On Wed, Nov 02, 2016 at 10:36:44AM +0100, Martin Liška wrote:
> On 11/01/2016 03:53 PM, Jakub Jelinek wrote:
> > What kind of false positives it is for each case? Is it with normal
> > asan-bootstrap (without your -fsanitize-use-after-scope changes), or
> > only with those changes, or only with those changes and
> > -fsanitize-use-after-scope used during bootstrap?
>
> Ok, the situation is simpler than I thought:
CCing also Marek.
>
> #include <stdio.h>
>
> int main(int argc, char **argv)
> {
> int *ptr;
>
> switch (argc)
> {
> int a;
>
> case 1:
> break;
>
> default:
> ptr = &a;
> break;
> }
>
> fprintf (stderr, "v: %d\n", *ptr);
> return 0;
> }
>
> Which is gimplified as:
>
> int * ptr;
>
> switch (argc) <default: <D.2575>, case 1: <D.2573>>
> {
> int a;
>
> try
> {
> ASAN_MARK (2, &a, 4);
> <D.2573>:
> goto <D.2574>;
> <D.2575>:
> ptr = &a;
> goto <D.2574>;
> }
> finally
> {
> ASAN_MARK (1, &a, 4);
> }
> }
> <D.2574>:
> _1 = *ptr;
> stderr.0_2 = stderr;
> fprintf (stderr.0_2, "v: %d\n", _1);
> D.2577 = 0;
> return D.2577;
> }
> D.2577 = 0;
> return D.2577;
>
> and thus we get:
> /tmp/switch-case.c:9:11: warning: statement will never be executed
> [-Wswitch-unreachable]
> int a;
>
> I'm wondering where properly fix that, we can either find all these
> ASAN_MARKs in gimplify_switch_expr
> and distribute it to all labels (which are gimplified). Or we can put such
> variables to asan_poisoned_variables
> if we have information that we're gimplifing statements before a first label.
> Do we know that from gimple context?
> If so, these variables will be unpoisoned at the very beginning of each label
> and the ASAN_MARK call in between
> switch statement and a first label can be removed.
Wouldn't it be easiest if -Wswitch-unreachable warning just ignored
the ASAN_MARK internal calls altogether?
Do you emit there any other statements, or just ASAN_MARK and nothing else?
Shouldn't there be also ASAN_MARK on the implicit gotos from the switch
statement? Otherwise, consider this being done in a loop, after the first
iteration you ASAN_MARK (1, &a, 4) (i.e. poison), then you iterate say with
args 1 and have in case 1: a = 0;, won't that trigger runtime error?
Jakub
