[Cocci] Analysis for Linux source files

[Cocci] Analysis for Linux source files

[SF Markus Elfring]

Hello,

I try out a bit of static source code analysis again by the following command.

elfring at Sonne:~/Projekte/Coccinelle/lokal/demos/pass-through>
XY=/usr/src/linux-stable/ && spatch -sp_file list_pass-through_functions.cocci \
-dir $XY \
-I ${XY}include \
-I ${XY}usr/include \
-I ${XY}arch/ia64/include \
-I ${XY}arch/ia64/include/uapi \
-I ${XY}arch/x86/include \
-I ${XY}arch/x86/include/generated \
-I /usr/include \
-I /usr/include/c++/4.7/tr1 \
-recursive_includes \
>list_pass-through_functions-linux.txt \
2>list_pass-through_functions-linux-errors.txt


I notice results like the following in my log file.

...
HANDLING: /usr/src/linux-stable/init/noinitramfs.c
EXN:Failure("empty list, max_min_ii_by_pos")
Note: processing took    85.2s: /usr/src/linux-stable/init/noinitramfs.c
HANDLING: /usr/src/linux-stable/init/do_mounts_md.c
EXN:Failure("empty list, max_min_ii_by_pos")
Note: processing took   109.5s: /usr/src/linux-stable/init/do_mounts_md.c
...


Can the shown error message be avoided?
What does it really mean?

openSUSE package: coccinelle 1.0.0-27.6
spatch version 1.0.0-rc14 with Python support and with Str regexp support

Regards,
Markus

[Cocci] Analysis for Linux source files

[Julia Lawall]

On Tue, 2 Apr 2013, SF Markus Elfring wrote:

> Hello,
>
> I try out a bit of static source code analysis again by the following command.
>
> elfring at Sonne:~/Projekte/Coccinelle/lokal/demos/pass-through>
> XY=/usr/src/linux-stable/ && spatch -sp_file list_pass-through_functions.cocci \
> -dir $XY \
> -I ${XY}include \
> -I ${XY}usr/include \
> -I ${XY}arch/ia64/include \
> -I ${XY}arch/ia64/include/uapi \
> -I ${XY}arch/x86/include \
> -I ${XY}arch/x86/include/generated \
> -I /usr/include \
> -I /usr/include/c++/4.7/tr1 \
> -recursive_includes \
> >list_pass-through_functions-linux.txt \
> 2>list_pass-through_functions-linux-errors.txt
>
>
> I notice results like the following in my log file.
>
> ...
> HANDLING: /usr/src/linux-stable/init/noinitramfs.c
> EXN:Failure("empty list, max_min_ii_by_pos")
> Note: processing took    85.2s: /usr/src/linux-stable/init/noinitramfs.c
> HANDLING: /usr/src/linux-stable/init/do_mounts_md.c
> EXN:Failure("empty list, max_min_ii_by_pos")
> Note: processing took   109.5s: /usr/src/linux-stable/init/do_mounts_md.c

Without your semantic patch and some example code, I don't know.

julia

[Cocci] Analysis for Linux source files

[SF Markus Elfring]

> Without your semantic patch and some example code, I don't know.

I let the following SmPL filter pattern run on source files from the current
Linux 3.8.5.
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git


elfring at Sonne:~/Projekte/Coccinelle/lokal/demos/pass-through> cat
list_pass-through_functions.cocci
@initialize:python@
import sys
result = []
mark = ['"', '', '"']
delimiter = '|'

def store_positions(fun, typ, pt_param, places, data_structure = ""):
    """Add source code positions to an internal list."""


    for place in places:


        fields = []


        fields.append(fun.ident)





        mark[1] = typ


        fields.append(''.join(mark))





        fields.append(pt_param.ident)


        fields.append(data_structure)





        mark[1] = place.file.replace('"', '""')


        fields.append(''.join(mark))





        fields.append(place.line)


        fields.append(str(int(place.column) + 1))


        result.append(delimiter.join(fields))





