From patchwork Thu Jul 6 19:19:46 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luc Van Oostenryck X-Patchwork-Id: 9828789 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 1B643602CA for ; Thu, 6 Jul 2017 19:20:02 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0D5F428608 for ; Thu, 6 Jul 2017 19:20:02 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0993628714; Thu, 6 Jul 2017 19:20:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 836CB28608 for ; Thu, 6 Jul 2017 19:20:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752823AbdGFTUA (ORCPT ); Thu, 6 Jul 2017 15:20:00 -0400 Received: from mail-wr0-f195.google.com ([209.85.128.195]:32964 "EHLO mail-wr0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752788AbdGFTUA (ORCPT ); Thu, 6 Jul 2017 15:20:00 -0400 Received: by mail-wr0-f195.google.com with SMTP id x23so2620408wrb.0 for ; Thu, 06 Jul 2017 12:19:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=VrHfM3NANKxL9hYM5v+lCWyNPYHdpjduUi46ewjs1JA=; b=Fa2xVD3IE4rv02TJKzYtSnIOGf+BisSeicwQXqhBoOjptH3hogm5dBZZFdnm/zg0hI Z/B/QVnp+jCngBfaOINDLomFUxHkhr11INISbUkzVmxf2v/2dGRn6s9txQZgl4QOFypA y7vVph6iHxJgYYGQq/AWopAkhW7gPpZPYUs0bUFDtgmnrQSIyImX1kuhovomtFCSaW8i vTL7wPA7OpIlWM0bctTZDFBJQFZ6X00B0Z0Uc9PNoGMSILyOjNiWtwdmee05y5G3vpoS Lr17XxeskALB/u9hPGQLsllS9MnwyCVn2VsXaURAo/vzy93L++AK+rs526RBWERBAR2U 792g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=VrHfM3NANKxL9hYM5v+lCWyNPYHdpjduUi46ewjs1JA=; b=uN5EyEdcRItgEvs4GiJlvQxajSfxEz3CmMnEsJbnRrVgacMglzD0ZXFsr/twiZneqE jeIZFldxaHPGbZb2bFCU1e80IR+y9/Kvav73O3XtrYXqHcItg6vpcaxPZEBmypEwDvIZ dR6Cxzld58Z3+kRdwyzgwxfnuha5m8Ab7OjjIY6g95N7Aw0sOMCTcL3PO9CDwhlOtuuW eWUvdzejyKEtarOdkGAlvodEVLAXIip3hhvDjieun5YuF8qzGmCqmLlsBov2R4UJyLAI FCG9UWLgqJLrDJyQpVmmicSyRiONnmKS8yfGJaj7DMN7L3pUTOHZNWJQI6lneaQcaFPE HwLA== X-Gm-Message-State: AIVw112JzkJbLT8vLu/aF9DnXmox71SIQs7okOVSekBRSwgDdTo6cL9j dfGUZTD0oHvfyY7C5nM= X-Received: by 10.28.147.137 with SMTP id v131mr519579wmd.98.1499368798325; Thu, 06 Jul 2017 12:19:58 -0700 (PDT) Received: from localhost.localdomain ([2a02:a03f:8ed:9a00:4423:4b1:a7de:145e]) by smtp.gmail.com with ESMTPSA id h6sm1105533wmf.31.2017.07.06.12.19.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 06 Jul 2017 12:19:57 -0700 (PDT) From: Luc Van Oostenryck To: linux-sparse@vger.kernel.org Cc: Christopher Li , Luc Van Oostenryck Subject: [PATCH 1/5] do not corrupt ptrlist while killing unreachable BBs Date: Thu, 6 Jul 2017 21:19:46 +0200 Message-Id: <20170706191950.81268-2-luc.vanoostenryck@gmail.com> X-Mailer: git-send-email 2.13.0 In-Reply-To: <20170706191950.81268-1-luc.vanoostenryck@gmail.com> References: <20170706191950.81268-1-luc.vanoostenryck@gmail.com> Sender: linux-sparse-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sparse@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In commit (51cfbc90a5 "fix: kill unreachable BBs after killing a child") kill_unreachable_bbs() was called during simplification in order to avoid creating fake cycles between phis and issuing bogus "crazy programmer" warnings. However, simplification is done via cse.c:clean_up_insns() which is looping over all BBs while kill_unreachable_bbs() loops