[Bug analyzer/114159] New: [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0

[Bug analyzer/114159] New: [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159

            Bug ID: 114159
           Summary: [13/14 Regression] ICE: in call_info, at
                    analyzer/call-info.cc:143 with -fanalyzer
                    -fanalyzer-call-summaries
                    --param=analyzer-max-svalue-depth=0
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 57572
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57572&action=edit
auto-reduced testcase

Compiler output:
$ x86_64-pc-linux-gnu-gcc -fanalyzer -fanalyzer-call-summaries
--param=analyzer-max-svalue-depth=0 pr36690-2.i
during IPA pass: analyzer
pr36690-2.i: In function 'main':
pr36690-2.i:13:3: internal compiler error: in call_info, at
analyzer/call-info.cc:143
   13 |   foo();
      |   ^~~~~
0xdc029b ana::call_info::call_info(ana::call_details const&)
        /repo/gcc-trunk/gcc/analyzer/call-info.cc:143
0xdc029b ana::call_info::call_info(ana::call_details const&)
        /repo/gcc-trunk/gcc/analyzer/call-info.cc:139
0x190bf18 ana::call_summary_edge_info::call_summary_edge_info(ana::call_details
const&, function*, ana::call_summary*, ana::extrinsic_state const&)
        /repo/gcc-trunk/gcc/analyzer/engine.cc:1619
0x190bf18 std::enable_if<!std::is_array<ana::call_summary_edge_info>::value,
std::unique_ptr<ana::call_summary_edge_info,
std::default_delete<ana::call_summary_edge_info> > >::type
make_unique<ana::call_summary_edge_info, ana::call_details&, function*&,
ana::call_summary*&, ana::extrinsic_state const&>(ana::call_details&,
function*&, ana::call_summary*&, ana::extrinsic_state const&)
        /repo/gcc-trunk/gcc/make-unique.h:41
0x190bf18 ana::exploded_node::replay_call_summary(ana::exploded_graph&,
ana::supernode const*, gcall const*, ana::program_state*, ana::path_context*,
function*, ana::call_summary*, ana::region_model_context*)
        /repo/gcc-trunk/gcc/analyzer/engine.cc:1734
0x190c0bd ana::exploded_node::replay_call_summaries(ana::exploded_graph&,
ana::supernode const*, gcall const*, ana::program_state*, ana::path_context*,
function*, ana::per_function_data*, ana::region_model_context*)
        /repo/gcc-trunk/gcc/analyzer/engine.cc:1677
0x19119df ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode
const*, gimple const*, ana::program_state*, ana::uncertainty_t*, bool*,
ana::path_context*)
        /repo/gcc-trunk/gcc/analyzer/engine.cc:1499
0x19143ba ana::exploded_graph::process_node(ana::exploded_node*)
        /repo/gcc-trunk/gcc/analyzer/engine.cc:4124
0x191532a ana::exploded_graph::process_worklist()
        /repo/gcc-trunk/gcc/analyzer/engine.cc:3515
0x1917a85 ana::impl_run_checkers(ana::logger*)
        /repo/gcc-trunk/gcc/analyzer/engine.cc:6209
0x1918996 ana::run_checkers()
        /repo/gcc-trunk/gcc/analyzer/engine.cc:6300
0x19075f8 execute
        /repo/gcc-trunk/gcc/analyzer/analyzer-pass.cc:87
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.


$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r14-9216-20240228150317-g5c01ede02a1-checking-yes-rtl-df-extra-nobootstrap-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/14.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--disable-bootstrap --with-cloog --with-ppl --with-isl
--build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu
--target=x86_64-pc-linux-gnu --with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r14-9216-20240228150317-g5c01ede02a1-checking-yes-rtl-df-extra-nobootstrap-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.1 20240228 (experimental) (GCC)

[Bug analyzer/114159] [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.3

[Bug analyzer/114159] [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-02-29

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug.

Happens for --param=analyzer-max-svalue-depth=3 and below:
  https://godbolt.org/z/enfqznExK
due to:
 6267     const svalue *fn_ptr_sval = get_rvalue (fn_ptr, ctxt);
in region_model::get_fndecl_for_call returning an UNKNOWN_SVALUE rather than a
ptr to a function_region, due to exceeding the complexity limit.

