dmalcolm@redhat.com> | 2022-01-22 10:26:22 -0500 |
commit | 45b999f642a531c083c982dda79fa6ad65730a7c (patch) | |
tree | 0551998d00aac3e773507d8b10959922686f51fb | |
parent | 6c1a93102b41a558f3ad49a7c66015257535c747 (diff) | |
download | gcc-45b999f642a531c083c982dda79fa6ad65730a7c.zip gcc-45b999f642a531c083c982dda79fa6ad65730a7c.tar.gz gcc-45b999f642a531c083c982dda79fa6ad65730a7c.tar.bz2 |
analyzer: fix ICE on vector casts [PR104159]
PR analyzer/104159 describes an ICE attempting to convert a vector_cst,
which occurs when symbolically executing within a recursive call on:
_4 = BIT_FIELD_REF <w_3(D), 32, 0>;
_1 = VIEW_CONVERT_EXPR<T>(_4);
where the BIT_FIELD_REF leads to a get_or_create_cast from
VEC<long, 8> to VEC<unsigned 4>
which get_code_for_cast erroneously picks NOP_EXPR for the cast, leading
to a bogus input to the VIEW_CONVERT_EXPR.
This patch fixes the issue by giving up on attempts to cast symbolic
values of vector types, treating the result of such casts as unknowable.
gcc/analyzer/ChangeLog:
PR analyzer/104159
* region-model-manager.cc
(region_model_manager::get_or_create_cast): Bail out if the types
are the same. Don't attempt to handle casts involving vector
types.
gcc/testsuite/ChangeLog:
PR analyzer/104159
* gcc.dg/analyzer/torture/pr104159.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
-rw-r--r-- | gcc/analyzer/region-model-manager.cc | 11 | ||||
-rw-r--r-- | gcc/testsuite/gcc.dg/analyzer/torture/pr104159.c | 18 |
2 files changed, 29 insertions, 0 deletions
diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc index bb93526..e765e7f 100644 --- a/gcc/analyzer/region-model-manager.cc +++ b/gcc/analyzer/region-model-manager.cc @@ -497,6 +497,17 @@ const svalue * region_model_manager::get_or_create_cast (tree type, const svalue *arg) { gcc_assert (type); + + /* No-op if the types are the same. */ + if (type == arg->get_type ()) + return arg; + + /* Don't attempt to handle casts involving vector types for now. */ + if (TREE_CODE (type) == VECTOR_TYPE + || (arg->get_type () + && TREE_CODE (arg->get_type ()) == VECTOR_TYPE)) + return get_or_create_unknown_svalue (type); + enum tree_code op = get_code_for_cast (type, arg->get_type ()); return get_or_create_unaryop (type, op, arg); } diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/pr104159.c b/gcc/testsuite/gcc.dg/analyzer/torture/pr104159.c new file mode 100644 index 0000000..1346b4b --- /dev/null +++ b/gcc/testsuite/gcc.dg/analyzer/torture/pr104159.c @@ -0,0 +1,18 @@ +/* { dg-additional-options "-Wno-analyzer-use-of-uninitialized-value" } */ + +typedef int __attribute__((__vector_size__(4))) T; +typedef unsigned __attribute__((__vector_size__(4))) U; +typedef unsigned __attribute__((__vector_size__(16))) V; +typedef unsigned long __attribute__((__vector_size__(16))) W; + +U u; +T t; + +void +foo(W w) { + U u = __builtin_shufflevector((V)w, u, 0); + t = (T){} + u + u; + foo((W){}); + for (;;) + ; +} |