[Bug analyzer/113222] New: ICE with -fanalyzer seen on Linux kernel kernel/sched/core.c

[Bug analyzer/113222] New: ICE with -fanalyzer seen on Linux kernel kernel/sched/core.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113222

            Bug ID: 113222
           Summary: ICE with -fanalyzer seen on Linux kernel
                    kernel/sched/core.c
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
            Blocks: 106358
  Target Milestone: ---

Given:

VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV    
struct sched_class
{
  int f;
};
extern struct sched_class __end_sched_classes[];

int
test ()
{
  const struct sched_class* class = ((__end_sched_classes - 1));
  return class->f;
}
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

trunk with -fanalyzer ICEs with:

/tmp/t.c: In function ‘test’:
/tmp/t.c:11:15: warning: buffer under-read [CWE-127] [-Wanalyzer-out-of-bounds]
   11 |   return class->f;
      |          ~~~~~^~~
  ‘test’: event 1
    |
    |   11 |   return class->f;
    |      |          ~~~~~^~~
    |      |               |
    |      |               (1) out-of-bounds read from byte -4 till byte -1 but
‘__end_sched_classes’ starts at byte 0
    |
during IPA pass: analyzer
/tmp/t.c:11:15: internal compiler error: Segmentation fault
   11 |   return class->f;
      |          ~~~~~^~~
0x10708aa crash_signal
        ../../src/gcc/toplev.cc:316
0x2299a65 tree_check6(tree_node*, char const*, int, char const*, tree_code,
tree_code, tree_code, tree_code, tree_code, tree_code)
        ../../src/gcc/tree.h:3726
0x2299a65 ana::valid_region_spatial_item::add_boundaries(ana::boundaries&,
ana::logger*) const
        ../../src/gcc/analyzer/access-diagram.cc:1337
0x229e2e0 ana::access_diagram_impl::find_boundaries() const
        ../../src/gcc/analyzer/access-diagram.cc:2197
0x229e2e0 ana::access_diagram_impl::access_diagram_impl(ana::access_operation
const&, diagnostic_event_id_t, text_art::style_manager&, text_art::theme
const&, ana::logger*)
        ../../src/gcc/analyzer/access-diagram.cc:2064
0x229283b std::enable_if<!std::is_array<ana::access_diagram_impl>::value,
std::unique_ptr<ana::access_diagram_impl,
std::default_delete<ana::access_diagram_impl> > >::type
make_unique<ana::access_diagram_impl, ana::access_operation const&,
diagnostic_event_id_t&, text_art::style_manager&, text_art::theme const&,
ana::logger*&>(ana::access_operation const&, diagnostic_event_id_t&,
text_art::style_manager&, text_art::theme const&, ana::logger*&)
        ../../src/gcc/make-unique.h:41
0x229283b ana::access_diagram::access_diagram(ana::access_operation const&,
diagnostic_event_id_t, text_art::style_manager&, text_art::theme const&,
ana::logger*)
        ../../src/gcc/analyzer/access-diagram.cc:2666
0x212b331 ana::out_of_bounds::make_access_diagram(ana::access_operation const&,
text_art::style_manager&, text_art::theme const&, ana::logger*) const
        ../../src/gcc/analyzer/bounds-checking.cc:208
0x212b331 ana::out_of_bounds::maybe_show_diagram(ana::logger*) const
        ../../src/gcc/analyzer/bounds-checking.cc:187
0x212b803
ana::concrete_buffer_under_read::emit(ana::diagnostic_emission_context&)
        ../../src/gcc/analyzer/bounds-checking.cc:806
0x214ff37 ana::diagnostic_manager::emit_saved_diagnostic(ana::exploded_graph
const&, ana::saved_diagnostic&)
        ../../src/gcc/analyzer/diagnostic-manager.cc:1617
0x2153ba6 ana::dedupe_winners::emit_best(ana::diagnostic_manager*,
ana::exploded_graph const&)
        ../../src/gcc/analyzer/diagnostic-manager.cc:1472
0x215053f ana::diagnostic_manager::emit_saved_diagnostics(ana::exploded_graph
const&)
        ../../src/gcc/analyzer/diagnostic-manager.cc:1524
0x1479be4 ana::impl_run_checkers(ana::logger*)
        ../../src/gcc/analyzer/engine.cc:6226
0x147ab56 ana::run_checkers()
        ../../src/gcc/analyzer/engine.cc:6300
0x146be6c execute
        ../../src/gcc/analyzer/analyzer-pass.cc:87
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.


Trunk:        affected: https://godbolt.org/z/11axozEc1
GCC 13.2: not affected: https://godbolt.org/z/43sdrx9jf


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106358
[Bug 106358] [meta-bug] tracker bug for building the Linux kernel with
-fanalyzer

[Bug analyzer/113222] ICE with -fanalyzer seen on Linux kernel kernel/sched/core.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113222

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-01-03
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
I'm testing a fix

[Bug analyzer/113222] ICE with -fanalyzer seen on Linux kernel kernel/sched/core.c

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113222

--- Comment #2 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:db5b01d282a0e3ddcac737e55f9758c8b081cf4b

commit r14-6917-gdb5b01d282a0e3ddcac737e55f9758c8b081cf4b
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Jan 4 09:12:40 2024 -0500

    analyzer: handle arrays of unknown size in access diagrams [PR113222]

    gcc/analyzer/ChangeLog:
            PR analyzer/113222
            * access-diagram.cc (valid_region_spatial_item::add_boundaries):
            Handle TYPE_DOMAIN being null.
            (valid_region_spatial_item::add_array_elements_to_table):
            Likewise.

    gcc/testsuite/ChangeLog:
            PR analyzer/113222
            * gcc.dg/analyzer/out-of-bounds-diagram-pr113222.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/113222] ICE with -fanalyzer seen on Linux kernel kernel/sched/core.c

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113222

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above commit.