public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/105765] New: [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue)
@ 2022-05-29 5:18 asolokha at gmx dot com
2022-05-29 13:07 ` [Bug analyzer/105765] " asolokha at gmx dot com
` (6 more replies)
0 siblings, 7 replies; 8+ messages in thread
From: asolokha at gmx dot com @ 2022-05-29 5:18 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105765
Bug ID: 105765
Summary: [13 Regression] ICE: Segmentation fault (in
ana::region_model::deref_rvalue)
Product: gcc
Version: 13.0
Status: UNCONFIRMED
Keywords: ice-on-valid-code
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: asolokha at gmx dot com
Target Milestone: ---
gcc 13.0.0 20220522 snapshot (g:a60228404f2ac11b5eb66270037ff3fa6bf948e5) ICEs
when compiling the following testcase, reduced from
clang/testsuite/CodeGen/ms_abi_aarch64.c from the clang 14.0.3 test suite, w/
-fanalyzer:
void
f4 (int a, ...)
{
__builtin_ms_va_list ap, ap2;
__builtin_ms_va_start (ap, a);
__builtin_ms_va_copy (ap2, ap);
__builtin_ms_va_end (ap);
}
% gcc-13.0.0 -fanalyzer -c jhszfd06.c
during IPA pass: analyzer
jhszfd06.c: In function 'f4':
jhszfd06.c:7:3: internal compiler error: Segmentation fault
7 | __builtin_ms_va_copy (ap2, ap);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0xedc30f crash_signal
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220522/work/gcc-13-20220522/gcc/toplev.cc:322
0x12af921 ana::region_model::deref_rvalue(ana::svalue const*, tree_node*,
ana::region_model_context*) const
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220522/work/gcc-13-20220522/gcc/analyzer/region-model.cc:2472
0x1311110 get_BT_VALIST_ARG
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220522/work/gcc-13-20220522/gcc/analyzer/varargs.cc:183
0x1311449 ana::region_model::impl_call_va_copy(ana::call_details const&)
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220522/work/gcc-13-20220522/gcc/analyzer/varargs.cc:670
0x12b2268 ana::region_model::on_call_pre(gcall const*,
ana::region_model_context*, bool*)
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220522/work/gcc-13-20220522/gcc/analyzer/region-model.cc:1439
0x12c0bc2 ana::region_model::on_stmt_pre(gimple const*, bool*, bool*,
ana::region_model_context*)
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220522/work/gcc-13-20220522/gcc/analyzer/region-model.cc:1213
0x128bff9 ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode
const*, gimple const*, ana::program_state*, ana::uncertainty_t*,
ana::path_context*)
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220522/work/gcc-13-20220522/gcc/analyzer/engine.cc:1383
0x128f3cc ana::exploded_graph::process_node(ana::exploded_node*)
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220522/work/gcc-13-20220522/gcc/analyzer/engine.cc:3776
0x12903da ana::exploded_graph::process_worklist()
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220522/work/gcc-13-20220522/gcc/analyzer/engine.cc:3219
0x1292ac5 ana::impl_run_checkers(ana::logger*)
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220522/work/gcc-13-20220522/gcc/analyzer/engine.cc:5811
0x12939ce ana::run_checkers()
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220522/work/gcc-13-20220522/gcc/analyzer/engine.cc:5885
0x1282358 execute
/var/tmp/portage/sys-devel/gcc-13.0.0_p20220522/work/gcc-13-20220522/gcc/analyzer/analyzer-pass.cc:87
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug analyzer/105765] [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue)
2022-05-29 5:18 [Bug analyzer/105765] New: [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue) asolokha at gmx dot com
@ 2022-05-29 13:07 ` asolokha at gmx dot com
2022-05-30 9:26 ` rguenth at gcc dot gnu.org
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: asolokha at gmx dot com @ 2022-05-29 13:07 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105765
--- Comment #1 from Arseny Solokha <asolokha at gmx dot com> ---
(In reply to Arseny Solokha from comment #0)
> reduced from clang/testsuite/CodeGen/ms_abi_aarch64.c
Of course, that should have been test/CodeGen/ms_abi_aarch64.c.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug analyzer/105765] [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue)
2022-05-29 5:18 [Bug analyzer/105765] New: [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue) asolokha at gmx dot com
2022-05-29 13:07 ` [Bug analyzer/105765] " asolokha at gmx dot com
@ 2022-05-30 9:26 ` rguenth at gcc dot gnu.org
2022-05-30 10:09 ` [Bug analyzer/105765] [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue) since r13-514-g2402dc6b982c4dac marxin at gcc dot gnu.org
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: rguenth at gcc dot gnu.org @ 2022-05-30 9:26 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105765
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|--- |13.0
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug analyzer/105765] [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue) since r13-514-g2402dc6b982c4dac
2022-05-29 5:18 [Bug analyzer/105765] New: [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue) asolokha at gmx dot com
2022-05-29 13:07 ` [Bug analyzer/105765] " asolokha at gmx dot com
2022-05-30 9:26 ` rguenth at gcc dot gnu.org
@ 2022-05-30 10:09 ` marxin at gcc dot gnu.org
2022-10-19 10:13 ` rguenth at gcc dot gnu.org
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: marxin at gcc dot gnu.org @ 2022-05-30 10:09 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105765
Martin Liška <marxin at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Last reconfirmed| |2022-05-30
Ever confirmed|0 |1
Summary|[13 Regression] ICE: |[13 Regression] ICE:
|Segmentation fault (in |Segmentation fault (in
|ana::region_model::deref_rv |ana::region_model::deref_rv
|alue) |alue) since
| |r13-514-g2402dc6b982c4dac
Status|UNCONFIRMED |NEW
CC| |marxin at gcc dot gnu.org
--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r13-514-g2402dc6b982c4dac.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug analyzer/105765] [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue) since r13-514-g2402dc6b982c4dac
2022-05-29 5:18 [Bug analyzer/105765] New: [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue) asolokha at gmx dot com
` (2 preceding siblings ...)
