[Bug analyzer/105092] New: ICE in get_region_for_local, at analyzer/region.cc:874

[Bug analyzer/105092] New: ICE in get_region_for_local, at analyzer/region.cc:874

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105092

            Bug ID: 105092
           Summary: ICE in get_region_for_local, at analyzer/region.cc:874
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code, openmp
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

g++ 12.0.1 20220327 snapshot (g:08e69332881f8d28ce8b559ffba1900ae5c0d5ee) ICEs
when compiling the following testcase, reduced from
gcc/testsuite/g++.dg/gomp/depend-iterator-3.C, w/ -fanalyzer -fopenmp:

struct S {
  S () {}
};

template <typename T>
struct U {
  T c[10];
  U () {
#pragma omp task affinity (iterator (i = 0 : 10 : 1): c[i])
    ;
  }
};

U<S> v;

% g++-12.0.1 -fanalyzer -fopenmp -c r3zw7jzh.C
during IPA pass: analyzer
r3zw7jzh.C: In constructor 'U<T>::U() [with T = S]':
r3zw7jzh.C:9:38: internal compiler error: in get_region_for_local, at
analyzer/region.cc:874
    9 | #pragma omp task affinity (iterator (i = 0 : 10 : 1): c[i])
      |                                      ^
0x89a98a ana::frame_region::get_region_for_local(ana::region_model_manager*,
tree_node*, ana::region_model_context const*) const
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220327/work/gcc-12-20220327/gcc/analyzer/region.cc:874
0x157a169 ana::region_model::get_lvalue(ana::path_var,
ana::region_model_context*) const
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220327/work/gcc-12-20220327/gcc/analyzer/region-model.cc:2136
0x157a169 ana::region_model::get_lvalue(tree_node*, ana::region_model_context*)
const
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220327/work/gcc-12-20220327/gcc/analyzer/region-model.cc:2147
0x15801e6 ana::region_model::on_assignment(gassign const*,
ana::region_model_context*)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220327/work/gcc-12-20220327/gcc/analyzer/region-model.cc:1040
0x155665f ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode
const*, gimple const*, ana::program_state*, ana::uncertainty_t*,
ana::path_context*)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220327/work/gcc-12-20220327/gcc/analyzer/engine.cc:1361
0x1559a43 ana::exploded_graph::process_node(ana::exploded_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220327/work/gcc-12-20220327/gcc/analyzer/engine.cc:3755
0x155aa3a ana::exploded_graph::process_worklist()
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220327/work/gcc-12-20220327/gcc/analyzer/engine.cc:3198
0x155d101 ana::impl_run_checkers(ana::logger*)
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220327/work/gcc-12-20220327/gcc/analyzer/engine.cc:5777
0x155e02e ana::run_checkers()
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220327/work/gcc-12-20220327/gcc/analyzer/engine.cc:5851
0x154ccb8 execute
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220327/work/gcc-12-20220327/gcc/analyzer/analyzer-pass.cc:87

[Bug analyzer/105092] ICE in get_region_for_local, at analyzer/region.cc:874

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105092

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2022-03-29
     Ever confirmed|0                           |1
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-7790-g4cebae0924248beb.

[Bug analyzer/105092] ICE with local with NULL DECL_CONTEXT on templatized OpenMP iterator

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105092

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at redhat dot com,
                   |                            |jason at redhat dot com
            Summary|ICE in                      |ICE with local with NULL
                   |get_region_for_local, at    |DECL_CONTEXT on templatized
                   |analyzer/region.cc:874      |OpenMP iterator
             Status|NEW                         |WAITING

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
The root cause of PR analyzer/104979 involved looking up a local variable in
the wrong stack frame, so in r12-7790-g4cebae0924248beb I added assertions to
the analyzer to ensure that when accessing a local variable in a frame, the
frame is for the correct function.

This new assertion is failing on the templatizing OpenMP reproducer in
ana::frame_region::get_region_for_local:

869             case SSA_NAME:
870               {
871                 if (tree var = SSA_NAME_VAR (expr))
872                   {
873                     if (DECL_P (var))
874                       gcc_assert (DECL_CONTEXT (var) == m_fun->decl);
875                   }

on this gimple stmt:
  i_11 = 0;

The SSA name's underlying var_decl "i" has NULL for its DECL_CONTEXT, despite
appearing to be a local variable.

