public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/114159] New: [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0
@ 2024-02-28 20:44 zsojka at seznam dot cz
2024-02-29 8:15 ` [Bug analyzer/114159] " rguenth at gcc dot gnu.org
` (5 more replies)
0 siblings, 6 replies; 7+ messages in thread
From: zsojka at seznam dot cz @ 2024-02-28 20:44 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159
Bug ID: 114159
Summary: [13/14 Regression] ICE: in call_info, at
analyzer/call-info.cc:143 with -fanalyzer
-fanalyzer-call-summaries
--param=analyzer-max-svalue-depth=0
Product: gcc
Version: 14.0
Status: UNCONFIRMED
Keywords: ice-on-valid-code
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: zsojka at seznam dot cz
Target Milestone: ---
Host: x86_64-pc-linux-gnu
Target: x86_64-pc-linux-gnu
Created attachment 57572
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57572&action=edit
auto-reduced testcase
Compiler output:
$ x86_64-pc-linux-gnu-gcc -fanalyzer -fanalyzer-call-summaries
--param=analyzer-max-svalue-depth=0 pr36690-2.i
during IPA pass: analyzer
pr36690-2.i: In function 'main':
pr36690-2.i:13:3: internal compiler error: in call_info, at
analyzer/call-info.cc:143
13 | foo();
| ^~~~~
0xdc029b ana::call_info::call_info(ana::call_details const&)
/repo/gcc-trunk/gcc/analyzer/call-info.cc:143
0xdc029b ana::call_info::call_info(ana::call_details const&)
/repo/gcc-trunk/gcc/analyzer/call-info.cc:139
0x190bf18 ana::call_summary_edge_info::call_summary_edge_info(ana::call_details
const&, function*, ana::call_summary*, ana::extrinsic_state const&)
/repo/gcc-trunk/gcc/analyzer/engine.cc:1619
0x190bf18 std::enable_if<!std::is_array<ana::call_summary_edge_info>::value,
std::unique_ptr<ana::call_summary_edge_info,
std::default_delete<ana::call_summary_edge_info> > >::type
make_unique<ana::call_summary_edge_info, ana::call_details&, function*&,
ana::call_summary*&, ana::extrinsic_state const&>(ana::call_details&,
function*&, ana::call_summary*&, ana::extrinsic_state const&)
/repo/gcc-trunk/gcc/make-unique.h:41
0x190bf18 ana::exploded_node::replay_call_summary(ana::exploded_graph&,
ana::supernode const*, gcall const*, ana::program_state*, ana::path_context*,
function*, ana::call_summary*, ana::region_model_context*)
/repo/gcc-trunk/gcc/analyzer/engine.cc:1734
0x190c0bd ana::exploded_node::replay_call_summaries(ana::exploded_graph&,
ana::supernode const*, gcall const*, ana::program_state*, ana::path_context*,
function*, ana::per_function_data*, ana::region_model_context*)
/repo/gcc-trunk/gcc/analyzer/engine.cc:1677
0x19119df ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode
const*, gimple const*, ana::program_state*, ana::uncertainty_t*, bool*,
ana::path_context*)
/repo/gcc-trunk/gcc/analyzer/engine.cc:1499
0x19143ba ana::exploded_graph::process_node(ana::exploded_node*)
/repo/gcc-trunk/gcc/analyzer/engine.cc:4124
0x191532a ana::exploded_graph::process_worklist()
/repo/gcc-trunk/gcc/analyzer/engine.cc:3515
0x1917a85 ana::impl_run_checkers(ana::logger*)
/repo/gcc-trunk/gcc/analyzer/engine.cc:6209
0x1918996 ana::run_checkers()
/repo/gcc-trunk/gcc/analyzer/engine.cc:6300
0x19075f8 execute
/repo/gcc-trunk/gcc/analyzer/analyzer-pass.cc:87
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r14-9216-20240228150317-g5c01ede02a1-checking-yes-rtl-df-extra-nobootstrap-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/14.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--disable-bootstrap --with-cloog --with-ppl --with-isl
--build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu
--target=x86_64-pc-linux-gnu --with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r14-9216-20240228150317-g5c01ede02a1-checking-yes-rtl-df-extra-nobootstrap-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.1 20240228 (experimental) (GCC)
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug analyzer/114159] [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0
2024-02-28 20:44 [Bug analyzer/114159] New: [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0 zsojka at seznam dot cz
@ 2024-02-29 8:15 ` rguenth at gcc dot gnu.org
2024-02-29 16:24 ` dmalcolm at gcc dot gnu.org
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: rguenth at gcc dot gnu.org @ 2024-02-29 8:15 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|--- |13.3
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug analyzer/114159] [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0
2024-02-28 20:44 [Bug analyzer/114159] New: [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0 zsojka at seznam dot cz
2024-02-29 8:15 ` [Bug analyzer/114159] " rguenth at gcc dot gnu.org
@ 2024-02-29 16:24 ` dmalcolm at gcc dot gnu.org
2024-02-29 23:16 ` cvs-commit at gcc dot gnu.org
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2024-02-29 16:24 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |ASSIGNED
Ever confirmed|0 |1
Last reconfirmed| |2024-02-29
--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug.