@is_pass_through@


identifier pt_function, input;
type data_type;
position pos;
@@
 data_type at pos pt_function(...,data_type input,...)
 {
  <+...
  return input;
  ...+>
 }

@is_pass_through_member_candidate@
identifier pt_function, input, tag;
type data_type;
position pos;
@@
 struct tag
 {
  ...
  data_type at pos (*pt_function)(...,data_type input,...);
  ...
 }

@script:python collection1 depends on is_pass_through@
typ << is_pass_through.data_type;
fun << is_pass_through.pt_function;
pt_param << is_pass_through.input;
places << is_pass_through.pos;
@@
store_positions(fun, typ, pt_param, places)

@script:python collection2 depends on is_pass_through_member_candidate@
tag << is_pass_through_member_candidate.tag;
typ << is_pass_through_member_candidate.data_type;
fun << is_pass_through_member_candidate.pt_function;
pt_param << is_pass_through_member_candidate.input;
places << is_pass_through_member_candidate.pos;
@@
store_positions(fun, typ, pt_param, places, tag)

@finalize:python@
if result:
   result.insert(0, delimiter.join(("function", '"data type"', "parameter",
'"contained in"', '"source file"', "line", "column")))
   print("\r\n".join(result))
else:
   sys.stderr.write("No result for this analysis!\n")



Regards,
Markus

[Cocci] Analysis for Linux source files

[Julia Lawall]

When I try, it complains because the parameter fun of store_positions does
not have an ident field.  Do you not see that problem?

julia

On Tue, 2 Apr 2013, SF Markus Elfring wrote:

> > Without your semantic patch and some example code, I don't know.
>
> I let the following SmPL filter pattern run on source files from the current
> Linux 3.8.5.
> https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git
>
>
> elfring at Sonne:~/Projekte/Coccinelle/lokal/demos/pass-through> cat
> list_pass-through_functions.cocci
> @initialize:python@
> import sys
> result = []
> mark = ['"', '', '"']
> delimiter = '|'
>
> def store_positions(fun, typ, pt_param, places, data_structure = ""):
>     """Add source code positions to an internal list."""
>
>
>     for place in places:
>
>
>         fields = []
>
>
>         fields.append(fun.ident)
>
>
>
>
>
>         mark[1] = typ
>
>
>         fields.append(''.join(mark))
>
>
>
>
>
>         fields.append(pt_param.ident)
>
>
>         fields.append(data_structure)
>
>
>
>
>
>         mark[1] = place.file.replace('"', '""')
>
>
>         fields.append(''.join(mark))
>
>
>
>
>
>         fields.append(place.line)
>
>
>         fields.append(str(int(place.column) + 1))
>
>
>         result.append(delimiter.join(fields))
>
>
>
>
>
> @is_pass_through@
>
>
> identifier pt_function, input;
> type data_type;
> position pos;
> @@
>  data_type at pos pt_function(...,data_type input,...)
>  {
>   <+...
>   return input;
>   ...+>
>  }
>
> @is_pass_through_member_candidate@
> identifier pt_function, input, tag;
> type data_type;
> position pos;
> @@
>  struct tag
>  {
>   ...
>   data_type at pos (*pt_function)(...,data_type input,...);
>   ...
>  }
>
> @script:python collection1 depends on is_pass_through@
> typ << is_pass_through.data_type;
> fun << is_pass_through.pt_function;
> pt_param << is_pass_through.input;
> places << is_pass_through.pos;
> @@
> store_positions(fun, typ, pt_param, places)
>
> @script:python collection2 depends on is_pass_through_member_candidate@
> tag << is_pass_through_member_candidate.tag;
> typ << is_pass_through_member_candidate.data_type;
> fun << is_pass_through_member_candidate.pt_function;
> pt_param << is_pass_through_member_candidate.input;
> places << is_pass_through_member_candidate.pos;
> @@
> store_positions(fun, typ, pt_param, places, tag)
>
> @finalize:python@
> if result:
>    result.insert(0, delimiter.join(("function", '"data type"', "parameter",
> '"contained in"', '"source file"', "line", "column")))
>    print("\r\n".join(result))
> else:
>    sys.stderr.write("No result for this analysis!\n")
>
>
>
> Regards,
> Markus
>

[Cocci] Analysis for Linux source files

[SF Markus Elfring]

> When I try, it complains because the parameter fun of store_positions does
> not have an ident field.  Do you not see that problem?

