[Bug analyzer/113998] New: [14 Regression] ICE: in get_last_byte_offset, at analyzer/ranges.cc:171 with -fanalyzer and __builtin_strncpy()

[Bug analyzer/113998] New: [14 Regression] ICE: in get_last_byte_offset, at analyzer/ranges.cc:171 with -fanalyzer and __builtin_strncpy()

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113998

            Bug ID: 113998
           Summary: [14 Regression] ICE: in get_last_byte_offset, at
                    analyzer/ranges.cc:171 with -fanalyzer and
                    __builtin_strncpy()
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 57463
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57463&action=edit
reduced testcase

Compiler output:
$ x86_64-pc-linux-gnu-gcc -fanalyzer testcase.c
during IPA pass: analyzer
testcase.c: In function 'main':
testcase.c:7:3: internal compiler error: in get_last_byte_offset, at
analyzer/ranges.cc:171
    7 |   __builtin_strncpy (a, a, n);
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~
0xdd3983
ana::symbolic_byte_range::get_last_byte_offset(ana::region_model_manager&)
const
        /repo/gcc-trunk/gcc/analyzer/ranges.cc:171
0x29727b7 ana::symbolic_byte_range::intersection(ana::symbolic_byte_range
const&, ana::region_model const&) const
        /repo/gcc-trunk/gcc/analyzer/ranges.cc:202
0x2948321 ana::call_details::complain_about_overlap(unsigned int, unsigned int,
ana::svalue const*) const
        /repo/gcc-trunk/gcc/analyzer/call-details.cc:517
0x194238f update_model
        /repo/gcc-trunk/gcc/analyzer/kf.cc:1545
0x193038a ana::exploded_graph::process_node(ana::exploded_node*)
        /repo/gcc-trunk/gcc/analyzer/engine.cc:4240
0x1930e3a ana::exploded_graph::process_worklist()
        /repo/gcc-trunk/gcc/analyzer/engine.cc:3515
0x19335a3 ana::impl_run_checkers(ana::logger*)
        /repo/gcc-trunk/gcc/analyzer/engine.cc:6209
0x19344b6 ana::run_checkers()
        /repo/gcc-trunk/gcc/analyzer/engine.cc:6300
0x1922e58 execute
        /repo/gcc-trunk/gcc/analyzer/analyzer-pass.cc:87
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r14-9062-20240219114159-geb17bdc211a-checking-yes-rtl-df-extra-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/14.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--with-cloog --with-ppl --with-isl --build=x86_64-pc-linux-gnu
--host=x86_64-pc-linux-gnu --target=x86_64-pc-linux-gnu
--with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r14-9062-20240219114159-geb17bdc211a-checking-yes-rtl-df-extra-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.1 20240219 (experimental) (GCC)

[Bug analyzer/113998] [14 Regression] ICE: in get_last_byte_offset, at analyzer/ranges.cc:171 with -fanalyzer and __builtin_strncpy()

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113998

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-02-19

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Confirmed: ICE on trunk: https://godbolt.org/z/bja1K6rxx
Doesn't affect GCC 13

[Bug analyzer/113998] [14 Regression] ICE: in get_last_byte_offset, at analyzer/ranges.cc:171 with -fanalyzer and __builtin_strncpy()

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113998

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug.

I'm testing a fix.

[Bug analyzer/113998] [14 Regression] ICE: in get_last_byte_offset, at analyzer/ranges.cc:171 with -fanalyzer and __builtin_strncpy()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113998

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0

[Bug analyzer/113998] [14 Regression] ICE: in get_last_byte_offset, at analyzer/ranges.cc:171 with -fanalyzer and __builtin_strncpy()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113998

--- Comment #3 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:79d4c7ddc83e000adc8174b179dff44a88d5a41b

commit r14-9090-g79d4c7ddc83e000adc8174b179dff44a88d5a41b
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Tue Feb 20 19:44:50 2024 -0500

    analyzer: handle empty ranges in symbolic_byte_range::intersection
[PR113998]

    gcc/analyzer/ChangeLog:
            PR analyzer/113998
            * ranges.cc (symbolic_byte_range::intersection): Handle empty
ranges.
            (selftest::test_intersects): Add test coverage for empty ranges.

    gcc/testsuite/ChangeLog:
            PR analyzer/113998
            * c-c++-common/analyzer/overlapping-buffers-pr113998.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/113998] [14 Regression] ICE: in get_last_byte_offset, at analyzer/ranges.cc:171 with -fanalyzer and __builtin_strncpy()

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113998

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above patch; marking as resolved.