mirror of
https://github.com/autc04/Retro68.git
synced 2024-09-28 18:56:06 +00:00
391 lines
11 KiB
C++
391 lines
11 KiB
C++
|
/* Warn on problematic uses of alloca and variable length arrays.
|
||
|
Copyright (C) 2016-2022 Free Software Foundation, Inc.
|
||
|
Contributed by Aldy Hernandez <aldyh@redhat.com>.
|
||
|
|
||
|
This file is part of GCC.
|
||
|
|
||
|
GCC is free software; you can redistribute it and/or modify it under
|
||
|
the terms of the GNU General Public License as published by the Free
|
||
|
Software Foundation; either version 3, or (at your option) any later
|
||
|
version.
|
||
|
|
||
|
GCC is distributed in the hope that it will be useful, but WITHOUT ANY
|
||
|
WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||
|
FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||
|
for more details.
|
||
|
|
||
|
You should have received a copy of the GNU General Public License
|
||
|
along with GCC; see the file COPYING3. If not see
|
||
|
<http://www.gnu.org/licenses/>. */
|
||
|
|
||
|
#include "config.h"
|
||
|
#include "system.h"
|
||
|
#include "coretypes.h"
|
||
|
#include "backend.h"
|
||
|
#include "tree.h"
|
||
|
#include "gimple.h"
|
||
|
#include "tree-pass.h"
|
||
|
#include "ssa.h"
|
||
|
#include "gimple-pretty-print.h"
|
||
|
#include "diagnostic-core.h"
|
||
|
#include "fold-const.h"
|
||
|
#include "gimple-iterator.h"
|
||
|
#include "tree-ssa.h"
|
||
|
#include "tree-cfg.h"
|
||
|
#include "builtins.h"
|
||
|
#include "calls.h"
|
||
|
#include "cfgloop.h"
|
||
|
#include "intl.h"
|
||
|
#include "gimple-range.h"
|
||
|
|
||
|
static unsigned HOST_WIDE_INT adjusted_warn_limit (bool);
|
||
|
|
||
|
const pass_data pass_data_walloca = {
|
||
|
GIMPLE_PASS,
|
||
|
"walloca",
|
||
|
OPTGROUP_NONE,
|
||
|
TV_NONE,
|
||
|
PROP_cfg, // properties_required
|
||
|
0, // properties_provided
|
||
|
0, // properties_destroyed
|
||
|
0, // properties_start
|
||
|
0, // properties_finish
|
||
|
};
|
||
|
|
||
|
class pass_walloca : public gimple_opt_pass
|
||
|
{
|
||
|
public:
|
||
|
pass_walloca (gcc::context *ctxt)
|
||
|
: gimple_opt_pass(pass_data_walloca, ctxt), xlimit_certain_p (false)
|
||
|
{}
|
||
|
opt_pass *clone () { return new pass_walloca (m_ctxt); }
|
||
|
void set_pass_param (unsigned int n, bool param)
|
||
|
{
|
||
|
gcc_assert (n == 0);
|
||
|
// Set to true to enable only warnings for alloca calls that
|
||
|
// are certainly in excess of the limit. This includes calls
|
||
|
// with constant arguments but excludes those in ranges (that
|
||
|
// can only be determined by range analysis) as well as
|
||
|
// the "may be too large" kind.
|
||
|
xlimit_certain_p = param;
|
||
|
}
|
||
|
virtual bool gate (function *);
|
||
|
virtual unsigned int execute (function *);
|
||
|
|
||
|
private:
|
||
|
// Set to TRUE the first time we run this pass on a function.
|
||
|
bool xlimit_certain_p;
|
||
|
};
|
||
|
|
||
|
bool
|
||
|
pass_walloca::gate (function *fun ATTRIBUTE_UNUSED)
|
||
|
{
|
||
|
// Warning is disabled when its size limit is greater than PTRDIFF_MAX
|
||
|
// for the target maximum, which makes the limit negative since when
|
||
|
// represented in signed HOST_WIDE_INT.
|
||
|
unsigned HOST_WIDE_INT max = tree_to_uhwi (TYPE_MAX_VALUE (ptrdiff_type_node));
|
||
|
return (adjusted_warn_limit (false) <= max
|
||
|
|| adjusted_warn_limit (true) <= max);
|
||
|
}
|
||
|
|
||
|
// Possible problematic uses of alloca.
|
||
|
enum alloca_type {
|
||
|
// Alloca argument is within known bounds that are appropriate.
|
||
|
ALLOCA_OK,
|
||
|
|
||
|
// Alloca argument is KNOWN to have a value that is too large.
|
||
|
ALLOCA_BOUND_DEFINITELY_LARGE,
|
||
|
|
||
|
// Alloca argument may be too large.