I'm sorry that I did not interpret the error message 'EXN:Failure("empty list,
max_min_ii_by_pos")' as an open issue from my Python function "store_positions".
I try to reuse the implementation that was already mentioned in a previous
discussion.
http://lists.diku.dk/pipermail/cocci/2011-December/002373.html

It works again if I delete the attribute access ".ident"

elfring at Sonne:~/Projekte/Coccinelle/lokal/demos/pass-through> spatch -sp_file
list_pass-through_functions2.cocci pt1.c
init_defs_builtins: /usr/share/coccinelle/standard.h
HANDLING: pt1.c
function|"data type"|parameter|"contained in"|"source file"|line|column
my_copy|"char *"|destination||"pt1.c"|1|1
my_append|"char *"|prefix||"pt1.c"|8|1



Was the Pycaml interface changed anyhow in the meantime?
Is the corresponding Coccinelle API still described by a Wiki document?


elfring at Sonne:~/Projekte/Coccinelle/lokal/demos/pass-through>
XY=/usr/src/linux-stable/ && spatch -sp_file list_pass-through_functions2.cocci \
-I ${XY}include \
-I ${XY}usr/include \
-I ${XY}arch/ia64/include \
-I ${XY}arch/ia64/include/uapi \
-I ${XY}arch/x86/include \
-I ${XY}arch/x86/include/generated \
-I /usr/include \
-I /usr/include/c++/4.7/tr1 \
-recursive_includes \
${XY}init/calibrate.c
init_defs_builtins: /usr/share/coccinelle/standard.h
HANDLING: /usr/src/linux-stable/init/calibrate.c
(ONCE) TYPE: header ia64intrin.h not found
(ONCE) TYPE: header stl/_prolog.h not found
(ONCE) TYPE: header gnu/stubs-x32.h not found
Fatal error: exception Failure("empty list, max_min_ii_by_pos")


Regards,
Markus

[Cocci] Analysis for Linux source files

[Julia Lawall]

On Tue, 2 Apr 2013, SF Markus Elfring wrote:

> > When I try, it complains because the parameter fun of store_positions does
> > not have an ident field.  Do you not see that problem?
>
> I'm sorry that I did not interpret the error message 'EXN:Failure("empty list,
> max_min_ii_by_pos")' as an open issue from my Python function "store_positions".
> I try to reuse the implementation that was already mentioned in a previous
> discussion.
> http://lists.diku.dk/pipermail/cocci/2011-December/002373.html
>
> It works again if I delete the attribute access ".ident"

The empty list problem is entirely unrelated to the python problem.

> elfring at Sonne:~/Projekte/Coccinelle/lokal/demos/pass-through> spatch -sp_file
> list_pass-through_functions2.cocci pt1.c
> init_defs_builtins: /usr/share/coccinelle/standard.h
> HANDLING: pt1.c
> function|"data type"|parameter|"contained in"|"source file"|line|column
> my_copy|"char *"|destination||"pt1.c"|1|1
> my_append|"char *"|prefix||"pt1.c"|8|1
>
>
>
> Was the Pycaml interface changed anyhow in the meantime?

No, I don't think so.

> Is the corresponding Coccinelle API still described by a Wiki document?

