program-state.cc
37.2 KB
-
analyzer: fix ICE due to sm-state origin being purged (PR 93382) · 591b59eb
The ICE in PR analyzer/93382 is a validation error. The global variable "idx" acquires a "tainted" state from local array n1[0]. When the frame is popped, the svalue for n1[0] is purged, but the "taint" sm_state_map's entry for "idx" has a svalue_id referencing the now-purged svalue. This is caught by program_state::validate as an assertion failure. This patch fixes the issue by resetting the origin id within sm_state_map entries for the case where the origin id has been purged. gcc/analyzer/ChangeLog: PR analyzer/93382 * program-state.cc (sm_state_map::on_svalue_purge): If the entry survives, but the origin is being purged, then reset the origin to null. gcc/testsuite/ChangeLog: PR analyzer/93382 * gcc.dg/analyzer/pr93382.c: New test.
David Malcolm committed