|
||
|
ALLOCA_BOUND_MAYBE_LARGE,
|
||
|
|
||
|
// Alloca appears in a loop.
|
||
|
ALLOCA_IN_LOOP,
|
||
|
|
||
|
// Alloca argument is 0.
|
||
|
ALLOCA_ARG_IS_ZERO,
|
||
|
|
||
|
// Alloca call is unbounded. That is, there is no controlling
|
||
|
// predicate for its argument.
|
||
|
ALLOCA_UNBOUNDED
|
||
|
};
|
||
|
|
||
|
// Type of an alloca call with its corresponding limit, if applicable.
|
||
|
class alloca_type_and_limit {
|
||
|
public:
|
||
|
enum alloca_type type;
|
||
|
// For ALLOCA_BOUND_MAYBE_LARGE and ALLOCA_BOUND_DEFINITELY_LARGE
|
||
|
// types, this field indicates the assumed limit if known or
|
||
|
// integer_zero_node if unknown. For any other alloca types, this
|
||
|
// field is undefined.
|
||
|
wide_int limit;
|
||
|
alloca_type_and_limit ();
|
||
|
alloca_type_and_limit (enum alloca_type type,
|
||
|
wide_int i) : type(type), limit(i) { }
|
||
|
alloca_type_and_limit (enum alloca_type type) : type(type)
|
||
|
{
|
||
|
limit = wi::to_wide (integer_zero_node);
|
||
|
}
|
||
|
};
|
||
|
|
||
|
/* Return TRUE if the user specified a limit for either VLAs or ALLOCAs. */
|
||
|
|
||
|
static bool
|
||
|
warn_limit_specified_p (bool is_vla)
|
||
|
{
|
||
|
unsigned HOST_WIDE_INT max = is_vla ? warn_vla_limit : warn_alloca_limit;
|
||
|
return max != HOST_WIDE_INT_MAX;
|
||
|
}
|
||
|
|
||
|
/* Return the value of the argument N to -Walloca-larger-than= or
|
||
|
-Wvla-larger-than= adjusted for the target data model so that
|
||
|
when N == HOST_WIDE_INT_MAX, the adjusted value is set to
|
||
|
PTRDIFF_MAX on the target. This is done to prevent warnings
|
||
|
for unknown/unbounded allocations in the "permissive mode"
|
||
|
while still diagnosing excessive and necessarily invalid
|
||
|
allocations. */
|
||
|
|
||
|
static unsigned HOST_WIDE_INT
|
||
|
adjusted_warn_limit (bool idx)
|
||
|
{
|
||
|
static HOST_WIDE_INT limits[2];
|
||
|
if (limits[idx])
|
||
|
return limits[idx];
|
||
|
|
||
|
limits[idx] = idx ? warn_vla_limit : warn_alloca_limit;
|
||
|
if (limits[idx] != HOST_WIDE_INT_MAX)
|
||
|
return limits[idx];
|
||
|
|
||
|
limits[idx] = tree_to_shwi (TYPE_MAX_VALUE (ptrdiff_type_node));
|
||
|
return limits[idx];
|
||
|
}
|
||
|
|
||
|
// Analyze the alloca call in STMT and return the alloca type with its
|
||
|
// corresponding limit (if applicable). IS_VLA is set if the alloca
|
||
|
// call was created by the gimplifier for a VLA.
|
||
|
|
||
|
static class alloca_type_and_limit
|
||
|
alloca_call_type (gimple *stmt, bool is_vla)
|
||
|
{
|
||
|
gcc_assert (gimple_alloca_call_p (stmt));
|
||
|
tree len = gimple_call_arg (stmt, 0);
|
||
|
|
||
|
gcc_assert (!is_vla || warn_vla_limit >= 0);
|
||
|
gcc_assert (is_vla || warn_alloca_limit >= 0);
|
||
|
|
||
|
// Adjust warn_alloca_max_size for VLAs, by taking the underlying
|
||
|
// type into account.
|
||
|
unsigned HOST_WIDE_INT max_size = adjusted_warn_limit (is_vla);
|
||
|
|
||
|
// Check for the obviously bounded case.
|
||
|
if (TREE_CODE (len) == INTEGER_CST)
|
||
|
{
|
||
|
if (tree_to_uhwi (len) > max_size)
|
||
|
return alloca_type_and_limit (ALLOCA_BOUND_DEFINITELY_LARGE,
|
||
|
wi::to_wide (len));
|
||
|
if (integer_zerop (len))
|
||
|
{
|
||
|
const offset_int maxobjsize
|
||
|
= wi::to_offset (max_object_size ());
|
||
|
alloca_type result = (max_size < maxobjsize
|
||
|
? ALLOCA_ARG_IS_ZERO : ALLOCA_OK);
|
||
|
return alloca_type_and_limit (result);
|
||
|
}
|
||
|
|
||
|
return alloca_type_and_limit (ALLOCA_OK);
|
||
|
}
|
||
|
|
||
|
struct alloca_type_and_limit ret = alloca_type_and_limit (ALLOCA_OK);
|
||
|
// If we have a declared maximum size, we can take it into account.
