From a55f9e355f56855c060bd28b0453d23f8c8f8729 Mon Sep 17 00:00:00 2001
From: David Malcolm <dmalcolm@redhat.com>
Date: Wed, 10 Jun 2020 08:50:17 -0400
Subject: [PATCH 223/293] FIXME: don't create clusters for symbolic_region2 for
 unknown ptrs

---
 gcc/analyzer/region-model2.cc | 14 ++++++++++++++
 gcc/analyzer/region-model2.h  |  2 ++
 gcc/analyzer/store2.cc        | 24 +++++++++++++++++++++---
 3 files changed, 37 insertions(+), 3 deletions(-)

diff --git a/gcc/analyzer/region-model2.cc b/gcc/analyzer/region-model2.cc
index 6dcad63c2ea..9734991d57f 100644
--- a/gcc/analyzer/region-model2.cc
+++ b/gcc/analyzer/region-model2.cc
@@ -1854,6 +1854,20 @@ region2::get_view (tree type, region_model2 *model) const
 }
 #endif
 
+/* Return true if this is a symbolic region for deferencing an
+   unknown ptr.
+   We shouldn't attempt to bind values for this region (but
+   can unbind values for other regions).  */
+
+bool
+region2::symbolic_for_unknown_ptr_p () const
+{
+  if (const symbolic_region2 *sym_reg = dyn_cast_symbolic_region2 ())
+    if (sym_reg->get_pointer ()->get_kind () == svalue2::SK_UNKNOWN)
+      return true;
+  return false;
+}
+
 /* region2's ctor.  */
 
 region2::region2 (unsigned id, const region2 *parent, tree type)
diff --git a/gcc/analyzer/region-model2.h b/gcc/analyzer/region-model2.h
index 014b8a47995..8640b4d0e33 100644
--- a/gcc/analyzer/region-model2.h
+++ b/gcc/analyzer/region-model2.h
@@ -1126,6 +1126,8 @@ public:
 			      tree type,
 			      auto_vec <const region2 *> *out) const;
 
+  bool symbolic_for_unknown_ptr_p () const;
+
  protected:
   region2 (unsigned id, const region2 *parent, tree type);
 
diff --git a/gcc/analyzer/store2.cc b/gcc/analyzer/store2.cc
index 5a21699176e..e61c13301ab 100644
--- a/gcc/analyzer/store2.cc
+++ b/gcc/analyzer/store2.cc
@@ -1135,8 +1135,16 @@ store2::set_value (store2_manager *mgr, const region2 *lhs_reg,
   rhs_sval = simplify_for_binding (rhs_sval);
 
   const region2 *lhs_base_reg = lhs_reg->get_base_region ();
-  binding_cluster2 *lhs_cluster = get_or_create_cluster (lhs_base_reg);
-  lhs_cluster->bind (mgr, lhs_reg, rhs_sval, kind);
+  binding_cluster2 *lhs_cluster;
+  if (lhs_base_reg->symbolic_for_unknown_ptr_p ())
+    /* Reject attempting to bind values into a symbolic region
+       for an unknown ptr; merely invalidate values below.  */
+    lhs_cluster = NULL;
+  else
+    {
+      lhs_cluster = get_or_create_cluster (lhs_base_reg);
+      lhs_cluster->bind (mgr, lhs_reg, rhs_sval, kind);
+    }
 
 #if 1
   /* Bindings to a cluster can affect other clusters if a symbolic
@@ -1158,7 +1166,9 @@ store2::set_value (store2_manager *mgr, const region2 *lhs_reg,
       const region2 *iter_base_reg = (*iter).first;
       binding_cluster2 *iter_cluster = (*iter).second;
       if (iter_base_reg != lhs_base_reg
-	  && (lhs_cluster->symbolic_p () || iter_cluster->symbolic_p ()))
+	  && (lhs_cluster == NULL
+	      || lhs_cluster->symbolic_p ()
+	      || iter_cluster->symbolic_p ()))
 	{
 	  tristate t_alias = eval_alias (lhs_base_reg, iter_base_reg);
 	  switch (t_alias.get_value ())
@@ -1285,6 +1295,8 @@ void
 store2::zero_fill_region (store2_manager *mgr, const region2 *reg)
 {
   const region2 *base_reg = reg->get_base_region ();
+  if (base_reg->symbolic_for_unknown_ptr_p ())
+    return;
   binding_cluster2 *cluster = get_or_create_cluster (base_reg);
   cluster->zero_fill_region (mgr, reg);
 }
@@ -1295,6 +1307,8 @@ void
 store2::mark_region_as_unknown (store2_manager *mgr, const region2 *reg)
 {
   const region2 *base_reg = reg->get_base_region ();
+  if (base_reg->symbolic_for_unknown_ptr_p ())
+    return;
   binding_cluster2 *cluster = get_or_create_cluster (base_reg);
   cluster->mark_region_as_unknown (mgr, reg);
 }
@@ -1333,6 +1347,10 @@ store2::get_or_create_cluster (const region2 *base_reg)
 {
   gcc_assert (base_reg);
   gcc_assert (base_reg->get_base_region () == base_reg);
+
+  /* We shouldn't create clusters for dereferencing an UNKNOWN ptr.  */
+  gcc_assert (!base_reg->symbolic_for_unknown_ptr_p ());
+
   if (binding_cluster2 **slot = m_cluster_map.get (base_reg))
     return *slot;
 
-- 
2.26.2

