* segfaults in pathological cases from gcc testsuite
@ 2007-10-22 15:24 Alexey Dobriyan
2007-10-22 16:38 ` Christopher Li
2007-10-30 23:24 ` [PATCH] " Chris Li
0 siblings, 2 replies; 4+ messages in thread
From: Alexey Dobriyan @ 2007-10-22 15:24 UTC (permalink / raw)
To: linux-sparse; +Cc: adobriyan
FWIW, I fed full gcc tree to sparse not only testsuite. Suprisingly it
crashed only in two places:
--------------------------------------------------------
gcc/testsuite/gcc.c-torture/compile/limits-exprparen.c
#define LBR1 ( ( ( ( ( ( ( ( ( (
#define LBR2 LBR1 LBR1 LBR1 LBR1 LBR1 LBR1 LBR1 LBR1 LBR1 LBR1
#define LBR3 LBR2 LBR2 LBR2 LBR2 LBR2 LBR2 LBR2 LBR2 LBR2 LBR2
#define LBR4 LBR3 LBR3 LBR3 LBR3 LBR3 LBR3 LBR3 LBR3 LBR3 LBR3
#define LBR5 LBR4 LBR4 LBR4 LBR4 LBR4 LBR4 LBR4 LBR4 LBR4 LBR4
#define LBR6 LBR5 LBR5 LBR5 LBR5 LBR5 LBR5 LBR5 LBR5 LBR5 LBR5
#define RBR1 ) ) ) ) ) ) ) ) ) )
#define RBR2 RBR1 RBR1 RBR1 RBR1 RBR1 RBR1 RBR1 RBR1 RBR1 RBR1
#define RBR3 RBR2 RBR2 RBR2 RBR2 RBR2 RBR2 RBR2 RBR2 RBR2 RBR2
#define RBR4 RBR3 RBR3 RBR3 RBR3 RBR3 RBR3 RBR3 RBR3 RBR3 RBR3
#define RBR5 RBR4 RBR4 RBR4 RBR4 RBR4 RBR4 RBR4 RBR4 RBR4 RBR4
#define RBR6 RBR5 RBR5 RBR5 RBR5 RBR5 RBR5 RBR5 RBR5 RBR5 RBR5
int q5_var = LBR4 0 RBR4;
--------------------------------------------------------
gcc/testsuite/gcc.c-torture/compile/limits-caselabels.c
#define LIM1(x) x##0: x##1: x##2: x##3: x##4: x##5: x##6: x##7: x##8: x##9:
#define LIM2(x) LIM1(x##0) LIM1(x##1) LIM1(x##2) LIM1(x##3) LIM1(x##4) \
LIM1(x##5) LIM1(x##6) LIM1(x##7) LIM1(x##8) LIM1(x##9)
#define LIM3(x) LIM2(x##0) LIM2(x##1) LIM2(x##2) LIM2(x##3) LIM2(x##4) \
LIM2(x##5) LIM2(x##6) LIM2(x##7) LIM2(x##8) LIM2(x##9)
#define LIM4(x) LIM3(x##0) LIM3(x##1) LIM3(x##2) LIM3(x##3) LIM3(x##4) \
LIM3(x##5) LIM3(x##6) LIM3(x##7) LIM3(x##8) LIM3(x##9)
#define LIM5(x) LIM4(x##0) LIM4(x##1) LIM4(x##2) LIM4(x##3) LIM4(x##4) \
LIM4(x##5) LIM4(x##6) LIM4(x##7) LIM4(x##8) LIM4(x##9)
#define LIM6(x) LIM5(x##0) LIM5(x##1) LIM5(x##2) LIM5(x##3) LIM5(x##4) \
LIM5(x##5) LIM5(x##6) LIM5(x##7) LIM5(x##8) LIM5(x##9)
#define LIM7(x) LIM6(x##0) LIM6(x##1) LIM6(x##2) LIM6(x##3) LIM6(x##4) \
LIM6(x##5) LIM6(x##6) LIM6(x##7) LIM6(x##8) LIM6(x##9)
void q19_func (long i)
{
switch (i) {
LIM5 (case 1)
break;
}
}
--------------------------------------------------------
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: segfaults in pathological cases from gcc testsuite
2007-10-22 15:24 segfaults in pathological cases from gcc testsuite Alexey Dobriyan
@ 2007-10-22 16:38 ` Christopher Li
2007-10-27 22:01 ` Alexey Dobriyan
2007-10-30 23:24 ` [PATCH] " Chris Li
1 sibling, 1 reply; 4+ messages in thread
From: Christopher Li @ 2007-10-22 16:38 UTC (permalink / raw)
To: Alexey Dobriyan; +Cc: linux-sparse, adobriyan
On 10/22/07, Alexey Dobriyan <adobriyan@sw.ru> wrote:
> FWIW, I fed full gcc tree to sparse not only testsuite. Suprisingly it
> crashed only in two places:
>
>
> --------------------------------------------------------
> gcc/testsuite/gcc.c-torture/compile/limits-exprparen.c
I can't reproduce it for me. What command line
are you using?