|
||
|
if (gimple_call_builtin_p (stmt, BUILT_IN_ALLOCA_WITH_ALIGN_AND_MAX))
|
||
|
{
|
||
|
tree arg = gimple_call_arg (stmt, 2);
|
||
|
if (compare_tree_int (arg, max_size) <= 0)
|
||
|
ret = alloca_type_and_limit (ALLOCA_OK);
|
||
|
else
|
||
|
{
|
||
|
const offset_int maxobjsize
|
||
|
= wi::to_offset (max_object_size ());
|
||
|
alloca_type result = (max_size < maxobjsize
|
||
|
? ALLOCA_BOUND_MAYBE_LARGE : ALLOCA_OK);
|
||
|
ret = alloca_type_and_limit (result, wi::to_wide (arg));
|
||
|
}
|
||
|
return ret;
|
||
|
}
|
||
|
|
||
|
// If the user specified a limit, use it.
|
||
|
int_range_max r;
|
||
|
if (warn_limit_specified_p (is_vla)
|
||
|
&& TREE_CODE (len) == SSA_NAME
|
||
|
&& get_range_query (cfun)->range_of_expr (r, len, stmt)
|
||
|
&& !r.varying_p ())
|
||
|
{
|
||
|
// The invalid bits are anything outside of [0, MAX_SIZE].
|
||
|
int_range<2> invalid_range (build_int_cst (size_type_node, 0),
|
||
|
build_int_cst (size_type_node, max_size),
|
||
|
VR_ANTI_RANGE);
|
||
|
|
||
|
r.intersect (invalid_range);
|
||
|
if (r.undefined_p ())
|
||
|
return alloca_type_and_limit (ALLOCA_OK);
|
||
|
|
||
|
return alloca_type_and_limit (ALLOCA_BOUND_MAYBE_LARGE,
|
||
|
wi::to_wide (integer_zero_node));
|
||
|
}
|
||
|
|
||
|
const offset_int maxobjsize = tree_to_shwi (max_object_size ());
|
||
|
/* When MAX_SIZE is greater than or equal to PTRDIFF_MAX treat
|
||
|
allocations that aren't visibly constrained as OK, otherwise
|
||
|
report them as (potentially) unbounded. */
|
||
|
alloca_type unbounded_result = (max_size < maxobjsize.to_uhwi ()
|
||
|
? ALLOCA_UNBOUNDED : ALLOCA_OK);
|
||
|
return alloca_type_and_limit (unbounded_result);
|
||
|
}
|
||
|
|
||
|
// Return TRUE if STMT is in a loop, otherwise return FALSE.
|
||
|
|
||
|
static bool
|
||
|
in_loop_p (gimple *stmt)
|
||
|
{
|
||
|
basic_block bb = gimple_bb (stmt);
|
||
|
return
|
||
|
bb->loop_father && bb->loop_father->header != ENTRY_BLOCK_PTR_FOR_FN (cfun);
|
||
|
}
|
||
|
|
||
|
unsigned int
|
||
|
pass_walloca::execute (function *fun)
|
||
|
{
|
||
|
gimple_ranger *ranger = enable_ranger (fun);
|
||
|
basic_block bb;
|
||
|
FOR_EACH_BB_FN (bb, fun)
|
||
|
{
|
||
|
for (gimple_stmt_iterator si = gsi_start_bb (bb); !gsi_end_p (si);
|
||
|
gsi_next (&si))
|
||
|
{
|
||
|
gimple *stmt = gsi_stmt (si);
|
||
|
if (!gimple_alloca_call_p (stmt))
|
||
|
continue;
|
||
|
|
||
|
location_t loc = gimple_nonartificial_location (stmt);
|
||
|
loc = expansion_point_location_if_in_system_header (loc);
|
||
|
|
||
|
const bool is_vla
|
||
|
= gimple_call_alloca_for_var_p (as_a <gcall *> (stmt));
|
||
|
|
||
|
// Strict mode whining for VLAs is handled by the front-end,
|
||
|
// so we can safely ignore this case. Also, ignore VLAs if
|
||
|
// the user doesn't care about them.