Unfortunately, the wiki machine is not alive any more...

julia

>
> elfring at Sonne:~/Projekte/Coccinelle/lokal/demos/pass-through>
> XY=/usr/src/linux-stable/ && spatch -sp_file list_pass-through_functions2.cocci \
> -I ${XY}include \
> -I ${XY}usr/include \
> -I ${XY}arch/ia64/include \
> -I ${XY}arch/ia64/include/uapi \
> -I ${XY}arch/x86/include \
> -I ${XY}arch/x86/include/generated \
> -I /usr/include \
> -I /usr/include/c++/4.7/tr1 \
> -recursive_includes \
> ${XY}init/calibrate.c
> init_defs_builtins: /usr/share/coccinelle/standard.h
> HANDLING: /usr/src/linux-stable/init/calibrate.c
> (ONCE) TYPE: header ia64intrin.h not found
> (ONCE) TYPE: header stl/_prolog.h not found
> (ONCE) TYPE: header gnu/stubs-x32.h not found
> Fatal error: exception Failure("empty list, max_min_ii_by_pos")
>
>
> Regards,
> Markus
>

[Cocci] Analysis for Linux source files

[SF Markus Elfring]

> The empty list problem is entirely unrelated to the python problem.

Can I do anything about it from my side?


> Unfortunately, the wiki machine is not alive any more...

Under which address will the description of the Pycaml interface (Coccinelle
API) become available again?

Regards,
Markus

[Cocci] Analysis for Linux source files

[Julia Lawall]

On Tue, 2 Apr 2013, SF Markus Elfring wrote:

> > The empty list problem is entirely unrelated to the python problem.
>
> Can I do anything about it from my side?
>
>
> > Unfortunately, the wiki machine is not alive any more...
>
> Under which address will the description of the Pycaml interface (Coccinelle
> API) become available again?

Ideally there would be a man page, like there is for the ocaml interface.
I can try to look into putting that together.

julia

[Cocci] Analysis for Linux source files

[Julia Lawall]

I get the problem on the following code:

irqreturn_t
nouveau_irq_handler(DRM_IRQ_ARGS)
{
        struct drm_device *dev = arg;
        struct nouveau_device *device = nouveau_dev(dev);
        struct nouveau_mc *pmc = nouveau_mc(device);
        u32 stat;

        stat = nv_rd32(device, 0x000100);
        if (stat == 0 || stat == ~0)
                return IRQ_NONE;

        nv_subdev(pmc)->intr(nv_subdev(pmc));
        return IRQ_HANDLED;
}

I would suspect that there is some inconsistency in how it is parsing this
kind of argument list.  It seems to parse it OK, but then not be able to
match it against a pattern like ...,x,...  I can look at it in more detail
tomorrow.

julia

[Cocci] Analysis for Linux source files

[Julia Lawall]

Again, to understand the problem, I need the .cocci file, and preferably
the .c file as well.  Preferably a small .c file that shows the problem.

julia

On Tue, 2 Apr 2013, SF Markus Elfring wrote:

> > When I try, it complains because the parameter fun of store_positions does
> > not have an ident field.  Do you not see that problem?
>
> I'm sorry that I did not interpret the error message 'EXN:Failure("empty list,
> max_min_ii_by_pos")' as an open issue from my Python function "store_positions".
> I try to reuse the implementation that was already mentioned in a previous
> discussion.
> http://lists.diku.dk/pipermail/cocci/2011-December/002373.html
>
> It works again if I delete the attribute access ".ident"
>
> elfring at Sonne:~/Projekte/Coccinelle/lokal/demos/pass-through> spatch -sp_file
> list_pass-through_functions2.cocci pt1.c
> init_defs_builtins: /usr/share/coccinelle/standard.h
> HANDLING: pt1.c
> function|"data type"|parameter|"contained in"|"source file"|line|column
> my_copy|"char *"|destination||"pt1.c"|1|1
> my_append|"char *"|prefix||"pt1.c"|8|1
>
>
>
> Was the Pycaml interface changed anyhow in the meantime?
> Is the corresponding Coccinelle API still described by a Wiki document?
>
>
> elfring at Sonne:~/Projekte/Coccinelle/lokal/demos/pass-through>
> XY=/usr/src/linux-stable/ && spatch -sp_file list_pass-through_functions2.cocci \
> -I ${XY}include \
> -I ${XY}usr/include \
> -I ${XY}arch/ia64/include \
> -I ${XY}arch/ia64/include/uapi \
> -I ${XY}arch/x86/include \
> -I ${XY}arch/x86/include/generated \
> -I /usr/include \
> -I /usr/include/c++/4.7/tr1 \
> -recursive_includes \
> ${XY}init/calibrate.c
> init_defs_builtins: /usr/share/coccinelle/standard.h
> HANDLING: /usr/src/linux-stable/init/calibrate.c
> (ONCE) TYPE: header ia64intrin.h not found
> (ONCE) TYPE: header stl/_prolog.h not found
> (ONCE) TYPE: header gnu/stubs-x32.h not found
> Fatal error: exception Failure("empty list, max_min_ii_by_pos")
>
>
> Regards,
> Markus
>

