[PATCH 15/73] linearize, flow: Fix asm operands, switch case bounds, and DSE

[Bart Van Assche <bvanassche@acm.org>]

Fix IR linearization and dead-store elimination issues in flow.c and
linearize.c:
- Continue scanning past OP_CALL for non-escaping locals while stopping
  at OP_ASM in kill_dead_stores_bb().
- Enlarge show_pseudo() formatting buffers and replace sprintf() with
  bounded snprintf().
- Guard VOID phi sources in linearize_logical(), register read-write
  '+r' asm outputs as inputs, guard non-string asm clobbers, and extend
  switch case values to the controlling expression width.
- Add regression test validation/linear/control-flow-fixes.c.

Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 flow.c                                 |  3 ++
 linearize.c                            | 46 ++++++++++++++++----------
 validation/linear/control-flow-fixes.c | 44 ++++++++++++++++++++++++
 3 files changed, 75 insertions(+), 18 deletions(-)
 create mode 100644 validation/linear/control-flow-fixes.c

diff --git a/flow.c b/flow.c
index 48755501e464..f89cd755a1ae 100644
--- a/flow.c
+++ b/flow.c
@@ -518,6 +518,9 @@ static void kill_dead_stores_bb(pseudo_t pseudo, unsigned long generation, struc
 		case OP_CALL:
 			if (!local)
 				return;
+			continue;
+		case OP_ASM:
+			return;
 		default:
 			continue;
 		}
diff --git a/linearize.c b/linearize.c
index 75850df0a90f..c6ec3703b149 100644
--- a/linearize.c
+++ b/linearize.c
@@ -98,7 +98,7 @@ const char *show_label(struct basic_block *bb)
 const char *show_pseudo(pseudo_t pseudo)
 {
 	static int n;
-	static char buffer[4][64];
+	static char buffer[4][256];
 	char *buf;
 	int i;
 
@@ -113,23 +113,23 @@ const char *show_pseudo(pseudo_t pseudo)
 		struct expression *expr;
 
 		if (!sym) {
-			snprintf(buf, 64, "<bad symbol>");
+			snprintf(buf, sizeof(buffer[0]), "<bad symbol>");
 			break;
 		}
 		if (sym->bb_target) {
-			snprintf(buf, 64, "%s", show_label(sym->bb_target));
+			snprintf(buf, sizeof(buffer[0]), "%s", show_label(sym->bb_target));
 			break;
 		}
 		if (sym->ident) {
-			snprintf(buf, 64, "%s", show_ident(sym->ident));
+			snprintf(buf, sizeof(buffer[0]), "%s", show_ident(sym->ident));
 			break;
 		}
 		expr = sym->initializer;
-		snprintf(buf, 64, "<anon symbol:%p>", verbose ? sym : NULL);
+		snprintf(buf, sizeof(buffer[0]), "<anon symbol:%p>", verbose ? sym : NULL);
 		if (expr) {
 			switch (expr->type) {
 			case EXPR_VALUE:
-				snprintf(buf, 64, "<symbol value: %lld>", expr->value);
+				snprintf(buf, sizeof(buffer[0]), "<symbol value: %lld>", expr->value);
 				break;
 			case EXPR_STRING:
 				return show_string(expr->string);
@@ -140,30 +140,30 @@ const char *show_pseudo(pseudo_t pseudo)
 		break;
 	}
 	case PSEUDO_REG:
-		i = snprintf(buf, 64, "%%r%d", pseudo->nr);
-		if (pseudo->ident)
-			sprintf(buf+i, "(%s)", show_ident(pseudo->ident));
+		i = snprintf(buf, sizeof(buffer[0]), "%%r%d", pseudo->nr);
+		if (pseudo->ident && i < (int)sizeof(buffer[0]))
+			snprintf(buf+i, sizeof(buffer[0]) - i, "(%s)", show_ident(pseudo->ident));
 		break;
 	case PSEUDO_VAL: {
 		long long value = pseudo->value;
 		if (value > 1000 || value < -1000)
-			snprintf(buf, 64, "$%#llx", value);
+			snprintf(buf, sizeof(buffer[0]), "$%#llx", value);
 		else
-			snprintf(buf, 64, "$%lld", value);
+			snprintf(buf, sizeof(buffer[0]), "$%lld", value);
 		break;
 	}
 	case PSEUDO_ARG:
-		snprintf(buf, 64, "%%arg%d", pseudo->nr);
+		snprintf(buf, sizeof(buffer[0]), "%%arg%d", pseudo->nr);
 		break;
 	case PSEUDO_PHI:
-		i = snprintf(buf, 64, "%%phi%d", pseudo->nr);
-		if (pseudo->ident)
-			sprintf(buf+i, "(%s)", show_ident(pseudo->ident));
+		i = snprintf(buf, sizeof(buffer[0]), "%%phi%d", pseudo->nr);
+		if (pseudo->ident && i < (int)sizeof(buffer[0]))
+			snprintf(buf+i, sizeof(buffer[0]) - i, "(%s)", show_ident(pseudo->ident));
 		break;
 	case PSEUDO_UNDEF:
 		return "UNDEF";
 	default:
-		snprintf(buf, 64, "<bad pseudo type %d>", pseudo->type);
+		snprintf(buf, sizeof(buffer[0]), "<bad pseudo type %d>", pseudo->type);
 	}
 	return buf;
 }
@@ -1746,7 +1746,8 @@ static pseudo_t linearize_logical(struct entrypoint *ep, struct expression *expr
 	src2 = linearize_expression_to_bool(ep, expr->right);
 	src2 = cast_pseudo(ep, src2, &bool_ctype, ctype);
 	phi2 = alloc_phi(ep->active, src2, ctype);
-	link_phi(node, phi2);
+	if (phi2 != VOID)
+		link_phi(node, phi2);
 