2022-05-30 10:09 ` [Bug analyzer/105765] [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue) since r13-514-g2402dc6b982c4dac marxin at gcc dot gnu.org
@ 2022-10-19 10:13 ` rguenth at gcc dot gnu.org
2022-10-19 13:45 ` [Bug analyzer/105765] [13 Regression] ICE: Segmentation fault on __builtin_ms_va_copy with -fanalyzer " dmalcolm at gcc dot gnu.org
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: rguenth at gcc dot gnu.org @ 2022-10-19 10:13 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105765
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P3 |P1
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug analyzer/105765] [13 Regression] ICE: Segmentation fault on __builtin_ms_va_copy with -fanalyzer since r13-514-g2402dc6b982c4dac
2022-05-29 5:18 [Bug analyzer/105765] New: [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue) asolokha at gmx dot com
` (3 preceding siblings ...)
2022-10-19 10:13 ` rguenth at gcc dot gnu.org
@ 2022-10-19 13:45 ` dmalcolm at gcc dot gnu.org
2022-10-19 20:50 ` cvs-commit at gcc dot gnu.org
2022-10-19 20:53 ` dmalcolm at gcc dot gnu.org
6 siblings, 0 replies; 8+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2022-10-19 13:45 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105765
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
Summary|[13 Regression] ICE: |[13 Regression] ICE:
|Segmentation fault (in |Segmentation fault on
|ana::region_model::deref_rv |__builtin_ms_va_copy with
|alue) since |-fanalyzer since
|r13-514-g2402dc6b982c4dac |r13-514-g2402dc6b982c4dac
--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug.
Reproduced on x86_64; looks like -fanalyzer's implementation of
BUILT_IN_VA_COPY makes assumptions about the types that don't hold for the
builtins created for x86_64 by ix86_init_builtins_va_builtins_abi (and
presumably something similar on aarch64?); am investigating.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug analyzer/105765] [13 Regression] ICE: Segmentation fault on __builtin_ms_va_copy with -fanalyzer since r13-514-g2402dc6b982c4dac
2022-05-29 5:18 [Bug analyzer/105765] New: [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue) asolokha at gmx dot com
` (4 preceding siblings ...)
2022-10-19 13:45 ` [Bug analyzer/105765] [13 Regression] ICE: Segmentation fault on __builtin_ms_va_copy with -fanalyzer " dmalcolm at gcc dot gnu.org
@ 2022-10-19 20:50 ` cvs-commit at gcc dot gnu.org
2022-10-19 20:53 ` dmalcolm at gcc dot gnu.org
6 siblings, 0 replies; 8+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2022-10-19 20:50 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105765
--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:
https://gcc.gnu.org/g:ebe87edadc4a3f15a6a0d0c1d4a198e0ea37d8b5
commit r13-3390-gebe87edadc4a3f15a6a0d0c1d4a198e0ea37d8b5
Author: David Malcolm <dmalcolm@redhat.com>
Date: Wed Oct 19 16:49:38 2022 -0400
analyzer: fix ICE on __builtin_ms_va_copy [PR105765]
gcc/analyzer/ChangeLog:
PR analyzer/105765
* varargs.cc (get_BT_VALIST_ARG): Rename to...
(get_va_copy_arg): ...this, and update logic for determining level
of indirection of va_copy's argument to use type of argument,
rather than looking at va_list_type_node, to correctly handle
__builtin_ms_va_copy.
(get_stateful_BT_VALIST_ARG): Rename to...
(get_stateful_va_copy_arg): ...this.
(va_list_state_machine::on_va_copy): Update for renaming.
(region_model::impl_call_va_copy): Likewise.
gcc/testsuite/ChangeLog:
PR analyzer/105765
* gcc.dg/analyzer/stdarg-1-ms_abi.c: New test, based on stdarg-1.c.
* gcc.dg/analyzer/stdarg-1-sysv_abi.c: Likewise.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug analyzer/105765] [13 Regression] ICE: Segmentation fault on __builtin_ms_va_copy with -fanalyzer since r13-514-g2402dc6b982c4dac
2022-05-29 5:18 [Bug analyzer/105765] New: [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue) asolokha at gmx dot com
` (5 preceding siblings ...)
2022-10-19 20:50 ` cvs-commit at gcc dot gnu.org
@ 2022-10-19 20:53 ` dmalcolm at gcc dot gnu.org
6 siblings, 0 replies; 8+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2022-10-19 20:53 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105765
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
Resolution|--- |FIXED
--- Comment #5 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above patch
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2022-10-19 20:53 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-29 5:18 [Bug analyzer/105765] New: [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue) asolokha at gmx dot com
2022-05-29 13:07 ` [Bug analyzer/105765] " asolokha at gmx dot com
2022-05-30 9:26 ` rguenth at gcc dot gnu.org
2022-05-30 10:09 ` [Bug analyzer/105765] [13 Regression] ICE: Segmentation fault (in ana::region_model::deref_rvalue) since r13-514-g2402dc6b982c4dac marxin at gcc dot gnu.org
2022-10-19 10:13 ` rguenth at gcc dot gnu.org
2022-10-19 13:45 ` [Bug analyzer/105765] [13 Regression] ICE: Segmentation fault on __builtin_ms_va_copy with -fanalyzer " dmalcolm at gcc dot gnu.org
2022-10-19 20:50 ` cvs-commit at gcc dot gnu.org
2022-10-19 20:53 ` dmalcolm at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).