From: David Malcolm <dmalcolm@redhat.com>
Date: Thu, 20 Aug 2020 14:00:49 +0000 (-0400)
Subject: analyzer: fix infinite recursion ICE on unions [PR96723]
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=00cb0f5840795698557731c6e549a5ce99573223;p=gcc.git

analyzer: fix infinite recursion ICE on unions [PR96723]

Attempts to store sm-state into a union in C++ triggered an infinite
recursion when trying to generate a representative tree, due to
erroneously trying to use the dtor of the union as a field.

Fix it by filtering out non-FIELD_DECLs when walking TYPE_FIELDs
in region::get_subregions_for_binding.

gcc/analyzer/ChangeLog:
	PR analyzer/96723
	* region-model-manager.cc
	(region_model_manager::get_field_region): Assert that field is a
	FIELD_DECL.
	* region.cc (region::get_subregions_for_binding): In
	union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.

gcc/testsuite/ChangeLog:
	PR analyzer/96723
	* g++.dg/analyzer/pr96723.C: New test.
---

diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc
index 422c4a95e7b..75402649a91 100644
--- a/gcc/analyzer/region-model-manager.cc
+++ b/gcc/analyzer/region-model-manager.cc
@@ -781,6 +781,8 @@ region_model_manager::get_region_for_global (tree expr)
 const region *
 region_model_manager::get_field_region (const region *parent, tree field)
 {
+  gcc_assert (TREE_CODE (field) == FIELD_DECL);
+
   field_region::key_t key (parent, field);
   if (field_region *reg = m_field_regions.get (key))
     return reg;
diff --git a/gcc/analyzer/region.cc b/gcc/analyzer/region.cc
index c3dc8cdfa84..1823901a3ee 100644
--- a/gcc/analyzer/region.cc
+++ b/gcc/analyzer/region.cc
@@ -311,6 +311,8 @@ region::get_subregions_for_binding (region_model_manager *mgr,
 	for (tree field = TYPE_FIELDS (get_type ()); field != NULL_TREE;
 	     field = DECL_CHAIN (field))
 	  {
+	    if (TREE_CODE (field) != FIELD_DECL)
+	      continue;
 	    const region *subregion = mgr->get_field_region (this, field);
 	    subregion->get_subregions_for_binding (mgr,
 						   relative_bit_offset,
diff --git a/gcc/testsuite/g++.dg/analyzer/pr96723.C b/gcc/testsuite/g++.dg/analyzer/pr96723.C
new file mode 100644
index 00000000000..5d9980c9d2d
--- /dev/null
+++ b/gcc/testsuite/g++.dg/analyzer/pr96723.C
@@ -0,0 +1,10 @@
+void
+foo ()
+{
+  union
+  {
+    int *p;
+  } u;
+  u.p = new int;
+  delete u.p;
+}