Re: Sparse crash when mixing int and enum in ternary operator

[Pavel Roskin <proski@gnu.org>]

On Tue, 2010-03-09 at 14:46 +0100, Kamil Dudka wrote:
> On Tue March 9 2010 06:43:09 Christopher Li wrote:
> > On Mon, Mar 8, 2010 at 5:24 PM, Pavel Roskin <proski@gnu.org> wrote:
> > > Hello!
> > > 
> > > Sparse crashed when checking drivers/net/wireless/ath/ath9k/gpio.c in
> > > Linux.  I could reduce the crash to the following simple program:
> > > 
> > > enum kind {
> > >    GOOD
> > > };
> > > static void foo(enum kind k)
> > > {
> > > }
> > > static void bar(int ok, int k)
> > > {
> > >    foo(ok ? GOOD : k);
> > > }
> > 
> > Confirm. This is cause by the recent enum-warning patch. Without it the
> > sparse runs fine.
> 
> Thank both of you for tacking down the bug!
> 
> > Let me see if this is some thing easy to fix.
> 
> It's easy to fix as soon as I understand how EXPR_CONDITIONAL/EXPR_SELECT
> work in sparse.  A fix from scratch is attached, but I'll need more time
> for testing it and to write some extra test-cases.

Now sparse crashes on crypto/tcrypt.c, where it didn't crash before:

Core was generated by `sparse -D__linux__ -Dlinux -D__STDC__ -Dunix
-D__unix__ -Wbitwise -Wno-return-v'.
Program terminated with signal 11, Segmentation fault.
#0  0x0000000000408131 in warn_for_different_enum_types (expr=0x0,
typeb=0x7f3b69632850) at evaluate.c:248
248             struct position pos = expr->pos;
(gdb) p expr
$1 = (struct expression *) 0x0
(gdb) where
#0  0x0000000000408131 in warn_for_different_enum_types (expr=0x0,
typeb=0x7f3b69632850) at evaluate.c:248
#1  0x000000000040843c in do_warn_for_enum_conversions (expr=0x0,
type=0x7f3b69632850) at evaluate.c:332
#2  0x000000000040849d in warn_for_enum_conversions
(expr=0x7f3b690378d0, type=0x7f3b69632850) at evaluate.c:343
#3  0x00000000004084ee in cast_to (old=0x7f3b690378d0,
type=0x7f3b69632850) at evaluate.c:363
#4  0x000000000040b035 in compatible_assignment_types
(expr=0x7f3b690378d0, target=0x7f3b69632850, rp=0x7f3b6903bd38,
where=0x664a00 "argument 3") at evaluate.c:1465
#5  0x000000000040ccec in evaluate_arguments (f=0x7f3b696323f0,
fn=0x7f3b696324d0, head=0x7f3b6903bd10) at evaluate.c:2221
#6  0x000000000040e82f in evaluate_call (expr=0x7f3b690377d0) at
evaluate.c:2888
#7  0x000000000040efc5 in evaluate_expression (expr=0x7f3b690377d0) at
evaluate.c:3059
#8  0x0000000000409a07 in evaluate_conditional (expr=0x7f3b690377d0,
iterator=0) at evaluate.c:937
#9  0x000000000040a3ef in evaluate_conditional_expression
(expr=0x7f3b69037950) at evaluate.c:1176
#10 0x000000000040efd6 in evaluate_expression (expr=0x7f3b69037950) at
evaluate.c:3062
#11 0x000000000040f3ff in evaluate_return_expression
(stmt=0x7f3b69044980) at evaluate.c:3181
#12 0x000000000040fd5b in evaluate_statement (stmt=0x7f3b69044980) at
evaluate.c:3404
#13 0x000000000040fe3c in evaluate_statement (stmt=0x7f3b69044930) at
evaluate.c:3426
#14 0x000000000040f343 in evaluate_symbol (sym=0x7f3b690280f0) at
evaluate.c:3158
#15 0x000000000040f3a7 in evaluate_symbol_list (list=0x7f3b69c06710) at
evaluate.c:3171
#16 0x00000000004075f2 in sparse (filename=0x7fff22e43882
"/home/proski/src/linux-2.6/crypto/tcrypt.c") at lib.c:984
#17 0x0000000000401a1f in main (argc=65, argv=0x7fff22e42348) at
sparse.c:284
(gdb) up 2
#2  0x000000000040849d in warn_for_enum_conversions
(expr=0x7f3b690378d0, type=0x7f3b69632850) at evaluate.c:343
343
do_warn_for_enum_conversions(expr->cond_true, type);
(gdb) p expr->cond_true
$1 = (struct expression *) 0x0
(gdb) p expr->cond_false
$2 = (struct expression *) 0x7f3b6a387b10

-- 
Regards,
Pavel Roskin