> --------------------------------------------------------
> gcc/testsuite/gcc.c-torture/compile/limits-caselabels.c
>
This is cause by too deep recursive label statement chain.
Let me see what I can do about it.
Chris
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: segfaults in pathological cases from gcc testsuite
2007-10-22 16:38 ` Christopher Li
@ 2007-10-27 22:01 ` Alexey Dobriyan
0 siblings, 0 replies; 4+ messages in thread
From: Alexey Dobriyan @ 2007-10-27 22:01 UTC (permalink / raw)
To: Christopher Li; +Cc: Alexey Dobriyan, linux-sparse
On Mon, Oct 22, 2007 at 09:38:51AM -0700, Christopher Li wrote:
> On 10/22/07, Alexey Dobriyan <adobriyan@sw.ru> wrote:
> > FWIW, I fed full gcc tree to sparse not only testsuite. Suprisingly it
> > crashed only in two places:
> >
> >
> > --------------------------------------------------------
> > gcc/testsuite/gcc.c-torture/compile/limits-exprparen.c
>
> I can't reproduce it for me. What command line
> are you using?
ulimit -s 8192 actually. With 16384 it passes.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] Re: segfaults in pathological cases from gcc testsuite
2007-10-22 15:24 segfaults in pathological cases from gcc testsuite Alexey Dobriyan
2007-10-22 16:38 ` Christopher Li
@ 2007-10-30 23:24 ` Chris Li
1 sibling, 0 replies; 4+ messages in thread
From: Chris Li @ 2007-10-30 23:24 UTC (permalink / raw)
To: Alexey Dobriyan; +Cc: linux-sparse, adobriyan
[-- Attachment #1: Type: text/plain, Size: 657 bytes --]
I fix the second one as it is easier to reproduce and makes
more sense to fix.
Please see the patch attached.
A side note is that, I don't believe you can hit this using
real life C code. Maybe some programing generated C code.
There is not thing wrong in sparse except its recursion
is very deep. The patch special handle this test case.
The first one is even less interesting to fix.
Chris
On Oct 22, 2007 8:24 AM, Alexey Dobriyan <adobriyan@sw.ru> wrote:
> FWIW, I fed full gcc tree to sparse not only testsuite. Suprisingly it
> crashed only in two places:
> void q19_func (long i)
> {
> switch (i) {
> LIM5 (case 1)
> break;
> }
> }
[-- Attachment #2: label-parsing-1 --]
[-- Type: application/octet-stream, Size: 3932 bytes --]
Avoid deep recursion in empty case labels.
This patch take the empty case label as special case,
avoid deep recursion on both parsing and linearizion.
