[Bug analyzer/110928] New: ICE with -fanalyzer on -Wanalyzer-out-of-bounds checker

["geoffreydgr at icloud dot com" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110928

            Bug ID: 110928
           Summary: ICE with -fanalyzer on -Wanalyzer-out-of-bounds
                    checker
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: geoffreydgr at icloud dot com
  Target Milestone: ---

ICE bug when analyzing the folowing program. And there also is a FP report of
out-of-bounds. 

cmd: gcc -O0 -fanalyzer
gcc version: x86-64 gcc (trunk)
compiler explore: https://godbolt.org/z/Gsx5WTqKj

```c
#include "stdio.h"
#include "stdint.h"


uint64_t d(int32_t h) {
  uint64_t j[2][6];
  int32_t k;
  for (k = 1;;) {
    printf("FLAG\n");
    if (h < 106 || j[k][h])
      return 0;
  }
}
int16_t e() {
  int32_t f[5];
  for (f[2] = 3; f[2]; --f[2])
    d(0);
}

int main() { e(); }

```

output:
```
<source>: In function 'd':
<source>:10:24: warning: stack-based buffer over-read [CWE-121]
[-Wanalyzer-out-of-bounds]
   10 |     if (h < 106 || j[k][h])
      |                    ~~~~^~~
  'd': events 1-4
    |
    |    6 |   uint64_t j[2][6];
    |      |            ^
    |      |            |
    |      |            (1) capacity: 96 bytes
    |......
    |   10 |     if (h < 106 || j[k][h])
    |      |        ~           ~~~~~~~
    |      |        |               |
    |      |        |               (3) ...to here
    |      |        |               (4) read of 8 bytes at offset 'h * 8 + 48'
exceeds 'j'
    |      |        (2) following 'false' branch (when 'h > 105')...
    |
<source>:10:24: note: valid subscripts for 'j' are '[0]' to '[1]'
   10 |     if (h < 106 || j[k][h])
      |                    ~~~~^~~
during IPA pass: analyzer
<source>:10:8: internal compiler error: in fold_binary_loc, at
fold-const.cc:11320
   10 |     if (h < 106 || j[k][h])
      |        ^
0x216b2ae internal_error(char const*, ...)
        ???:0
0x9d1202 fancy_abort(char const*, int, char const*)
        ???:0
0xcdba8d fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
        ???:0
0x172fc13 generic_simplify_MULT_EXPR(unsigned int, tree_code, tree_node*,
tree_node*, tree_node*)
        ???:0
0xcd40c5 fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
        ???:0
0xcdba8d fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
        ???:0
0x14beb7f ana::region_offset::calc_symbolic_bit_offset(ana::region_model
const&) const
        ???:0
0x213be3b ana::access_range::get_size(ana::region_model const&,
ana::bit_size_expr*) const
        ???:0
0x2148663 ana::access_diagram_impl::access_diagram_impl(ana::access_operation
const&, diagnostic_event_id_t, text_art::style_manager&, text_art::theme
const&, ana::logger*)
        ???:0
0x213ce0b ana::access_diagram::access_diagram(ana::access_operation const&,
diagnostic_event_id_t, text_art::style_manager&, text_art::theme const&,
ana::logger*)
        ???:0
0x1fbf5d3 ana::symbolic_buffer_over_read::emit(rich_location*, ana::logger*)
        ???:0
0x1fe653e ana::diagnostic_manager::emit_saved_diagnostic(ana::exploded_graph
const&, ana::saved_diagnostic const&)
        ???:0
0x1fe6d40 ana::diagnostic_manager::emit_saved_diagnostics(ana::exploded_graph
const&)
        ???:0
0x149e891 ana::impl_run_checkers(ana::logger*)
        ???:0
0x149f83f ana::run_checkers()
        ???:0
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
Compiler returned: 1
```