[Bug analyzer/107777] New: [13 Regression] ICE in get_representative_path_var_1, at analyzer/region-model.cc:4750

[Bug analyzer/107777] New: [13 Regression] ICE in get_representative_path_var_1, at analyzer/region-model.cc:4750

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107777

            Bug ID: 107777
           Summary: [13 Regression] ICE in get_representative_path_var_1,
                    at analyzer/region-model.cc:4750
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

gcc 13.0.0 20221120 snapshot (g:a16a5460447eaaff0b4468064e4d7b1cc8fc42eb) ICEs
when compiling the following testcase w/ -fanalyzer:

int *
__errno_location (void);

long int
read (int, void *, unsigned long int);

struct IOBUF {
  int fd;
};

void
do_getline_end_data (struct IOBUF *iop, int tree)
{
  char end_data;

  if (tree)
    *__errno_location () = 0;

  read (iop->fd, &end_data, sizeof end_data);
}

% gcc-13 -fanalyzer -c ofd9impz.c
during IPA pass: analyzer
ofd9impz.c: In function 'do_getline_end_data':
ofd9impz.c:19:3: internal compiler error: in get_representative_path_var_1, at
analyzer/region-model.cc:4750
   19 |   read (iop->fd, &end_data, sizeof end_data);
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x7bd41c ana::region_model::get_representative_path_var_1(ana::region const*,
hash_set<ana::svalue const*, false, default_hash_traits<ana::svalue const*> >*)
const
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/region-model.cc:4750
0x12cbbd8 ana::region_model::get_representative_path_var(ana::region const*,
hash_set<ana::svalue const*, false, default_hash_traits<ana::svalue const*> >*)
const
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/region-model.cc:4896
0x131dc1f ana::binding_cluster::get_representative_path_vars(ana::region_model
const*, hash_set<ana::svalue const*, false, default_hash_traits<ana::svalue
const*> >*, ana::region const*, ana::svalue const*, auto_vec<ana::path_var,
0ul>*) const
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/store.cc:2111
0x131e7e8 ana::store::get_representative_path_vars(ana::region_model const*,
hash_set<ana::svalue const*, false, default_hash_traits<ana::svalue const*> >*,
ana::svalue const*, auto_vec<ana::path_var, 0ul>*) const
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/store.cc:2987
0x12cb1a8 ana::region_model::get_representative_path_var_1(ana::svalue const*,
hash_set<ana::svalue const*, false, default_hash_traits<ana::svalue const*> >*)
const
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/region-model.cc:4626
0x12cb501 ana::region_model::get_representative_path_var(ana::svalue const*,
hash_set<ana::svalue const*, false, default_hash_traits<ana::svalue const*> >*)
const
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/region-model.cc:4693
0x12cb501 ana::region_model::get_representative_path_var(ana::svalue const*,
hash_set<ana::svalue const*, false, default_hash_traits<ana::svalue const*> >*)
const
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/region-model.cc:4685
0x12cb501 ana::region_model::get_representative_tree(ana::svalue const*) const
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/region-model.cc:4712
0x12add04 ana::impl_sm_context::get_diagnostic_tree(tree_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/engine.cc:433
0x13089ef check_for_open_fd
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/sm-fd.cc:1550
0x1309cfc on_read
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/sm-fd.cc:1533
0x1309cfc on_stmt
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/sm-fd.cc:1246
0x12a590f ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode
const*, gimple const*, ana::program_state*, ana::uncertainty_t*,
ana::path_context*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/engine.cc:1485
0x12a8895 ana::exploded_graph::process_node(ana::exploded_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/engine.cc:4054
0x12a984a ana::exploded_graph::process_worklist()
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/engine.cc:3457
0x12abfd4 ana::impl_run_checkers(ana::logger*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/engine.cc:6110
0x12acfd6 ana::run_checkers()
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/engine.cc:6198
0x129b8d8 execute
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/analyzer-pass.cc:87

[Bug analyzer/107777] [13 Regression] ICE in get_representative_path_var_1, at analyzer/region-model.cc:4750 since r13-3770-g3d2d04cda493fb55

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107777

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-11-21
                 CC|                            |marxin at gcc dot gnu.org
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
            Summary|[13 Regression] ICE in      |[13 Regression] ICE in
                   |get_representative_path_var |get_representative_path_var
                   |_1, at                      |_1, at
                   |analyzer/region-model.cc:47 |analyzer/region-model.cc:47
                   |50                          |50 since
                   |                            |r13-3770-g3d2d04cda493fb55

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r13-3770-g3d2d04cda493fb55.

[Bug analyzer/107777] [13 Regression] ICE in get_representative_path_var_1, at analyzer/region-model.cc:4750 since r13-3770-g3d2d04cda493fb55

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107777

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:358dab90186b30a5d287710f13625c327210218d

commit r13-4219-g358dab90186b30a5d287710f13625c327210218d
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Nov 21 19:08:17 2022 -0500

    analyzer: fix ICE on writes to errno [PR107777]

    gcc/analyzer/ChangeLog:
            PR analyzer/107777
            * call-summary.cc
            (call_summary_replay::convert_region_from_summary_1): Handle
            RK_THREAD_LOCAL and RK_ERRNO in switch.
            * region-model.cc (region_model::get_representative_path_var_1):
            Likewise.

    gcc/testsuite/ChangeLog:
            PR analyzer/107777
            * gcc.dg/analyzer/call-summaries-errno.c: New test.
            * gcc.dg/analyzer/errno-pr107777.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/107777] [13 Regression] ICE in get_representative_path_var_1, at analyzer/region-model.cc:4750 since r13-3770-g3d2d04cda493fb55

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107777

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug.  Should be fixed by the above commit.

[Bug analyzer/107777] [13 Regression] ICE in get_representative_path_var_1, at analyzer/region-model.cc:4750 since r13-3770-g3d2d04cda493fb55

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107777

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.0