[Cocci] Analysis for Linux source files

[SF Markus Elfring]

> Again, to understand the problem, I need the .cocci file, and preferably
> the .c file as well.  Preferably a small .c file that shows the problem.

Would you like to reproduce my issue with the following SmPL filter pattern on
the source file
"https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/init/calibrate.c?id=8595c539f0360477189eef91f6337ba44962f72d"?

elfring at Sonne:~/Projekte/Coccinelle/lokal/demos/pass-through> cat
list_pass-through_functions2.cocci
@initialize:python@
import sys
result = []
mark = ['"', '', '"']
delimiter = '|'

def store_positions(fun, typ, pt_param, places, data_structure = ""):
    """Add source code positions to an internal list."""
    for place in places:
        fields = []
        fields.append(fun)

        mark[1] = typ
        fields.append(''.join(mark))

        fields.append(pt_param)
        fields.append(data_structure)

        mark[1] = place.file.replace('"', '""')
        fields.append(''.join(mark))

        fields.append(place.line)
        fields.append(str(int(place.column) + 1))
        result.append(delimiter.join(fields))

@is_pass_through@
identifier pt_function, input;
type data_type;
position pos;
@@
 data_type at pos pt_function(...,data_type input,...)
 {
  <+...
  return input;
  ...+>
 }

@is_pass_through_member_candidate@
identifier pt_function, input, tag;
type data_type;
position pos;
@@
 struct tag
 {
  ...
  data_type at pos (*pt_function)(...,data_type input,...);
  ...
 }

@script:python collection1 depends on is_pass_through@
typ << is_pass_through.data_type;
fun << is_pass_through.pt_function;
pt_param << is_pass_through.input;
places << is_pass_through.pos;
@@
store_positions(fun, typ, pt_param, places)

@script:python collection2 depends on is_pass_through_member_candidate@
tag << is_pass_through_member_candidate.tag;
typ << is_pass_through_member_candidate.data_type;
fun << is_pass_through_member_candidate.pt_function;
pt_param << is_pass_through_member_candidate.input;
places << is_pass_through_member_candidate.pos;
@@
store_positions(fun, typ, pt_param, places, tag)

@finalize:python@
if result:
   result.insert(0, delimiter.join(("function", '"data type"', "parameter",
'"contained in"', '"source file"', "line", "column")))
   print("\r\n".join(result))
else:
   sys.stderr.write("No result for this analysis!\n")


Regards,
Markus

[Cocci] Analysis for Linux source files

[Nic Volanschi (R&D)]

If this may help, I stumbled against the same error in a different
setting, but I think the ultimate cause is the same:

$ cat in.c
int foo()
{
  register rI;
  return rI;
}

$ cat in.cocci
@f1@
identifier f;
position p;
type T;
@@
* T at p f;

The reported error is the same: << Fatal error: exception Failure("empty
list, max_min_ii_by_pos") >>
I localized the problem on the variable declaration <<register rI;>>
where the type is missing (int by default). As soon as you add the
missing "int", the error disappears. 
In fact, the error seems somewhat justified, as you are taking the
position of an inexistent type.

I guess that in the big file indicated by Markus, the problematic
declaration is:


> static DEFINE_PER_CPU(unsigned long, cpu_loops_per_jiffy) = { 0 };


where we have the same missing, implicit int return type.

Hope it helps,
Nic.

