analyzer: don't call binding_key::make on empty regions [PR108065]

gcc/analyzer/ChangeLog:
	PR analyzer/108065
	* region.cc (decl_region::get_svalue_for_initializer): Bail out to
	avoid calling binding_key::make with an empty region.
	* store.cc (binding_map::apply_ctor_val_to_range): Likewise.
	(binding_map::apply_ctor_pair_to_child_region): Likewise.
	(binding_cluster::bind): Likewise.
	(binding_cluster::purge_region): Likewise.
	(binding_cluster::maybe_get_compound_binding): Likewise.
	(binding_cluster::maybe_get_simple_value): Likewise.

gcc/testsuite/ChangeLog:
	PR analyzer/108065
	* gfortran.dg/analyzer/pr108065.f90: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

diff --git a/gcc/analyzer/region.cc b/gcc/analyzer/region.cc
index 67ba9486980b263478e3f3f9ea0284bd117d7df6..83809d6e1c3d20cf181d212df2fb92fee8118432 100644 (file)
--- a/gcc/analyzer/region.cc
+++ b/gcc/analyzer/region.cc
@@ -1208,6 +1208,9 @@ decl_region::get_svalue_for_initializer (region_model_manager *mgr) const
       if (DECL_EXTERNAL (m_decl))
        return NULL;
 
+      if (empty_p ())
+       return NULL;
+
       /* Implicit initialization to zero; use a compound_svalue for it.
         Doing so requires that we have a concrete binding for this region,
         which can fail if we have a region with unknown size

diff --git a/gcc/analyzer/store.cc b/gcc/analyzer/store.cc
index dd8ebaa73742779bcc242f173c8557ef5d980bb9..f3b500c50a06a7928d83c0f4fdcdf608d4aba071 100644 (file)
--- a/gcc/analyzer/store.cc
+++ b/gcc/analyzer/store.cc
@@ -911,6 +911,8 @@ binding_map::apply_ctor_val_to_range (const region *parent_reg,
     return false;
   bit_offset_t start_bit_offset = min_offset.get_bit_offset ();
   store_manager *smgr = mgr->get_store_manager ();
+  if (max_element->empty_p ())
+    return false;
   const binding_key *max_element_key = binding_key::make (smgr, max_element);
   if (max_element_key->symbolic_p ())
     return false;
@@ -950,6 +952,8 @@ binding_map::apply_ctor_pair_to_child_region (const region *parent_reg,
   else
     {
       const svalue *sval = get_svalue_for_ctor_val (val, mgr);
+      if (child_reg->empty_p ())
+       return false;
       const binding_key *k
        = binding_key::make (mgr->get_store_manager (), child_reg);
       /* Handle the case where we have an unknown size for child_reg
@@ -1347,6 +1351,8 @@ binding_cluster::bind (store_manager *mgr,
       return;
     }
 
+  if (reg->empty_p ())
+    return;
   const binding_key *binding = binding_key::make (mgr, reg);
   bind_key (binding, sval);
 }
@@ -1419,6 +1425,8 @@ void
 binding_cluster::purge_region (store_manager *mgr, const region *reg)
 {
   gcc_assert (reg->get_kind () == RK_DECL);
+  if (reg->empty_p ())
+    return;
   const binding_key *binding
     = binding_key::make (mgr, const_cast<region *> (reg));
   m_map.remove (binding);
@@ -1666,6 +1674,9 @@ binding_cluster::maybe_get_compound_binding (store_manager *mgr,
   if (reg_offset.symbolic_p ())
     return NULL;
 
+  if (reg->empty_p ())
+    return NULL;
+
   region_model_manager *sval_mgr = mgr->get_svalue_manager ();
 
   /* We will a build the result map in two parts:
@@ -2162,6 +2173,9 @@ binding_cluster::maybe_get_simple_value (store_manager *mgr) const
   if (m_map.elements () != 1)
     return NULL;
 
+  if (m_base_region->empty_p ())
+    return NULL;
+
   const binding_key *key = binding_key::make (mgr, m_base_region);
   return get_any_value (key);
 }

diff --git a/gcc/testsuite/gfortran.dg/analyzer/pr108065.f90 b/gcc/testsuite/gfortran.dg/analyzer/pr108065.f90
new file mode 100644 (file)
index 0000000..86ba4d4
--- /dev/null
+++ b/gcc/testsuite/gfortran.dg/analyzer/pr108065.f90
@@ -0,0 +1,17 @@
+! { dg-do compile }
+! { dg-additional-options "-fcheck=bounds -Wno-analyzer-malloc-leak" }
+! Copy of gfortran.dg/bounds_check_23.f90
+! as a regression test for ICE with -fanalyzer (PR analyzer/108065)
+
+program test
+  implicit none
+  call sub('Lorem ipsum')
+contains
+  subroutine sub( text )
+    character(len=*), intent(in)  :: text
+    character(len=1), allocatable :: c(:)
+    integer :: i
+    c = [ ( text(i:i), i = 1, len(text) ) ]
+    if (c(1) /= 'L') stop 1
+  end subroutine sub
+end program test