|
||
|
if (is_vla)
|
||
|
{
|
||
|
if (warn_vla > 0 || warn_vla_limit < 0)
|
||
|
continue;
|
||
|
}
|
||
|
else if (warn_alloca)
|
||
|
{
|
||
|
warning_at (loc, OPT_Walloca, "use of %<alloca%>");
|
||
|
continue;
|
||
|
}
|
||
|
else if (warn_alloca_limit < 0)
|
||
|
continue;
|
||
|
|
||
|
class alloca_type_and_limit t
|
||
|
= alloca_call_type (stmt, is_vla);
|
||
|
|
||
|
unsigned HOST_WIDE_INT adjusted_alloca_limit
|
||
|
= adjusted_warn_limit (false);
|
||
|
// Even if we think the alloca call is OK, make sure it's not in a
|
||
|
// loop, except for a VLA, since VLAs are guaranteed to be cleaned
|
||
|
// up when they go out of scope, including in a loop.
|
||
|
if (t.type == ALLOCA_OK && !is_vla && in_loop_p (stmt))
|
||
|
{
|
||
|
/* As in other instances, only diagnose this when the limit
|
||
|
is less than the maximum valid object size. */
|
||
|
const offset_int maxobjsize
|
||
|
= wi::to_offset (max_object_size ());
|
||
|
if (adjusted_alloca_limit < maxobjsize.to_uhwi ())
|
||
|
t = alloca_type_and_limit (ALLOCA_IN_LOOP);
|
||
|
}
|
||
|
|
||
|
enum opt_code wcode
|
||
|
= is_vla ? OPT_Wvla_larger_than_ : OPT_Walloca_larger_than_;
|
||
|
char buff[WIDE_INT_MAX_PRECISION / 4 + 4];
|
||
|
switch (t.type)
|
||
|
{
|
||
|
case ALLOCA_OK:
|
||
|
break;
|
||
|
case ALLOCA_BOUND_MAYBE_LARGE:
|
||
|
{
|
||
|
if (xlimit_certain_p)
|
||
|
break;
|
||
|
|
||
|
auto_diagnostic_group d;
|
||
|
if (warning_at (loc, wcode,
|
||
|
(is_vla
|
||
|
? G_("argument to variable-length "
|
||
|
"array may be too large")
|
||
|
: G_("argument to %<alloca%> may be too "
|
||
|
"large")))
|
||
|
&& t.limit != 0)
|
||
|
{
|
||
|
print_decu (t.limit, buff);
|
||
|
inform (loc, "limit is %wu bytes, but argument "
|
||
|
"may be as large as %s",
|
||
|
is_vla ? warn_vla_limit : adjusted_alloca_limit,
|
||
|
buff);
|
||
|
}
|
||
|
}
|
||
|
break;
|
||
|
case ALLOCA_BOUND_DEFINITELY_LARGE:
|
||
|
{
|
||
|
auto_diagnostic_group d;
|
||
|
if (warning_at (loc, wcode,
|
||
|
(is_vla
|
||
|
? G_("argument to variable-length"
|
||
|
" array is too large")
|
||
|
: G_("argument to %<alloca%> is too large")))
|
||
|
&& t.limit != 0)
|
||
|
{
|
||
|
print_decu (t.limit, buff);
|
||
|
inform (loc, "limit is %wu bytes, but argument is %s",
|
||
|
is_vla ? warn_vla_limit : adjusted_alloca_limit,
|
||
|
buff);
|
||
|
}
|
||
|
}
|
||
|
break;
|
||
|
case ALLOCA_UNBOUNDED:
|
||
|
if (xlimit_certain_p)
|
||
|
break;
|
||
|
|
||
|
warning_at (loc, wcode,
|
||
|
(is_vla
|
||
|
? G_("unbounded use of variable-length array")
|
||
|
: G_("unbounded use of %<alloca%>")));
|
||
|
break;
|
||
|
case ALLOCA_IN_LOOP:
|
||
|
gcc_assert (!is_vla);
|
||
|
warning_at (loc, wcode,
|
||
|
"use of %<alloca%> within a loop");
|
||
|
break;
|
||
|
case ALLOCA_ARG_IS_ZERO:
|
||
|
warning_at (loc, wcode,
|
||
|
(is_vla
|
||
|
? G_("argument to variable-length array "
|
||
|
"is zero")
|
||
|
: G_("argument to %<alloca%> is zero")));
|
||
|
break;
|
||
|
default:
|
||
|
gcc_unreachable ();
|
||
|
}
|
||
|
}
|
||
|
}
|
||
|
ranger->export_global_ranges ();
|
||
|
disable_ranger (fun);
|
||
|
return 0;
|
||
|
}
|
||
|
|
||
|
gimple_opt_pass *
|
||
|
make_pass_walloca (gcc::context *ctxt)
|
||
|
{
|
||
|
return new pass_walloca (ctxt);
|
||
|
}
|