 	// join
 	set_activeblock(ep, merge);
@@ -2154,6 +2155,8 @@ static pseudo_t linearize_asm_statement(struct entrypoint *ep, struct statement
 
 	/* ... and the addresses for memory outputs */
 	FOR_EACH_PTR(stmt->asm_outputs, op) {
+		if (op->is_modify && !op->is_memory)
+			add_asm_input(ep, insn, op);
 		add_asm_output_address(ep, insn, op);
 	} END_FOR_EACH_PTR(op);
 
@@ -2166,7 +2169,8 @@ static pseudo_t linearize_asm_statement(struct entrypoint *ep, struct statement
 
 	/* and finally, look if it clobbers memory */
 	FOR_EACH_PTR(stmt->asm_clobbers, clob) {
-		if (!strcmp(clob->string->data, "memory"))
+		if (clob->type == EXPR_STRING && clob->string &&
+		    !strcmp(clob->string->data, "memory"))
 			insn->clobber_memory = 1;
 	} END_FOR_EACH_PTR(clob);
 
@@ -2262,11 +2266,17 @@ static pseudo_t linearize_switch(struct entrypoint *ep, struct statement *stmt)
 			continue;
 		} else {
 			struct expression *case_to = case_stmt->case_to;
+			struct symbol *ctype = expr->ctype;
 			long long begin, end;
 
 			begin = end = case_stmt->case_expression->value;
 			if (case_to && case_to->type == EXPR_VALUE)
 				end = case_to->value;
+			if (ctype->bit_size > 0) {
+				bool is_signed = !(ctype->ctype.modifiers & MOD_UNSIGNED);
+				begin = bits_extend(begin, ctype->bit_size, is_signed);
+				end = bits_extend(end, ctype->bit_size, is_signed);
+			}
 			if (begin > end)
 				jmp = alloc_multijmp(bb_case, end, begin);
 			else
diff --git a/validation/linear/control-flow-fixes.c b/validation/linear/control-flow-fixes.c
new file mode 100644
index 000000000000..507598d42458
--- /dev/null
+++ b/validation/linear/control-flow-fixes.c
@@ -0,0 +1,44 @@
+/* 1. Statement expression with return inside if condition */
+int stmt_expr_cond(void)
+{
+	if (({ if (0) return 0; 1; }))
+		return 1;
+	return 0;
+}
+
+/* 2. Logical expression with unreachable RHS after return */
+int logical_after_return(int x)
+{
+	return x && ({ return 2; 1; });
+}
+
+/* 3. asm "+r" read-write register and "m" memory operand preserve stores */
+int asm_rw_and_mem(void)
+{
+	int x = 42;
+	int y = 99;
+	asm("" : "+r"(x) : "m"(y));
+	return x;
+}
+
+/* 4. Switch on signed char with negative case label */
+int switch_signed_char(signed char c)
+{
+	switch (c) {
+	case -1:
+		return 1;
+	default:
+		return 0;
+	}
+}
+
+/*
+ * check-name: control-flow-fixes
+ * check-command: test-linearize -Wno-decl $file
+ *
+ * check-output-ignore
+ * check-output-excludes: VOID
+ * check-output-contains: store\\.32.*\\$99 -> 0\\[y\\]
+ * check-output-contains: in:.*"+r" (\\$42)
+ * check-output-contains: switch\\.8.*-1 ->
+ */