On Wed, 2013-04-03 at 12:00 +0200, cocci-request at systeme.lip6.fr wrote:

> ----------------------------------------------------------------------
> 
> Message: 1
> Date: Tue, 02 Apr 2013 17:37:30 +0200
> From: SF Markus Elfring <elfring@users.sourceforge.net>



> Would you like to reproduce my issue with the following SmPL filter pattern on
> the source file
> "https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/init/calibrate.c?id=8595c539f0360477189eef91f6337ba44962f72d"?



> ------------------------------
> 
> Message: 3
> Date: Tue, 2 Apr 2013 18:21:22 +0200 (CEST)
> From: Julia Lawall <julia.lawall@lip6.fr>



> I get the problem on the following code:
> 
> irqreturn_t
> nouveau_irq_handler(DRM_IRQ_ARGS)
> {
>         struct drm_device *dev = arg;
>         struct nouveau_device *device = nouveau_dev(dev);
>         struct nouveau_mc *pmc = nouveau_mc(device);
>         u32 stat;
> 
>         stat = nv_rd32(device, 0x000100);
>         if (stat == 0 || stat == ~0)
>                 return IRQ_NONE;
> 
>         nv_subdev(pmc)->intr(nv_subdev(pmc));
>         return IRQ_HANDLED;
> }
> 
> I would suspect that there is some inconsistency in how it is parsing this
> kind of argument list.  It seems to parse it OK, but then not be able to
> match it against a pattern like ...,x,...  I can look at it in more detail
> tomorrow.
> 
> julia
> 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://systeme.lip6.fr/pipermail/cocci/attachments/20130408/f4c99e4b/attachment.html>

[Cocci] Analysis for Linux source files

[Julia Lawall]

Thanks very much for the report.  I thought that my fix had solved the
problem, but it doesn't seem to have been a complete solution, because I
still see the problem on this example.

I will look into it.

julia

On Mon, 8 Apr 2013, Nic Volanschi (R&D) wrote:

> If this may help, I stumbled against the same error in a different setting, but I think the ultimate cause is the same:
>
> $ cat in.c
> int foo()
> {
> ? register rI;
> ? return rI;
> }
>
> $ cat in.cocci
> @f1@
> identifier f;
> position p;
> type T;
> @@
> * T at p f;
>
> The reported error is the same: << Fatal error: exception Failure("empty list, max_min_ii_by_pos") >>
> I localized the problem on the variable declaration <<register rI;>> where the type is missing (int by default). As soon as
> you add the missing "int", the error disappears.
> In fact, the error seems somewhat justified, as you are taking the position of an inexistent type.
>
> I guess that in the big file indicated by Markus, the problematic declaration is:
>
> static DEFINE_PER_CPU(unsigned long, cpu_loops_per_jiffy) = { 0 };
>
>
> where we have the same missing, implicit int return type.
>
> Hope it helps,
> Nic.
>
> On Wed, 2013-04-03 at 12:00 +0200, cocci-request at systeme.lip6.fr wrote:
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Tue, 02 Apr 2013 17:37:30 +0200
> From: SF Markus Elfring <elfring@users.sourceforge.net>
>
>
> Would you like to reproduce my issue with the following SmPL filter pattern on
> the source file
> "https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/init/calibrate.c?id=8595c539f0360477189eef91f6337b
> a44962f72d"?
>
>
> ------------------------------
>
> Message: 3
> Date: Tue, 2 Apr 2013 18:21:22 +0200 (CEST)
> From: Julia Lawall <julia.lawall@lip6.fr>
>
>
> I get the problem on the following code:
>
> irqreturn_t
> nouveau_irq_handler(DRM_IRQ_ARGS)
> {
>         struct drm_device *dev = arg;
>         struct nouveau_device *device = nouveau_dev(dev);
>         struct nouveau_mc *pmc = nouveau_mc(device);
>         u32 stat;
>
>         stat = nv_rd32(device, 0x000100);
>         if (stat == 0 || stat == ~0)
>                 return IRQ_NONE;
>
>         nv_subdev(pmc)->intr(nv_subdev(pmc));
>         return IRQ_HANDLED;
> }
>
> I would suspect that there is some inconsistency in how it is parsing this
> kind of argument list.  It seems to parse it OK, but then not be able to
> match it against a pattern like ...,x,...  I can look at it in more detail
> tomorrow.
>
> julia
>
>
>
>

