[Bug analyzer/101837] New: ICE with -O3 -fsanitize=undefined -fanalyzer

[Bug analyzer/101837] New: ICE with -O3 -fsanitize=undefined -fanalyzer

[eggert at cs dot ucla.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101837

            Bug ID: 101837
           Summary: ICE with -O3 -fsanitize=undefined -fanalyzer
           Product: gcc
           Version: 11.2.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: eggert at cs dot ucla.edu
  Target Milestone: ---

Created attachment 51283
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51283&action=edit
Compile with "-O3 -fsanitize=undefined -fanalyzer -S" to reproduce the ICE

While building the time zone code I got an internal compiler error. This is
with cc (GCC) 11.2.1 20210728 (Red Hat 11.2.1-1) on Fedora 34 x86-64. Compile
the attached program u.c with:

cc -O3 -fsanitize=undefined -fanalyzer -S u.i

I briefly attempted to simplify u.c but the simplifications made the compiler
error go away.

[Bug analyzer/101837] [11/12 Regression] ICE with -O3 -fsanitize=undefined -fanalyzer since r11-7941-ge4bb1bd60a9fd1be

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101837

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org
            Summary|ICE with -O3                |[11/12 Regression] ICE with
                   |-fsanitize=undefined        |-O3 -fsanitize=undefined
                   |-fanalyzer                  |-fanalyzer since
                   |                            |r11-7941-ge4bb1bd60a9fd1be

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Thanks for the report. Reduced test-case:

$ cat pr101837.i
void memory_exhausted();
void memcheck(void *ptr) {
  if (ptr)
    memory_exhausted();
}

int emalloc(int size) { memcheck(__builtin_malloc(size)); }
int main() { int max_envvar_len = emalloc(max_envvar_len + 1); }

Started with r11-7941-ge4bb1bd60a9fd1be.

[Bug analyzer/101837] [11/12 Regression] ICE with -O3 -fsanitize=undefined -fanalyzer since r11-7941-ge4bb1bd60a9fd1be

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101837

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2021-08-18

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this; I'm testing a fix.

[Bug analyzer/101837] [11/12 Regression] ICE with -O3 -fsanitize=undefined -fanalyzer since r11-7941-ge4bb1bd60a9fd1be

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101837

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:4b821c7efbe12cfbb129a88541108b39058da526

commit r12-3095-g4b821c7efbe12cfbb129a88541108b39058da526
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Aug 23 14:09:44 2021 -0400

    analyzer: fix ICE when failing to reconstruct a fn ptr [PR101837]

    gcc/analyzer/ChangeLog:
            PR analyzer/101837
            * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
            NULL, and assert that it's non-NULL before passing it to
            build_call_array_loc.

    gcc/testsuite/ChangeLog:
            PR analyzer/101837
            * gcc.dg/analyzer/pr101837.c: New test.

[Bug analyzer/101837] [11/12 Regression] ICE with -O3 -fsanitize=undefined -fanalyzer since r11-7941-ge4bb1bd60a9fd1be

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101837

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by above commit.

[Bug analyzer/101837] [11/12 Regression] ICE with -O3 -fsanitize=undefined -fanalyzer since r11-7941-ge4bb1bd60a9fd1be

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101837

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jehova at existiert dot net

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
*** Bug 105925 has been marked as a duplicate of this bug. ***

[Bug analyzer/101837] [11/12 Regression] ICE with -O3 -fsanitize=undefined -fanalyzer since r11-7941-ge4bb1bd60a9fd1be

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101837

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |girgias at php dot net

--- Comment #6 from Martin Liška <marxin at gcc dot gnu.org> ---
*** Bug 105919 has been marked as a duplicate of this bug. ***