over all BBs *and* can delete some of them which may corrupt the looping in clean_up_insns(). Fix this, by adding a flag to kill_unreachable_bbs(), telling if it is safe to delete the BBs or if we can just mark them as unreachable (set bb->ep to NULL and unlink any parent and/or chilren), in which case the deletion will be done later. Note: the reproducer is one with very broken syntax but nothing seems to forbid the same situation to happen with a valid program. Fixes: 51cfbc90a5e1462fcd624a1598ecd985a508a5d6 Signed-off-by: Luc Van Oostenryck --- flow.c | 5 +++-- flow.h | 2 +- linearize.c | 6 +++--- validation/crash-ptrlist.c | 23 +++++++++++++++++++++++ 4 files changed, 30 insertions(+), 6 deletions(-) create mode 100644 validation/crash-ptrlist.c diff --git a/flow.c b/flow.c index c7161d47e..3974984de 100644 --- a/flow.c +++ b/flow.c @@ -825,7 +825,7 @@ void kill_bb(struct basic_block *bb) bb->parents = NULL; } -void kill_unreachable_bbs(struct entrypoint *ep) +void kill_unreachable_bbs(struct entrypoint *ep, int del) { struct basic_block *bb; unsigned long generation = ++bb_generation; @@ -837,7 +837,8 @@ void kill_unreachable_bbs(struct entrypoint *ep) /* Mark it as being dead */ kill_bb(bb); bb->ep = NULL; - DELETE_CURRENT_PTR(bb); + if (del) + DELETE_CURRENT_PTR(bb); } END_FOR_EACH_PTR(bb); PACK_PTR_LIST(&ep->bbs); diff --git a/flow.h b/flow.h index b592ad4d3..094368fcd 100644 --- a/flow.h +++ b/flow.h @@ -24,7 +24,7 @@ extern int simplify_instruction(struct instruction *); extern void kill_bb(struct basic_block *); extern void kill_use(pseudo_t *); -extern void kill_unreachable_bbs(struct entrypoint *ep); +extern void kill_unreachable_bbs(struct entrypoint *ep, int del); extern void kill_insn(struct instruction *, int force); static inline void kill_instruction(struct instruction *insn) diff --git a/linearize.c b/linearize.c index 7313e72d8..c1ad0c2a4 100644 --- a/linearize.c +++ b/linearize.c @@ -673,7 +673,7 @@ void insert_branch(struct basic_block *bb, struct instruction *jmp, struct basic PACK_PTR_LIST(&bb->children); if (repeat_phase & REPEAT_CFG_CLEANUP) - kill_unreachable_bbs(bb->ep); + kill_unreachable_bbs(bb->ep, 0); } @@ -2225,7 +2225,7 @@ static struct entrypoint *linearize_fn(struct symbol *sym, struct symbol *base_t * Do trivial flow simplification - branches to * branches, kill dead basicblocks etc */ - kill_unreachable_bbs(ep); + kill_unreachable_bbs(ep, 1); /* * Turn symbols into pseudos @@ -2242,7 +2242,7 @@ repeat: pack_basic_blocks(ep); } while (repeat_phase & REPEAT_CSE); - kill_unreachable_bbs(ep); + kill_unreachable_bbs(ep, 1); vrfy_flow(ep); /* Cleanup */ diff --git a/validation/crash-ptrlist.c b/validation/crash-ptrlist.c new file mode 100644 index 000000000..8e9b5cb5f --- /dev/null +++ b/validation/crash-ptrlist.c @@ -0,0 +1,23 @@ +a; +char b; +c() { + while () { + int *d; + while () { + char *e = &b; + if (a ?: (*d = f || *0) || g) { + if + ; + } else { + int h = 0; + if (j) { + char **i = &e; + if (0 ? 0 : 0 ?: (**i = 1 || 0 && 0)) h ?: (*e = i && &h + +/* + * check-name: crash ptrlist + * check-command: test-linearize $file + * + * check-error-ignore + * check-output-ignore + */