[Cocci] Analysis for Linux source files

[Julia Lawall]

Actually, what result would you prefer?  In the previous fix that I made,
I just caused the missing type, which was hidden under a macro, to make
the match fail.  In this case, though perhaps you would prefer T to be
bound to int?  That might cause some problemes, though, because it is not
a real "int" in the source code...

julia

On Mon, 8 Apr 2013, Nic Volanschi (R&D) wrote:

> If this may help, I stumbled against the same error in a different setting, but I think the ultimate cause is the same:
>
> $ cat in.c
> int foo()
> {
> ? register rI;
> ? return rI;
> }
>
> $ cat in.cocci
> @f1@
> identifier f;
> position p;
> type T;
> @@
> * T at p f;
>
> The reported error is the same: << Fatal error: exception Failure("empty list, max_min_ii_by_pos") >>
> I localized the problem on the variable declaration <<register rI;>> where the type is missing (int by default). As soon as
> you add the missing "int", the error disappears.
> In fact, the error seems somewhat justified, as you are taking the position of an inexistent type.
>
> I guess that in the big file indicated by Markus, the problematic declaration is:
>
> static DEFINE_PER_CPU(unsigned long, cpu_loops_per_jiffy) = { 0 };
>
>
> where we have the same missing, implicit int return type.
>
> Hope it helps,
> Nic.
>
> On Wed, 2013-04-03 at 12:00 +0200, cocci-request at systeme.lip6.fr wrote:
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Tue, 02 Apr 2013 17:37:30 +0200
> From: SF Markus Elfring <elfring@users.sourceforge.net>
>
>
> Would you like to reproduce my issue with the following SmPL filter pattern on
> the source file
> "https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/init/calibrate.c?id=8595c539f0360477189eef91f6337b
> a44962f72d"?
>
>
> ------------------------------
>
> Message: 3
> Date: Tue, 2 Apr 2013 18:21:22 +0200 (CEST)
> From: Julia Lawall <julia.lawall@lip6.fr>
>
>
> I get the problem on the following code:
>
> irqreturn_t
> nouveau_irq_handler(DRM_IRQ_ARGS)
> {
>         struct drm_device *dev = arg;
>         struct nouveau_device *device = nouveau_dev(dev);
>         struct nouveau_mc *pmc = nouveau_mc(device);
>         u32 stat;
>
>         stat = nv_rd32(device, 0x000100);
>         if (stat == 0 || stat == ~0)
>                 return IRQ_NONE;
>
>         nv_subdev(pmc)->intr(nv_subdev(pmc));
>         return IRQ_HANDLED;
> }
>
> I would suspect that there is some inconsistency in how it is parsing this
> kind of argument list.  It seems to parse it OK, but then not be able to
> match it against a pattern like ...,x,...  I can look at it in more detail
> tomorrow.
>
> julia
>
>
>
>

[Cocci] Analysis for Linux source files

[Nic Volanschi (R&D)]

I guess that failing the match is OK. So taking the position of a type
could be a way of imposing an explicit type, isn't it.

Nic.

On Mon, 2013-04-08 at 16:56 +0200, Julia Lawall wrote:

> Actually, what result would you prefer?  In the previous fix that I made,
> I just caused the missing type, which was hidden under a macro, to make
> the match fail.  In this case, though perhaps you would prefer T to be
> bound to int?  That might cause some problemes, though, because it is not
> a real "int" in the source code...
> 
> julia
> 
> On Mon, 8 Apr 2013, Nic Volanschi (R&D) wrote:
> 
> > If this may help, I stumbled against the same error in a different setting, but I think the ultimate cause is the same:
> >
> > $ cat in.c
> > int foo()
> > {
> >   register rI;
> >   return rI;
> > }
> >
> > $ cat in.cocci
> > @f1@
> > identifier f;
> > position p;
> > type T;
> > @@
> > * T at p f;
> >
> > The reported error is the same: << Fatal error: exception Failure("empty list, max_min_ii_by_pos") >>
> > I localized the problem on the variable declaration <<register rI;>> where the type is missing (int by default). As soon as
> > you add the missing "int", the error disappears.
> > In fact, the error seems somewhat justified, as you are taking the position of an inexistent type.
> >
> > I guess that in the big file indicated by Markus, the problematic declaration is:
> >
> > static DEFINE_PER_CPU(unsigned long, cpu_loops_per_jiffy) = { 0 };
> >
> >
> > where we have the same missing, implicit int return type.
> >
> > Hope it helps,
> > Nic.
> >
> > On Wed, 2013-04-03 at 12:00 +0200, cocci-request at systeme.lip6.fr wrote:
> >
> > ----------------------------------------------------------------------
> >
> > Message: 1
> > Date: Tue, 02 Apr 2013 17:37:30 +0200
> > From: SF Markus Elfring <elfring@users.sourceforge.net>
> >
> >
> > Would you like to reproduce my issue with the following SmPL filter pattern on
> > the source file
> > "https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/init/calibrate.c?id=8595c539f0360477189eef91f6337b
> > a44962f72d"?
> >
> >
> > ------------------------------
> >
> > Message: 3
> > Date: Tue, 2 Apr 2013 18:21:22 +0200 (CEST)
> > From: Julia Lawall <julia.lawall@lip6.fr>
> >
> >
> > I get the problem on the following code:
> >
> > irqreturn_t
> > nouveau_irq_handler(DRM_IRQ_ARGS)
> > {
> >         struct drm_device *dev = arg;
> >         struct nouveau_device *device = nouveau_dev(dev);
> >         struct nouveau_mc *pmc = nouveau_mc(device);
> >         u32 stat;
> >
> >         stat = nv_rd32(device, 0x000100);
> >         if (stat == 0 || stat == ~0)
> >                 return IRQ_NONE;
> >
> >         nv_subdev(pmc)->intr(nv_subdev(pmc));
> >         return IRQ_HANDLED;
> > }
> >
> > I would suspect that there is some inconsistency in how it is parsing this
> > kind of argument list.  It seems to parse it OK, but then not be able to
> > match it against a pattern like ...,x,...  I can look at it in more detail
> > tomorrow.
> >
> > julia
> >
> >
> >
> >
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://systeme.lip6.fr/pipermail/cocci/attachments/20130408/0b5f7eeb/attachment-0001.html>

[Cocci] Analysis for Linux source files

[Julia Lawall]

Attached is a patch.  The line numbers may be off, but it should apply to
the latest version.  It causes a match failure for the following semantic
patch:

@r@
type T;
identifier x;
position p;
@@

T at p x;

@script:python@
T << r.T;
@@

print "before"
print T
print "after"

when applied to the following code:

int main () {
  register x;
  return 0;
}

The type metavariable would have been matched to the implicit "int", but
this implicit int doesn't have a position, so the match of the position
variable fails.  On the other hand, there is no more crash.

julia
-------------- next part --------------
diff --git a/engine/cocci_vs_c.ml b/engine/cocci_vs_c.ml
index 4d12515..26a479c 100644
--- a/engine/cocci_vs_c.ml
+++ b/engine/cocci_vs_c.ml
@@ -2820,7 +2820,13 @@ and (fullTypebis: (A.typeC, Ast_c.fullType) matcher) =
 	match ty with
 	  B.NoType -> false
 	| _ -> true in
-      if type_present
+      let position_required_but_unavailable =
+	match A.get_pos_var ida with
+	  [] -> false
+	| _ ->
+	    let (tyq, (ty, tyii)) = typb in
+	    List.for_all Ast_c.is_fake tyii in
+      if type_present && not position_required_but_unavailable
       then
 	let max_min _ =
 	  Lib_parsing_c.lin_col_by_pos (Lib_parsing_c.ii_of_type typb) in