Happens for --param=analyzer-max-svalue-depth=3 and below:
https://godbolt.org/z/enfqznExK
due to:
6267 const svalue *fn_ptr_sval = get_rvalue (fn_ptr, ctxt);
in region_model::get_fndecl_for_call returning an UNKNOWN_SVALUE rather than a
ptr to a function_region, due to exceeding the complexity limit.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug analyzer/114159] [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0
2024-02-28 20:44 [Bug analyzer/114159] New: [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0 zsojka at seznam dot cz
2024-02-29 8:15 ` [Bug analyzer/114159] " rguenth at gcc dot gnu.org
2024-02-29 16:24 ` dmalcolm at gcc dot gnu.org
@ 2024-02-29 23:16 ` cvs-commit at gcc dot gnu.org
2024-02-29 23:21 ` [Bug analyzer/114159] [13 " dmalcolm at gcc dot gnu.org
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2024-02-29 23:16 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159
--- Comment #2 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:
https://gcc.gnu.org/g:c0d8a64e72324d1c2981da21a66394bf8f7a2889
commit r14-9245-gc0d8a64e72324d1c2981da21a66394bf8f7a2889
Author: David Malcolm <dmalcolm@redhat.com>
Date: Thu Feb 29 17:57:08 2024 -0500
analyzer: fix ICE in call summarization [PR114159]
PR analyzer/114159 reports an ICE inside playback of call summaries
for very low values of --param=analyzer-max-svalue-depth=VAL.
Root cause is that call_summary_edge_info's ctor tries to evaluate
the function ptr of a gimple call stmt and assumes it gets a function *,
but with low values of --param=analyzer-max-svalue-depth=VAL we get
back an UNKNOWN svalue, rather than a pointer to a specific function.
Fix by adding a new call_info ctor that passes a specific
const function & from the call_summary_edge_info, rather than trying
to compute the function.
In doing so, I noticed that the analyzer was using "function *" despite
not modifying functions, and was sloppy about can-be-null versus
must-be-non-null function pointers, so I "constified" the function, and
converted the many places where the function must be non-null to be
"const function &".
gcc/analyzer/ChangeLog:
PR analyzer/114159
* analyzer.cc: Include "tree-dfa.h".
(get_ssa_default_def): New decl.
* analyzer.h (get_ssa_default_def): New.
* call-info.cc (call_info::call_info): New ctor taking an explicit
called_fn.
* call-info.h (call_info::call_info): Likewise.
* call-summary.cc (call_summary_replay::call_summary_replay):
Convert param from function * to const function &.
* call-summary.h (call_summary_replay::call_summary_replay):
Likewise.
* checker-event.h (state_change_event::get_dest_function):
Constify return value.
* engine.cc (point_and_state::validate): Update for conversion to
const function &.
(exploded_node::on_stmt): Likewise.
(call_summary_edge_info::call_summary_edge_info): Likewise.
Pass in called_fn to call_info ctor.
(exploded_node::replay_call_summaries): Update for conversion to
const function &. Convert per_function_data from * to &.
(exploded_node::replay_call_summary): Update for conversion to
const function &.
(exploded_graph::add_function_entry): Likewise.
(toplevel_function_p): Likewise.
(add_tainted_args_callback): Likewise.
(exploded_graph::build_initial_worklist): Likewise.
(exploded_graph::maybe_create_dynamic_call): Likewise.
(maybe_update_for_edge): Likewise.
(exploded_graph::on_escaped_function): Likewise.
* exploded-graph.h (exploded_node::replay_call_summaries):
Likewise.
(exploded_node::replay_call_summary): Likewise.
(exploded_graph::add_function_entry): Likewise.
* program-point.cc (function_point::from_function_entry):
Likewise.
(program_point::from_function_entry): Likewise.
* program-point.h (function_point::from_function_entry): Likewise.
(program_point::from_function_entry): Likewise.
* program-state.cc (program_state::push_frame): Likewise.
(program_state::get_current_function): Constify return type.
* program-state.h (program_state::push_frame): Update for
conversion to const function &.
(program_state::get_current_function): Likewise.
* region-model-manager.cc
(region_model_manager::get_frame_region): Likewise.
* region-model-manager.h
(region_model_manager::get_frame_region): Likewise.
* region-model.cc (region_model::called_from_main_p): Likewise.
(region_model::update_for_gcall): Likewise.
(region_model::push_frame): Likewise.
(region_model::get_current_function): Constify return type.
(region_model::pop_frame): Update for conversion to
const function &.
