[Bug analyzer/107158] New: internal compiler error: in get_or_create_cluster, at analyzer/store.cc:2832

[Bug analyzer/107158] New: internal compiler error: in get_or_create_cluster, at analyzer/store.cc:2832

[urs at akk dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107158

            Bug ID: 107158
           Summary: internal compiler error: in get_or_create_cluster, at
                    analyzer/store.cc:2832
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: urs at akk dot org
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu
             Build: x86_64-pc-linux-gnu

gcc build from git @ 49192c41de94b2746cd33366134b6aeaefa6ca2a
with
configure --program-suffix=-13 --enable-languages=c,lto --enable-lto
--disable-multilib
make -j 4 BOOT_CFLAGS='-pipe -O0 -w' bootstrap

on x86_64-pc-linux-gnu (Intel(R) Core(TM) i7-6700T); Ubuntu 22.04.1 LTS; GLIBC
2.35-0ubuntu3.1


gcc-13 -v -save-temps -freport-bug -I. -I../include -DHAVE_CONFIG_H -g -std=c11
-O2 -Wextra -Wpedantic -Wall -Winline -Wshadow -Wstrict-prototypes
-Wmissing-prototypes -Wmissing-declarations -Wbad-function-cast
-Wnested-externs -Wcast-align -Wpointer-arith -Waggregate-return -Wcast-qual
-Wwrite-strings -Wundef -Wpacked -Wfloat-equal -Wunused-macros
-Wold-style-definition -Winit-self -Wmissing-include-dirs -Wlogical-op
-Wjump-misses-init -Wformat=2 -Wshift-overflow=2 -Wnull-dereference
-Wduplicated-cond -Walloc-zero -Walloca -Wstringop-overflow=2
-Wduplicated-branches -Wno-format-nonliteral -Wno-stringop-truncation
-Wno-format-truncation -fanalyzer -Wno-analyzer-fd-use-without-check
-fanalyzer-call-summaries -o makecfg  ./makecfg.c

results in

during IPA pass: analyzer
./makecfg.c: In function ‘parse_tbl’:
./makecfg.c:140:25: internal compiler error: in get_or_create_cluster, at
analyzer/store.cc:2832
  140 |                         store_data(buffer, "");
      |                         ^~~~~~~~~~~~~~~~~~~~~~
0x7f3d31181d8f __libc_start_call_main
        ../sysdeps/nptl/libc_start_call_main.h:58
0x7f3d31181e3f __libc_start_main_impl
        ../csu/libc-start.c:392

without "-fanalyzer-call-summaries" it works as expected, but "complains":

/makecfg.c: In function ‘parse_tbl’:
./makecfg.c:116:1: warning: leak of ‘<unknown>’ [CWE-401]
[-Wanalyzer-malloc-lea
k]
  116 | }
[...]

[Bug analyzer/107158] internal compiler error: in get_or_create_cluster, at analyzer/store.cc:2832

[urs at akk dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107158

--- Comment #1 from urs at akk dot org ---
Created attachment 53668
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53668&action=edit
internal compiler error: in get_or_create_cluster, at analyzer/store.cc:2832

[Bug analyzer/107158] internal compiler error: in get_or_create_cluster, at analyzer/store.cc:2832

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107158

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2022-10-05

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug.  Confirmed; am investigating.

[Bug analyzer/107158] internal compiler error: in get_or_create_cluster, at analyzer/store.cc:2832

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107158

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:ef878564140cbcf23f479da88e07e5a996cec6bb

commit r13-3096-gef878564140cbcf23f479da88e07e5a996cec6bb
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Wed Oct 5 14:07:47 2022 -0400

    analyzer: add regression test for PR 107158

    PR analyzer/107158 reports an ICE when using
      -fanalyzer -fanalyzer-call-summaries
    on a particular source file.

    It turns out I just fixed this ICE in r13-3094-g6832c95c0e1a58.

    This followup patch adds a somewhat reduced reproducer as a regression
    test.  Unfortunately, although the ICE is fixed, there are two false
    positives from -Wanalyzer-malloc-leak on the test case, so I'm going to
    use PR analyzer/107158 for tracking those false positives.

    gcc/testsuite/ChangeLog:
            PR analyzer/107158
            * gcc.dg/analyzer/call-summaries-pr107158.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/107158] False postives from -Wanalyzer-malloc-leak on tin-2.6.2

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107158

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|internal compiler error: in |False postives from
                   |get_or_create_cluster, at   |-Wanalyzer-malloc-leak on
                   |analyzer/store.cc:2832      |tin-2.6.2
             Blocks|                            |99390

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
The ICE should be fixed by the above patch.

As noted above,  although the ICE is fixed, there are two false positives from
-Wanalyzer-malloc-leak on the test case, so I'm going to reuse this bug for
tracking those; retitling accordingly, and adding to the call summarization
tracker bug.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99390
[Bug 99390] [meta-bug] tracker bug for call summaries in -fanalyzer

[Bug analyzer/107158] False postives from -Wanalyzer-malloc-leak on tin-2.6.2

[urs at akk dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107158

--- Comment #5 from urs at akk dot org ---
Now (git @ e99dcbb54e07b798c3353124f38336f96a826d43; same $CFLAGS and source
file)

during IPA pass: analyzer
./makecfg.c: In function ‘parse_tbl’:
./makecfg.c:150:25: internal compiler error: in bind_key, at
analyzer/store.cc:1356
  150 |                         store_data(buffer, s);
      |                         ^~~~~~~~~~~~~~~~~~~~~
0x7fec3b172d8f __libc_start_call_main
        ../sysdeps/nptl/libc_start_call_main.h:58
0x7fec3b172e3f __libc_start_main_impl
        ../csu/libc-start.c:392

[Bug analyzer/107158] False postives from -Wanalyzer-malloc-leak on tin-2.6.2

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107158

--- Comment #6 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks;  I can reproduce the ICE using the attachment.  Looks like I reduced
the reproducer too much; sorry.

[Bug analyzer/107158] False postives from -Wanalyzer-malloc-leak on tin-2.6.2

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107158

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:629b4813e91aba0a8fc9b18434ec1808776a4b3d

commit r13-3138-g629b4813e91aba0a8fc9b18434ec1808776a4b3d
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Oct 6 15:46:49 2022 -0400

    analyzer: fix another ICE in PR 107158

    I overreduced PR analyzer/107158 in r13-3096-gef878564140cbc, and there
    was another ICE in the original reproducer, which this patch fixes.

    gcc/analyzer/ChangeLog:
            PR analyzer/107158
            * store.cc (store::replay_call_summary_cluster): Eliminate
            special-casing of RK_HEAP_ALLOCATED in favor of sharing code with
            RK_DECL, avoiding an ICE due to attempting to bind a
            compound_svalue into a binding_cluster when an svalue in the
            summary cluster converts to a compound_svalue in the caller.

    gcc/testsuite/ChangeLog:
            PR analyzer/107158
            * gcc.dg/analyzer/call-summaries-pr107158-2.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/107158] False postives from -Wanalyzer-malloc-leak on tin-2.6.2

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107158

--- Comment #8 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
I believe the above patch fixes the remaining ICEs on the attachment.  Please
let me know if you find other ways to crash it.

Keeping this open to track the memory leak false +ves.

[Bug analyzer/107158] False postives from -Wanalyzer-malloc-leak on tin-2.6.2

[urs at akk dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107158

--- Comment #9 from urs at akk dot org ---
After commit ce917b0422c145779b83e005afd8433c0c86fb06 this doesn't show up
anymore.