[Bug analyzer/107788] New: [13 Regression] ICE in wide_int_to_tree_1, at tree.cc:1757

[Bug analyzer/107788] New: [13 Regression] ICE in wide_int_to_tree_1, at tree.cc:1757

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107788

            Bug ID: 107788
           Summary: [13 Regression] ICE in wide_int_to_tree_1, at
                    tree.cc:1757
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

g++ 13.0.0 20221120 snapshot (g:a16a5460447eaaff0b4468064e4d7b1cc8fc42eb) ICEs
when compiling libstdc++-v3/testsuite/20_util/bind/placeholders.cc w/
-fanalyzer -fno-early-inlining:

% g++-13 -fanalyzer -fno-early-inlining -Ilibstdc++-v3/testsuite/util -c
libstdc++-v3/testsuite/20_util/bind/placeholders.cc
during IPA pass: analyzer
In file included from libstdc++-v3/testsuite/20_util/bind/placeholders.cc:22:
libstdc++-v3/testsuite/20_util/bind/placeholders.cc: In function 'void
test01()':
libstdc++-v3/testsuite/20_util/bind/placeholders.cc:31:20: internal compiler
error: in wide_int_to_tree_1, at tree.cc:1757
   31 |   VERIFY( std::bind(std::minus<int>(), _1, _2)(five, seven) == -2 );
      |           ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/opt/compiler-test-corpus/gcc-13-20221120/libstdc++-v3/testsuite/util/testsuite_hooks.h:64:12:
note: in definition of macro 'VERIFY'
   64 |     if (! (fn))                                                        
\
      |            ^~
0x88e5f6 wide_int_to_tree_1
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/tree.cc:1757
0x14c8dcf wide_int_to_tree(tree_node*, poly_int<1u,
generic_wide_int<wide_int_ref_storage<false, true> > > const&)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/tree.cc:1869
0x14c8dcf build_int_cst(tree_node*, poly_int<1u, long>)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/tree.cc:1509
0x15dfd17 ana::region_model_manager::get_or_create_int_cst(tree_node*,
poly_int<1u, long>)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/region-model-manager.cc:236
0x15beae0 ana::region_model::update_for_int_cst_return(ana::call_details
const&, int, bool)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/region-model.cc:1934
0x15fa781 on_bind
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/sm-fd.cc:1874
0x15fa781 ana::region_model::on_bind(ana::call_details const&, bool)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/sm-fd.cc:2284
0x15d6b76 ana::kf_bind::outcome_of_bind::update_model(ana::region_model*,
ana::exploded_edge const*, ana::region_model_context*) const
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/region-model-impl-calls.cc:630
0x159821e ana::exploded_graph::process_node(ana::exploded_node*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/engine.cc:4170
0x1598d7a ana::exploded_graph::process_worklist()
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/engine.cc:3457
0x159b504 ana::impl_run_checkers(ana::logger*)
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/engine.cc:6110
0x159c506 ana::run_checkers()
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/engine.cc:6198
0x158ae08 execute
       
/var/tmp/portage/sys-devel/gcc-13.0.0_p20221120/work/gcc-13-20221120/gcc/analyzer/analyzer-pass.cc:87

I'll try to reduce the testcase later today.

[Bug analyzer/107788] [13 Regression] ICE in wide_int_to_tree_1, at tree.cc:1757

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107788

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-11-21
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Reduced to:

struct minus {
} _1;
int _2;
struct _Bind {
  _Bind(_Bind &);
};
template <typename _Func, typename _BoundArgs>
_Bind bind(_Func, _BoundArgs &&...);
void test01() { bind(minus(), _2, _1); }

[Bug analyzer/107788] [13 Regression] ICE in wide_int_to_tree_1, at tree.cc:1757 since r13-4074-g86a90006864840c2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107788

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[13 Regression] ICE in      |[13 Regression] ICE in
                   |wide_int_to_tree_1, at      |wide_int_to_tree_1, at
                   |tree.cc:1757                |tree.cc:1757 since
                   |                            |r13-4074-g86a90006864840c2

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r13-4074-g86a90006864840c2.

[Bug analyzer/107788] [13 Regression] ICE in wide_int_to_tree_1, at tree.cc:1757 since r13-4074-g86a90006864840c2

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107788

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.0

[Bug analyzer/107788] [13 Regression] ICE in wide_int_to_tree_1, at tree.cc:1757 since r13-4074-g86a90006864840c2

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107788

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:4e4e45a4fd341174d8231ee6a99e6fe308904f8f

commit r13-4221-g4e4e45a4fd341174d8231ee6a99e6fe308904f8f
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Nov 21 19:08:18 2022 -0500

    analyzer: fix ICE on 'bind' that returns a struct [PR107788]

    gcc/analyzer/ChangeLog:
            PR analyzer/107788
            * region-model.cc (region_model::update_for_int_cst_return):
            Require that the return type be an integer type.
            (region_model::update_for_nonzero_return): Likewise.

    gcc/testsuite/ChangeLog:
            PR analyzer/107788
            * g++.dg/analyzer/fd-bind-pr107783.C: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/107788] [13 Regression] ICE in wide_int_to_tree_1, at tree.cc:1757 since r13-4074-g86a90006864840c2

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107788

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug, and thanks for reducing it.  The ICE should be
fixed by the above commit.

That said, the known_function machinery is erroneously deciding to use the
"bind" handling even for std::bind, so keeping this open to track only doing it
for names in the root namespace.

[Bug analyzer/107788] [13 Regression] ICE in wide_int_to_tree_1, at tree.cc:1757 since r13-4074-g86a90006864840c2

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107788

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:ec7c796de020cb5cd955aa5b26c92b1da49d6076

commit r13-4249-gec7c796de020cb5cd955aa5b26c92b1da49d6076
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Tue Nov 22 17:29:21 2022 -0500

    analyzer: only look for named functions in root ns [PR107788]

    gcc/analyzer/ChangeLog:
            PR analyzer/107788
            * known-function-manager.cc (known_function_manager::get_match):
            Don't look up fndecls by name when they're not in the root
            namespace.

    gcc/testsuite/ChangeLog:
            PR analyzer/107788
            * g++.dg/analyzer/named-functions.C: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/107788] [13 Regression] ICE in wide_int_to_tree_1, at tree.cc:1757 since r13-4074-g86a90006864840c2

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107788

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
(In reply to David Malcolm from comment #4)
> That said, the known_function machinery is erroneously deciding to use the
> "bind" handling even for std::bind, so keeping this open to track only doing
> it for names in the root namespace.

Fixed by the commit in comment #5.

Marking this as resolved.