[Bug analyzer/110882] New: ICE with -fanalyzer on zero-sized array

[Bug analyzer/110882] New: ICE with -fanalyzer on zero-sized array

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110882

            Bug ID: 110882
           Summary: ICE with -fanalyzer on zero-sized array
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
  Target Milestone: ---

ICE seen with -fanalyzer on this code:

-----------------------------------------------------------------

struct csv_row {
  char *columns[0];
};

void
parse_csv_line(int n_columns,
               const char *columns[])
{
  for (int n = 0; n < n_columns; n++) {
      columns[n] = ((void *)0);
  }
}

void parse_csv_data(int n_columns,
                    struct csv_row *entry)
{
  parse_csv_line(n_columns, (const char **)entry->columns);
}

-----------------------------------------------------------------

ICE happens on gcc 13 onwards; specifically, affects:
- trunk: https://godbolt.org/z/To7c1r8ME
- gcc 13.2: https://godbolt.org/z/a5zr5Ga4b

gcc 12.3 is not affected

[Bug analyzer/110882] ICE with -fanalyzer on zero-sized array

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110882

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
It's failing this assertion:

#1  0x00000000016e2295 in ana::binding_key::make (mgr=0x7fffffff91d8,
r=0x3275340) at ../../src/gcc/analyzer/store.cc:132
132               gcc_assert (bit_size > 0);
(gdb) list
127         {
128           bit_size_t bit_size;
129           if (r->get_bit_size (&bit_size))
130             {
131               /* Must be non-empty.  */
132               gcc_assert (bit_size > 0);
133               return mgr->get_concrete_binding (offset.get_bit_offset (),
134                                                 bit_size);
135             }
136           else

[Bug analyzer/110882] ICE with -fanalyzer on zero-sized array

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110882

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-08-02

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Reduced from downstream bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2228600

[Bug analyzer/110882] [13/14 Regression] ICE with -fanalyzer on zero-sized array

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110882

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:c62f93d1e0383def445d4ef2b812468cb7cdaf05

commit r14-2955-gc62f93d1e0383def445d4ef2b812468cb7cdaf05
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Aug 3 09:47:44 2023 -0400

    analyzer: fix ICE on zero-sized arrays [PR110882]

    gcc/analyzer/ChangeLog:
            PR analyzer/110882
            * region.cc (int_size_in_bits): Fail on zero-sized types.

    gcc/testsuite/ChangeLog:
            PR analyzer/110882
            * gcc.dg/analyzer/pr110882.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/110882] [13 Regression] ICE with -fanalyzer on zero-sized array

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110882

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[13/14 Regression] ICE with |[13 Regression] ICE with
                   |-fanalyzer on zero-sized    |-fanalyzer on zero-sized
                   |array                       |array

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed on trunk for gcc 14 by the above patch.

Keeping open to track backporting this to gcc 13.

[Bug analyzer/110882] [13 Regression] ICE with -fanalyzer on zero-sized array

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110882

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:f80efa49b7a1639b0d6e9bcea8cf38850d037a02

commit r14-2957-gf80efa49b7a1639b0d6e9bcea8cf38850d037a02
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Aug 3 10:47:22 2023 -0400

    testsuite, analyzer: add test case [PR108171]

    The ICE in PR analyzer/108171 appears to be a dup of the recently fixed
    PR analyzer/110882 and is likewise fixed by it; adding this test case.

    gcc/testsuite/ChangeLog:
            PR analyzer/108171
            * gcc.dg/analyzer/pr108171.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/110882] [13 Regression] ICE with -fanalyzer on zero-sized array

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110882

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |asolokha at gmx dot com

--- Comment #6 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
*** Bug 108171 has been marked as a duplicate of this bug. ***

[Bug analyzer/110882] [13 Regression] ICE with -fanalyzer on zero-sized array

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110882

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.3

[Bug analyzer/110882] [13 Regression] ICE with -fanalyzer on zero-sized array

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110882

--- Comment #7 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by David Malcolm
<dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:a0b13d0860848dd5f2876897ada1e22e4e681e91

commit r13-8747-ga0b13d0860848dd5f2876897ada1e22e4e681e91
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu May 9 13:09:28 2024 -0400

    analyzer: fix ICE on zero-sized arrays [PR110882]

    gcc/analyzer/ChangeLog:
            PR analyzer/110882
            * region.cc (int_size_in_bits): Fail on zero-sized types.

    gcc/testsuite/ChangeLog:
            PR analyzer/110882
            * gcc.dg/analyzer/pr110882.c: New test.

    (cherry picked from commit r14-2955-gc62f93d1e0383d)

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/110882] [13 Regression] ICE with -fanalyzer on zero-sized array

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110882

--- Comment #8 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by David Malcolm
<dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:44968a0e00f656e9bb3e504bb2fa1a8282002015

commit r13-8748-g44968a0e00f656e9bb3e504bb2fa1a8282002015
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu May 9 13:09:28 2024 -0400

    testsuite, analyzer: add test case [PR108171]

    The ICE in PR analyzer/108171 appears to be a dup of the recently fixed
    PR analyzer/110882 and is likewise fixed by it; adding this test case.

    gcc/testsuite/ChangeLog:
            PR analyzer/108171
            * gcc.dg/analyzer/pr108171.c: New test.

    (cherry picked from commit r14-2957-gf80efa49b7a163)

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/110882] ICE with -fanalyzer on zero-sized array

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110882

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED
            Summary|[13 Regression] ICE with    |ICE with -fanalyzer on
                   |-fanalyzer on zero-sized    |zero-sized array
                   |array                       |

--- Comment #9 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed for GCC 13 (for the upcoming GCC 13.3) by the above patch.