"i" is created here:

(gdb) bt
#0  copy_node (node=<var_decl 0x7fffea653d80 i>) at ../../src/gcc/tree.cc:1358
#1  0x0000000000bf64a3 in copy_decl (decl=<var_decl 0x7fffea653d80 i>) at
../../src/gcc/cp/lex.cc:1027
#2  0x0000000000d87d5c in tsubst_decl (t=<var_decl 0x7fffea653d80 i>,
args=<tree_vec 0x7fffea7d2700>, complain=3) at ../../src/gcc/cp/pt.cc:14912
#3  0x0000000000d9462f in tsubst_omp_clause_decl (decl=<tree_list
0x7fffea7db280>, args=<tree_vec 0x7fffea7d2700>, complain=3, 
    in_decl=<template_decl 0x7ffff7ffb480 __ct >,
iterator_cache=0x7fffffffcc10) at ../../src/gcc/cp/pt.cc:17540
#4  0x0000000000d9509d in tsubst_omp_clauses (clauses=<omp_clause
0x7fffea7d3fc0>, ort=C_ORT_OMP, args=<tree_vec 0x7fffea7d2700>, complain=3, 
    in_decl=<template_decl 0x7ffff7ffb480 __ct >) at
../../src/gcc/cp/pt.cc:17643
#5  0x0000000000d9eec5 in tsubst_expr (t=<omp_task 0x7fffea7db320>,
args=<tree_vec 0x7fffea7d2700>, complain=3, 
    in_decl=<template_decl 0x7ffff7ffb480 __ct >,
integral_constant_expression_p=false) at ../../src/gcc/cp/pt.cc:18974
#6  0x0000000000d9d132 in tsubst_expr (t=<bind_expr 0x7fffea7d45a0>,
args=<tree_vec 0x7fffea7d2700>, complain=3, 
    in_decl=<template_decl 0x7ffff7ffb480 __ct >,
integral_constant_expression_p=false) at ../../src/gcc/cp/pt.cc:18761
#7  0x0000000000d99d5c in tsubst_expr (t=<statement_list 0x7fffea7d2500>,
args=<tree_vec 0x7fffea7d2700>, complain=3, 
    in_decl=<template_decl 0x7ffff7ffb480 __ct >,
integral_constant_expression_p=false) at ../../src/gcc/cp/pt.cc:18404
#8  0x0000000000d9d132 in tsubst_expr (t=<bind_expr 0x7fffea7d4570>,
args=<tree_vec 0x7fffea7d2700>, complain=3, 
    in_decl=<template_decl 0x7ffff7ffb480 __ct >,
integral_constant_expression_p=false) at ../../src/gcc/cp/pt.cc:18761
#9  0x0000000000dc340d in instantiate_body (pattern=<template_decl
0x7ffff7ffb480 __ct >, args=<tree_vec 0x7fffea7d2700>, 
    d=<function_decl 0x7fffea7c4f00 __ct >, nested_p=false) at
../../src/gcc/cp/pt.cc:26338
#10 0x0000000000dc4fcf in instantiate_decl (d=<function_decl 0x7fffea7c4f00
__ct >, defer_ok=false, expl_inst_class_mem_p=false)
    at ../../src/gcc/cp/pt.cc:26630
#11 0x0000000000dc53bb in instantiate_pending_templates (retries=0) at
../../src/gcc/cp/pt.cc:26709
#12 0x0000000000ba2148 in c_parse_final_cleanups () at
../../src/gcc/cp/decl2.cc:5092
#13 0x0000000000f31e7a in c_common_parse_file () at
../../src/gcc/c-family/c-opts.cc:1262
#14 0x00000000014ef80a in compile_file () at ../../src/gcc/toplev.cc:452
#15 0x0000000000a20e98 in do_compile (no_backend=false) at
../../src/gcc/toplev.cc:2168
#16 toplev::main (this=this@entry=0x7fffffffdcae, argc=<optimized out>,
argc@entry=25, argv=<optimized out>, argv@entry=0x7fffffffddb8)
    at ../../src/gcc/toplev.cc:2320
#17 0x0000000000a22dd5 in main (argc=25, argv=0x7fffffffddb8) at
../../src/gcc/main.cc:39

as a copy of the "i" created here:

(gdb) bt
#0  make_node (code=VAR_DECL) at ../../src/gcc/tree.cc:1211
#1  0x00000000017e2d6e in build_decl (loc=292864, code=VAR_DECL,
name=<identifier_node 0x7fffea7d3d80 i>, type=<integer_type 0x7fffea6655e8
int>)
    at ../../src/gcc/tree.cc:5289
#2  0x0000000000d0c3ce in cp_parser_omp_iterators (parser=0x7fffea6747b8) at
../../src/gcc/cp/parser.cc:39118
#3  0x0000000000d0c746 in cp_parser_omp_clause_affinity (parser=0x7fffea6747b8,
list=<tree 0x0>) at ../../src/gcc/cp/parser.cc:39181
#4  0x0000000000d0f6b5 in cp_parser_omp_all_clauses (parser=0x7fffea6747b8,
mask=..., where=0x259c622 "#pragma omp task", 
    pragma_tok=0x7fffea5b41c8, finish_p=true, nested=0) at
../../src/gcc/cp/parser.cc:40274
#5  0x0000000000d1c848 in cp_parser_omp_task (parser=0x7fffea6747b8,
pragma_tok=0x7fffea5b41c8, if_p=0x0) at ../../src/gcc/cp/parser.cc:43585
#6  0x0000000000d307ba in cp_parser_omp_construct (parser=0x7fffea6747b8,
pragma_tok=0x7fffea5b41c8, if_p=0x0) at ../../src/gcc/cp/parser.cc:47225
#7  0x0000000000d31980 in cp_parser_pragma (parser=0x7fffea6747b8,
context=pragma_compound, if_p=0x0) at ../../src/gcc/cp/parser.cc:47866
#8  0x0000000000cd0ee5 in cp_parser_statement (parser=0x7fffea6747b8,
in_statement_expr=<tree 0x0>, in_compound=true, if_p=0x0, chain=0x0, 
    loc_after_labels=0x0) at ../../src/gcc/cp/parser.cc:12393
#9  0x0000000000cd1f60 in cp_parser_statement_seq_opt (parser=0x7fffea6747b8,
in_statement_expr=<tree 0x0>) at ../../src/gcc/cp/parser.cc:12846
#10 0x0000000000cd1e50 in cp_parser_compound_statement (parser=0x7fffea6747b8,
in_statement_expr=<tree 0x0>, bcs_flags=0, function_body=true)
    at ../../src/gcc/cp/parser.cc:12798
#11 0x0000000000cebffb in cp_parser_function_body (parser=0x7fffea6747b8,
in_function_try_block=false) at ../../src/gcc/cp/parser.cc:25056
#12 0x0000000000cec382 in cp_parser_ctor_initializer_opt_and_function_body
(parser=0x7fffea6747b8, in_function_try_block=false)
    at ../../src/gcc/cp/parser.cc:25107
#13 0x0000000000cf95bb in cp_parser_function_definition_after_declarator
(parser=0x7fffea6747b8, inline_p=true) at ../../src/gcc/cp/parser.cc:31237
#14 0x0000000000cfc4b6 in cp_parser_late_parsing_for_member
(parser=0x7fffea6747b8, member_function=<function_decl 0x7fffea7c4d00 __ct >)
    at ../../src/gcc/cp/parser.cc:32159
#15 0x0000000000cef1f0 in cp_parser_class_specifier_1 (parser=0x7fffea6747b8)
at ../../src/gcc/cp/parser.cc:26170
#16 0x0000000000cef2ec in cp_parser_class_specifier (parser=0x7fffea6747b8) at
../../src/gcc/cp/parser.cc:26198
#17 0x0000000000cdf767 in cp_parser_type_specifier (parser=0x7fffea6747b8,
flags=33, decl_specs=0x7fffffffd820, is_declaration=true, 
    declares_class_or_enum=0x7fffffffd77c, is_cv_qualifier=0x7fffffffd77b) at
../../src/gcc/cp/parser.cc:19342
#18 0x0000000000cd9513 in cp_parser_decl_specifier_seq (parser=0x7fffea6747b8,
flags=33, decl_specs=0x7fffffffd820, 
    declares_class_or_enum=0x7fffffffd8c4) at ../../src/gcc/cp/parser.cc:15901
#19 0x0000000000cfaa94 in cp_parser_single_declaration (parser=0x7fffea6747b8,
checks=0x0, member_p=false, explicit_specialization_p=false, 
    friend_p=0x7fffffffd917) at ../../src/gcc/cp/parser.cc:31642
#20 0x0000000000cf984a in cp_parser_template_declaration_after_parameters
(parser=0x7fffea6747b8, parameter_list=<tree_vec 0x7fffea7d22a0>, 
    member_p=false) at ../../src/gcc/cp/parser.cc:31305
#21 0x0000000000cfa909 in cp_parser_explicit_template_declaration
(parser=0x7fffea6747b8, member_p=false) at ../../src/gcc/cp/parser.cc:31571
#22 0x0000000000cfa967 in cp_parser_template_declaration_after_export
(parser=0x7fffea6747b8, member_p=false) at ../../src/gcc/cp/parser.cc:31590
#23 0x0000000000cdbff0 in cp_parser_template_declaration
(parser=0x7fffea6747b8, member_p=false) at ../../src/gcc/cp/parser.cc:17452
#24 0x0000000000cd7323 in cp_parser_declaration (parser=0x7fffea6747b8,
prefix_attrs=<tree 0x0>) at ../../src/gcc/cp/parser.cc:14893
#25 0x0000000000cd770d in cp_parser_toplevel_declaration
(parser=0x7fffea6747b8) at ../../src/gcc/cp/parser.cc:14983
#26 0x0000000000cbf9fc in cp_parser_translation_unit (parser=0x7fffea6747b8) at
../../src/gcc/cp/parser.cc:5010
#27 0x0000000000d31f14 in c_parse_file () at ../../src/gcc/cp/parser.cc:48046
#28 0x0000000000f31d90 in c_common_parse_file () at
../../src/gcc/c-family/c-opts.cc:1240
#29 0x00000000014ef80a in compile_file () at ../../src/gcc/toplev.cc:452
#30 0x0000000000a20e98 in do_compile (no_backend=false) at
../../src/gcc/toplev.cc:2168
#31 toplev::main (this=this@entry=0x7fffffffdcae, argc=<optimized out>,
argc@entry=25, argv=<optimized out>, argv@entry=0x7fffffffddb8)
    at ../../src/gcc/toplev.cc:2320
#32 0x0000000000a22dd5 in main (argc=25, argv=0x7fffffffddb8) at
../../src/gcc/main.cc:39