(selftest::test_stack_frames): Likewise.
(selftest::test_get_representative_path_var): Likewise.
(selftest::test_state_merging): Likewise.
(selftest::test_alloca): Likewise.
* region-model.h (region_model::push_frame): Likewise.
(region_model::get_current_function): Likewise.
* region.cc (frame_region::dump_to_pp): Likewise.
(frame_region::get_region_for_local): Likewise.
* region.h (class frame_region): Likewise.
* sm-signal.cc (signal_unsafe_call::describe_state_change):
Likewise.
(update_model_for_signal_handler): Likewise.
(signal_delivery_edge_info_t::update_model): Likewise.
(register_signal_handler::impl_transition): Likewise.
* state-purge.cc (class gimple_op_visitor): Likewise.
(state_purge_map::state_purge_map): Likewise.
(state_purge_map::get_or_create_data_for_decl): Likewise.
(state_purge_per_ssa_name::state_purge_per_ssa_name): Likewise.
(state_purge_per_ssa_name::add_to_worklist): Likewise.
(state_purge_per_ssa_name::process_point): Likewise.
(state_purge_per_decl::add_to_worklist): Likewise.
(state_purge_annotator::print_needed): Likewise.
* state-purge.h
(state_purge_map::get_or_create_data_for_decl): Likewise.
(class state_purge_per_tree): Likewise.
(class state_purge_per_ssa_name): Likewise.
(class state_purge_per_decl): Likewise.
* supergraph.cc (supergraph::dump_dot_to_pp): Likewise.
* supergraph.h
(supergraph::get_node_for_function_entry): Likewise.
(supergraph::get_node_for_function_exit): Likewise.
gcc/ChangeLog:
PR analyzer/114159
* function.cc (function_name): Make param const.
* function.h (function_name): Likewise.
gcc/testsuite/ChangeLog:
PR analyzer/114159
* c-c++-common/analyzer/call-summaries-pr114159.c: New test.
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug analyzer/114159] [13 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0
2024-02-28 20:44 [Bug analyzer/114159] New: [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0 zsojka at seznam dot cz
` (2 preceding siblings ...)
2024-02-29 23:16 ` cvs-commit at gcc dot gnu.org
@ 2024-02-29 23:21 ` dmalcolm at gcc dot gnu.org
2024-05-13 11:28 ` rguenth at gcc dot gnu.org
2024-05-21 9:19 ` jakub at gcc dot gnu.org
5 siblings, 0 replies; 7+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2024-02-29 23:21 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|[13/14 Regression] ICE: in |[13 Regression] ICE: in
|call_info, at |call_info, at
|analyzer/call-info.cc:143 |analyzer/call-info.cc:143
|with -fanalyzer |with -fanalyzer
|-fanalyzer-call-summaries |-fanalyzer-call-summaries
|--param=analyzer-max-svalue |--param=analyzer-max-svalue
|-depth=0 |-depth=0
--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed on trunk for GCC 14 by the above patch.
Keeping open to track backporting the fix to GCC 13.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug analyzer/114159] [13 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0
2024-02-28 20:44 [Bug analyzer/114159] New: [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0 zsojka at seznam dot cz
` (3 preceding siblings ...)
2024-02-29 23:21 ` [Bug analyzer/114159] [13 " dmalcolm at gcc dot gnu.org
@ 2024-05-13 11:28 ` rguenth at gcc dot gnu.org
2024-05-21 9:19 ` jakub at gcc dot gnu.org
5 siblings, 0 replies; 7+ messages in thread
From: rguenth at gcc dot gnu.org @ 2024-05-13 11:28 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P3 |P2
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug analyzer/114159] [13 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0
2024-02-28 20:44 [Bug analyzer/114159] New: [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0 zsojka at seznam dot cz
` (4 preceding siblings ...)
2024-05-13 11:28 ` rguenth at gcc dot gnu.org
@ 2024-05-21 9:19 ` jakub at gcc dot gnu.org
5 siblings, 0 replies; 7+ messages in thread
From: jakub at gcc dot gnu.org @ 2024-05-21 9:19 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159
Jakub Jelinek <jakub at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|13.3 |13.4
--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 13.3 is being released, retargeting bugs to GCC 13.4.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2024-05-21 9:19 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-02-28 20:44 [Bug analyzer/114159] New: [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0 zsojka at seznam dot cz
2024-02-29 8:15 ` [Bug analyzer/114159] " rguenth at gcc dot gnu.org
2024-02-29 16:24 ` dmalcolm at gcc dot gnu.org
2024-02-29 23:16 ` cvs-commit at gcc dot gnu.org
2024-02-29 23:21 ` [Bug analyzer/114159] [13 " dmalcolm at gcc dot gnu.org
2024-05-13 11:28 ` rguenth at gcc dot gnu.org
2024-05-21 9:19 ` jakub at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).