[Bug analyzer/111305] New: GCC Static Analyzer -Wanalyzer-out-of-bounds FP and ICE problem

["geoffreydgr at icloud dot com" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111305

            Bug ID: 111305
           Summary: GCC Static Analyzer -Wanalyzer-out-of-bounds FP and
                    ICE problem
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: geoffreydgr at icloud dot com
  Target Milestone: ---

ICE bug when analyzing the folowing program. And there also is a FP report of
out-of-bounds. 

cmd: gcc -O0 -fanalyzer
gcc version: x86-64 gcc (trunk)
see it live:
https://godbolt.org/z/qKxde131e

```
#include <stdio.h>
#include <stdint.h>

struct a {
  uint32_t b;
};
union c {
  int8_t b;
};

int32_t *d( int32_t *j, int32_t k, struct a l) {
  int64_t m[1]= {0};
  for (l.b = 0; l.b <= 0; l.b++) {
    printf("FLAG\n");
    l.b == 12 && m[l.b];
  }
}

```

out:
```
<source>: In function 'd':
<source>:15:19: warning: stack-based buffer over-read [CWE-121]
[-Wanalyzer-out-of-bounds]
   15 |     l.b == 12 && m[l.b];
      |                  ~^~~~~
  'd': events 1-10
    |
    |   12 |   int64_t m[1]= {0};
    |      |           ^
    |      |           |
    |      |           (1) capacity: 8 bytes
    |   13 |   for (l.b = 0; l.b <= 0; l.b++) {
    |      |                 ~~~~~~~~
    |      |                     |
    |      |                     (2) following 'true' branch...
    |      |                     (6) following 'true' branch...
    |   14 |     printf("FLAG\n");
    |      |     ~~~~~~~~~~~~~~~~
    |      |     |
    |      |     (3) ...to here
    |      |     (7) ...to here
    |   15 |     l.b == 12 && m[l.b];
    |      |     ~~~~~~~~~~~~~~~~~~~
    |      |               |   | |
    |      |               |   | (9) ...to here
    |      |               |   (10) read of 8 bytes at offset 'l.b * 8' exceeds
'm'
    |      |               (4) following 'false' branch...
    |      |               (5) ...to here
    |      |               (8) following 'true' branch...
    |
<source>:15:19: note: valid subscripts for 'm' are '[0]' to '[0]'
   15 |     l.b == 12 && m[l.b];
      |                  ~^~~~~
during IPA pass: analyzer
<source>:15:15: internal compiler error: in decompose, at wide-int.h:990
   15 |     l.b == 12 && m[l.b];
      |     ~~~~~~~~~~^~~~~~~~~
0x21af71e internal_error(char const*, ...)
        ???:0
0x9dd814 fancy_abort(char const*, int, char const*)
        ???:0
0x185a343 tree_zero_one_valued_p(tree_node*)
        ???:0
0x214b222 generic_simplify_MULT_EXPR(unsigned int, tree_code, tree_node*,
tree_node*, tree_node*)
        ???:0
0xce1d05 fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
        ???:0
0xce96cd fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
        ???:0
0x18f3716 generic_simplify_23(unsigned int, tree_node*, tree_node*, tree_node*,
tree_node**, tree_code)
        ???:0
0x186889c generic_simplify_PLUS_EXPR(unsigned int, tree_code, tree_node*,
tree_node*, tree_node*)
        ???:0
0xce1d05 fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
        ???:0
0xce96cd fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
        ???:0
0x21505bf generic_simplify_MULT_EXPR(unsigned int, tree_code, tree_node*,
tree_node*, tree_node*)
        ???:0
0xce1d05 fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
        ???:0
0xce96cd fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
        ???:0
0x14d2c3f ana::region_offset::calc_symbolic_bit_offset(ana::region_model
const&) const
        ???:0
0x217faff ana::access_range::get_size(ana::region_model const&,
ana::bit_size_expr*) const
        ???:0
0x218cad3 ana::access_diagram_impl::access_diagram_impl(ana::access_operation
const&, diagnostic_event_id_t, text_art::style_manager&, text_art::theme
const&, ana::logger*)
        ???:0
0x2180abb ana::access_diagram::access_diagram(ana::access_operation const&,
diagnostic_event_id_t, text_art::style_manager&, text_art::theme const&,
ana::logger*)
        ???:0
0x2111f43 ana::symbolic_buffer_over_read::emit(rich_location*, ana::logger*)
        ???:0
0x2139d1e ana::diagnostic_manager::emit_saved_diagnostic(ana::exploded_graph
const&, ana::saved_diagnostic&)
        ???:0
0x213a520 ana::diagnostic_manager::emit_saved_diagnostics(ana::exploded_graph
const&)
        ???:0
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
Compiler returned: 1
```