[Bug analyzer/104524] New: [12 Regression] ICE in get_or_create_cast, at analyzer/region-model-manager.cc:499

[Bug analyzer/104524] New: [12 Regression] ICE in get_or_create_cast, at analyzer/region-model-manager.cc:499

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104524

            Bug ID: 104524
           Summary: [12 Regression] ICE in get_or_create_cast, at
                    analyzer/region-model-manager.cc:499
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

gcc 12.0.1 20220213 snapshot (g:58aeb75d4097010ad9bb72b964265b18ab284f93) ICEs
when compiling the following testcase, reduced from
gcc/testsuite/gcc.c-torture/execute/20010925-1.c, w/ -fanalyzer:

int src[1];

int
main (int c, char **a)
{
  __builtin_memcpy (*a, src, c);

  return 0;
}

% gcc-12.0.1 -fanalyzer -c gg3fyq9h.c
during IPA pass: analyzer
gg3fyq9h.c: In function 'main':
gg3fyq9h.c:6:3: internal compiler error: in get_or_create_cast, at
analyzer/region-model-manager.cc:499
    6 |   __builtin_memcpy (*a, src, c);
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x7b4eaf ana::region_model_manager::get_or_create_cast(tree_node*, ana::svalue
const*)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/region-model-manager.cc:499
0x12b5d48 ana::region_model_manager::maybe_fold_sub_svalue(tree_node*,
ana::svalue const*, ana::region const*)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/region-model-manager.cc:764
0x12b5d48 ana::region_model_manager::get_or_create_sub_svalue(tree_node*,
ana::svalue const*, ana::region const*)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/region-model-manager.cc:847
0x12dae75 ana::binding_cluster::get_any_binding(ana::store_manager*,
ana::region const*) const
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/store.cc:1477
0x1291adb ana::region_model::get_initial_value_for_global(ana::region const*)
const
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/region-model.cc:2034
0x12a7534 ana::region_model::impl_call_memcpy(ana::call_details const&)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/region-model-impl-calls.cc:515
0x12a0a3a ana::region_model::on_call_pre(gcall const*,
ana::region_model_context*, bool*)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/region-model.cc:1191
0x12a36e2 ana::region_model::on_stmt_pre(gimple const*, bool*, bool*,
ana::region_model_context*)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/region-model.cc:1074
0x1270248 ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode
const*, gimple const*, ana::program_state*, ana::uncertainty_t*,
ana::path_context*)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/engine.cc:1305
0x1273656 ana::exploded_graph::process_node(ana::exploded_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/engine.cc:3694
0x127467a ana::exploded_graph::process_worklist()
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/engine.cc:3137
0x1276d20 ana::impl_run_checkers(ana::logger*)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/engine.cc:5716
0x1277c1e ana::run_checkers()
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/engine.cc:5787
0x12668f8 execute
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220213/work/gcc-12-20220213/gcc/analyzer/analyzer-pass.cc:87

[Bug analyzer/104524] [12 Regression] ICE in get_or_create_cast, at analyzer/region-model-manager.cc:499

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104524

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.0

[Bug analyzer/104524] [12 Regression] ICE in get_or_create_cast, at analyzer/region-model-manager.cc:499

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104524

--- Comment #1 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:84832cab6e43db7fa10ec53d15f8f8457aa31080

commit r12-7252-g84832cab6e43db7fa10ec53d15f8f8457aa31080
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Feb 14 13:27:45 2022 -0500

    analyzer: fix ICE on cast to NULL type [PR104524]

    gcc/analyzer/ChangeLog:
            PR analyzer/104524
            * region-model-manager.cc
            (region_model_manager::maybe_fold_sub_svalue): Only call
            get_or_create_cast if type is non-NULL.

    gcc/testsuite/ChangeLog:
            PR analyzer/104524
            * gcc.dg/analyzer/pr104524.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/104524] [12 Regression] ICE in get_or_create_cast, at analyzer/region-model-manager.cc:499

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104524

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug; it should be fixed by the above commit.