Signed-Off-By: Christopher Li<sparse@chrisli.org>
Index: sparse/parse.c
===================================================================
--- sparse.orig/parse.c 2007-10-30 13:48:28.000000000 -0700
+++ sparse/parse.c 2007-10-30 13:49:17.000000000 -0700
@@ -1678,25 +1678,30 @@ static struct token *parse_if_statement(
return statement(token->next, &stmt->if_false);
}
-static inline struct token *case_statement(struct token *token, struct statement *stmt)
-{
- stmt->type = STMT_CASE;
- token = expect(token, ':', "after default/case");
- add_case_statement(stmt);
- return statement(token, &stmt->case_statement);
-}
-
static struct token *parse_case_statement(struct token *token, struct statement *stmt)
{
- token = parse_expression(token->next, &stmt->case_expression);
- if (match_op(token, SPECIAL_ELLIPSIS))
- token = parse_expression(token->next, &stmt->case_to);
- return case_statement(token, stmt);
+ for (;;) {
+ token = parse_expression(token->next, &stmt->case_expression);
+ if (match_op(token, SPECIAL_ELLIPSIS))
+ token = parse_expression(token->next, &stmt->case_to);
+ stmt->type = STMT_CASE;
+ token = expect(token, ':', "after case");
+ add_case_statement(stmt);
+ if (!match_ident(token, &case_ident))
+ break;
+ stmt->case_statement = alloc_statement(token->pos, STMT_CASE);
+ stmt = stmt->case_statement;
+ token = token->next;
+ }
+ return statement(token, &stmt->case_statement);
}
static struct token *parse_default_statement(struct token *token, struct statement *stmt)
{
- return case_statement(token->next, stmt);
+ stmt->type = STMT_CASE;
+ token = expect(token->next, ':', "after default");
+ add_case_statement(stmt);
+ return statement(token, &stmt->case_statement);
}
static struct token *parse_loop_iterator(struct token *token, struct statement *stmt)
Index: sparse/linearize.c
===================================================================
--- sparse.orig/linearize.c 2007-10-30 13:48:28.000000000 -0700
+++ sparse/linearize.c 2007-10-30 13:55:26.000000000 -0700
@@ -1894,7 +1894,12 @@ pseudo_t linearize_statement(struct entr
}
case STMT_CASE: {
- add_label(ep, stmt->case_label);
+ for (;;) {
+ add_label(ep, stmt->case_label);
+ if (stmt->case_statement->type != STMT_CASE)
+ break;
+ stmt = stmt->case_statement;
+ }
linearize_statement(ep, stmt->case_statement);
break;
}
Index: sparse/validation/limits-caselabels.c
===================================================================
--- sparse.orig/validation/limits-caselabels.c 2007-10-30 13:50:19.000000000 -0700
+++ sparse/validation/limits-caselabels.c 2007-10-30 13:57:01.000000000 -0700
@@ -0,0 +1,27 @@
+#define LIM1(x) x##0: x##1: x##2: x##3: x##4: x##5: x##6: x##7: x##8: x##9:
+#define LIM2(x) LIM1(x##0) LIM1(x##1) LIM1(x##2) LIM1(x##3) LIM1(x##4) \
+ LIM1(x##5) LIM1(x##6) LIM1(x##7) LIM1(x##8) LIM1(x##9)
+#define LIM3(x) LIM2(x##0) LIM2(x##1) LIM2(x##2) LIM2(x##3) LIM2(x##4) \
+ LIM2(x##5) LIM2(x##6) LIM2(x##7) LIM2(x##8) LIM2(x##9)
+#define LIM4(x) LIM3(x##0) LIM3(x##1) LIM3(x##2) LIM3(x##3) LIM3(x##4) \
+ LIM3(x##5) LIM3(x##6) LIM3(x##7) LIM3(x##8) LIM3(x##9)
+#define LIM5(x) LIM4(x##0) LIM4(x##1) LIM4(x##2) LIM4(x##3) LIM4(x##4) \
+ LIM4(x##5) LIM4(x##6) LIM4(x##7) LIM4(x##8) LIM4(x##9)
+#define LIM6(x) LIM5(x##0) LIM5(x##1) LIM5(x##2) LIM5(x##3) LIM5(x##4) \
+ LIM5(x##5) LIM5(x##6) LIM5(x##7) LIM5(x##8) LIM5(x##9)
+#define LIM7(x) LIM6(x##0) LIM6(x##1) LIM6(x##2) LIM6(x##3) LIM6(x##4) \
+ LIM6(x##5) LIM6(x##6) LIM6(x##7) LIM6(x##8) LIM6(x##9)
+
+void q19_func (long i);
+void q19_func (long i)
+{
+ switch (i) {
+ LIM5 (case 1)
+ break;
+ }
+}
+
+/*
+ * check-name: Empty case label limits.
+ */
+
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2007-10-30 23:24 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-10-22 15:24 segfaults in pathological cases from gcc testsuite Alexey Dobriyan
2007-10-22 16:38 ` Christopher Li
2007-10-27 22:01 ` Alexey Dobriyan
2007-10-30 23:24 ` [PATCH] " Chris Li
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).