[PATCH] Re: segfaults in pathological cases from gcc testsuite

["Chris Li" <christ.li@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 657 bytes --]

I fix the second one as it is easier to reproduce and makes
more sense to fix.

Please see the patch attached.

A side note is that, I don't believe you can hit this using
real life C code. Maybe some programing generated C code.
There is not thing wrong in sparse except its recursion
is very deep. The patch special handle this test case.

The first one is even less interesting to fix.

Chris

On Oct 22, 2007 8:24 AM, Alexey Dobriyan <adobriyan@sw.ru> wrote:
> FWIW, I fed full gcc tree to sparse not only testsuite. Suprisingly it
> crashed only in two places:
> void q19_func (long i)
> {
>   switch (i) {
>     LIM5 (case 1)
>       break;
>   }
> }

[-- Attachment #2: label-parsing-1 --]
[-- Type: application/octet-stream, Size: 3932 bytes --]

Avoid deep recursion in empty case labels.

This patch take the empty case label as special case,
avoid deep recursion on both parsing and linearizion.

Signed-Off-By: Christopher Li<sparse@chrisli.org>

Index: sparse/parse.c
===================================================================
--- sparse.orig/parse.c	2007-10-30 13:48:28.000000000 -0700
+++ sparse/parse.c	2007-10-30 13:49:17.000000000 -0700
@@ -1678,25 +1678,30 @@ static struct token *parse_if_statement(
 	return statement(token->next, &stmt->if_false);
 }
 
-static inline struct token *case_statement(struct token *token, struct statement *stmt)
-{
-	stmt->type = STMT_CASE;
-	token = expect(token, ':', "after default/case");
-	add_case_statement(stmt);
-	return statement(token, &stmt->case_statement);
-}
-
 static struct token *parse_case_statement(struct token *token, struct statement *stmt)
 {
-	token = parse_expression(token->next, &stmt->case_expression);
-	if (match_op(token, SPECIAL_ELLIPSIS))
-		token = parse_expression(token->next, &stmt->case_to);
-	return case_statement(token, stmt);
+	for (;;) {
+		token = parse_expression(token->next, &stmt->case_expression);
+		if (match_op(token, SPECIAL_ELLIPSIS))
+			token = parse_expression(token->next, &stmt->case_to);
+		stmt->type = STMT_CASE;
+		token = expect(token, ':', "after case");
+		add_case_statement(stmt);
+		if (!match_ident(token, &case_ident))
+			break;
+		stmt->case_statement = alloc_statement(token->pos, STMT_CASE);
+		stmt = stmt->case_statement;
+		token = token->next;
+	}
+	return statement(token, &stmt->case_statement);
 }
 
 static struct token *parse_default_statement(struct token *token, struct statement *stmt)
 {
-	return case_statement(token->next, stmt);
+	stmt->type = STMT_CASE;
+	token = expect(token->next, ':', "after default");
+	add_case_statement(stmt);
+	return statement(token, &stmt->case_statement);
 }
 
 static struct token *parse_loop_iterator(struct token *token, struct statement *stmt)
Index: sparse/linearize.c
===================================================================
--- sparse.orig/linearize.c	2007-10-30 13:48:28.000000000 -0700
+++ sparse/linearize.c	2007-10-30 13:55:26.000000000 -0700
@@ -1894,7 +1894,12 @@ pseudo_t linearize_statement(struct entr
 	}
 
 	case STMT_CASE: {
-		add_label(ep, stmt->case_label);
+		for (;;) {
+			add_label(ep, stmt->case_label);
+			if (stmt->case_statement->type != STMT_CASE)
+				break;
+			stmt = stmt->case_statement;
+		}
 		linearize_statement(ep, stmt->case_statement);
 		break;
 	}
Index: sparse/validation/limits-caselabels.c
===================================================================
--- sparse.orig/validation/limits-caselabels.c	2007-10-30 13:50:19.000000000 -0700
+++ sparse/validation/limits-caselabels.c	2007-10-30 13:57:01.000000000 -0700
@@ -0,0 +1,27 @@
+#define LIM1(x) x##0: x##1: x##2: x##3: x##4: x##5: x##6: x##7: x##8: x##9:
+#define LIM2(x) LIM1(x##0) LIM1(x##1) LIM1(x##2) LIM1(x##3) LIM1(x##4) \
+               LIM1(x##5) LIM1(x##6) LIM1(x##7) LIM1(x##8) LIM1(x##9)
+#define LIM3(x) LIM2(x##0) LIM2(x##1) LIM2(x##2) LIM2(x##3) LIM2(x##4) \
+               LIM2(x##5) LIM2(x##6) LIM2(x##7) LIM2(x##8) LIM2(x##9)
+#define LIM4(x) LIM3(x##0) LIM3(x##1) LIM3(x##2) LIM3(x##3) LIM3(x##4) \
+               LIM3(x##5) LIM3(x##6) LIM3(x##7) LIM3(x##8) LIM3(x##9)
+#define LIM5(x) LIM4(x##0) LIM4(x##1) LIM4(x##2) LIM4(x##3) LIM4(x##4) \
+               LIM4(x##5) LIM4(x##6) LIM4(x##7) LIM4(x##8) LIM4(x##9)
+#define LIM6(x) LIM5(x##0) LIM5(x##1) LIM5(x##2) LIM5(x##3) LIM5(x##4) \
+               LIM5(x##5) LIM5(x##6) LIM5(x##7) LIM5(x##8) LIM5(x##9)
+#define LIM7(x) LIM6(x##0) LIM6(x##1) LIM6(x##2) LIM6(x##3) LIM6(x##4) \
+               LIM6(x##5) LIM6(x##6) LIM6(x##7) LIM6(x##8) LIM6(x##9)
+
+void q19_func (long i);
+void q19_func (long i)
+{
+ switch (i) {
+   LIM5 (case 1)
+     break;
+ }
+}
+
+/*
+ * check-name: Empty case label limits.
+ */
+