which has context: <function_decl 0x7fffea7c4d00 __ct >

The copy of "i" initially has the same context after copy_decl in tsubst_decl
here:

Run till exit from #0  0x0000000000bf64a3 in copy_decl (decl=<var_decl
0x7fffea653d80 i>) at ../../src/gcc/cp/lex.cc:1027
tsubst_decl (t=<var_decl 0x7fffea653d80 i>, args=<tree_vec 0x7fffea7d2700>,
complain=3) at ../../src/gcc/cp/pt.cc:14912
14912           r = copy_decl (t);

but later in tsubst_decl it gets overwritten here:

14982           DECL_CONTEXT (r) = ctx;

where "ctx" is NULL.  ctx was set to NULL was set in tsubst_decl earlier here:

14865               if (!(VAR_P (t) && DECL_LOCAL_DECL_P (t)))
14866                 /* Subsequent calls to pushdecl will fill this in.  */
14867                 ctx = NULL_TREE;

and ctxt remains NULL until the overwrite of DECL_CONTEXT (r).

I'm not quite sure what the expected interaction between C++ template
substitution and the OMP code here is.

Is it expected that every local var_decl has a non-NULL DECL_CONTEXT?
Alternatively, how should the analyzer determine which variables should be on
the stack, and, of those, which function they relate to?

Sorry if I'm missing something here.

[Bug c++/105092] ICE with local with NULL DECL_CONTEXT on templatized OpenMP iterator

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105092

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
             Status|WAITING                     |ASSIGNED
          Component|analyzer                    |c++
           Assignee|dmalcolm at gcc dot gnu.org        |jakub at gcc dot gnu.org

[Bug c++/105092] ICE with local with NULL DECL_CONTEXT on templatized OpenMP iterator

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105092

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 52714
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52714&action=edit
gcc12-pr105092.patch

Untested fix.

[Bug c++/105092] ICE with local with NULL DECL_CONTEXT on templatized OpenMP iterator

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105092

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:410f39f56c14b195f066b9a18a3c6e8ffa03f848

commit r12-7915-g410f39f56c14b195f066b9a18a3c6e8ffa03f848
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Mar 30 09:38:51 2022 +0200

    openmp: Ensure DECL_CONTEXT of OpenMP iterators in templates [PR105092]

    cp_parser_omp_iterators does:
          DECL_ARTIFICIAL (iter_var) = 1;
          DECL_CONTEXT (iter_var) = current_function_decl;
          pushdecl (iter_var);
    on the newly created iterator vars, but when we instantiate templates
    containing them, we just tsubst_decl them (which apparently for
    automatic vars clears DECL_CONTEXT with a comment that pushdecl should
    be called on them later).
    The result is that we have automatic vars in the IL which have NULL
    DECL_CONTEXT and the analyzer is upset about those.

    Fixed by setting DECL_CONTEXT and calling pushdecl during the
instantiation.

    2022-03-30  Jakub Jelinek  <jakub@redhat.com>

            PR c++/105092
            * pt.cc (tsubst_omp_clause_decl): When handling iterators, set
            DECL_CONTEXT of the iterator var to current_function_decl and
            call pushdecl.

            * g++.dg/gomp/pr105092.C: New test.

[Bug c++/105092] ICE with local with NULL DECL_CONTEXT on templatized OpenMP iterator

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105092

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.