[Bug analyzer/114159] [13/14 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159

--- Comment #2 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:c0d8a64e72324d1c2981da21a66394bf8f7a2889

commit r14-9245-gc0d8a64e72324d1c2981da21a66394bf8f7a2889
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Feb 29 17:57:08 2024 -0500

    analyzer: fix ICE in call summarization [PR114159]

    PR analyzer/114159 reports an ICE inside playback of call summaries
    for very low values of --param=analyzer-max-svalue-depth=VAL.

    Root cause is that call_summary_edge_info's ctor tries to evaluate
    the function ptr of a gimple call stmt and assumes it gets a function *,
    but with low values of --param=analyzer-max-svalue-depth=VAL we get
    back an UNKNOWN svalue, rather than a pointer to a specific function.

    Fix by adding a new call_info ctor that passes a specific
    const function & from the call_summary_edge_info, rather than trying
    to compute the function.

    In doing so, I noticed that the analyzer was using "function *" despite
    not modifying functions, and was sloppy about can-be-null versus
    must-be-non-null function pointers, so I "constified" the function, and
    converted the many places where the function must be non-null to be
    "const function &".

    gcc/analyzer/ChangeLog:
            PR analyzer/114159
            * analyzer.cc: Include "tree-dfa.h".
            (get_ssa_default_def): New decl.
            * analyzer.h (get_ssa_default_def): New.
            * call-info.cc (call_info::call_info): New ctor taking an explicit
            called_fn.
            * call-info.h (call_info::call_info): Likewise.
            * call-summary.cc (call_summary_replay::call_summary_replay):
            Convert param from function * to const function &.
            * call-summary.h (call_summary_replay::call_summary_replay):
            Likewise.
            * checker-event.h (state_change_event::get_dest_function):
            Constify return value.
            * engine.cc (point_and_state::validate): Update for conversion to
            const function &.
            (exploded_node::on_stmt): Likewise.
            (call_summary_edge_info::call_summary_edge_info): Likewise.
            Pass in called_fn to call_info ctor.
            (exploded_node::replay_call_summaries): Update for conversion to
            const function &.  Convert per_function_data from * to &.
            (exploded_node::replay_call_summary): Update for conversion to
            const function &.
            (exploded_graph::add_function_entry): Likewise.
            (toplevel_function_p): Likewise.
            (add_tainted_args_callback): Likewise.
            (exploded_graph::build_initial_worklist): Likewise.
            (exploded_graph::maybe_create_dynamic_call): Likewise.
            (maybe_update_for_edge): Likewise.
            (exploded_graph::on_escaped_function): Likewise.
            * exploded-graph.h (exploded_node::replay_call_summaries):
            Likewise.
            (exploded_node::replay_call_summary): Likewise.
            (exploded_graph::add_function_entry): Likewise.
            * program-point.cc (function_point::from_function_entry):
            Likewise.
            (program_point::from_function_entry): Likewise.
            * program-point.h (function_point::from_function_entry): Likewise.
            (program_point::from_function_entry): Likewise.
            * program-state.cc (program_state::push_frame): Likewise.
            (program_state::get_current_function): Constify return type.
            * program-state.h (program_state::push_frame): Update for
            conversion to const function &.
            (program_state::get_current_function): Likewise.
            * region-model-manager.cc
            (region_model_manager::get_frame_region): Likewise.
            * region-model-manager.h
            (region_model_manager::get_frame_region): Likewise.
            * region-model.cc (region_model::called_from_main_p): Likewise.
            (region_model::update_for_gcall): Likewise.
            (region_model::push_frame): Likewise.
            (region_model::get_current_function): Constify return type.
            (region_model::pop_frame): Update for conversion to
            const function &.
            (selftest::test_stack_frames): Likewise.
            (selftest::test_get_representative_path_var): Likewise.
            (selftest::test_state_merging): Likewise.
            (selftest::test_alloca): Likewise.
            * region-model.h (region_model::push_frame): Likewise.
            (region_model::get_current_function): Likewise.
            * region.cc (frame_region::dump_to_pp): Likewise.
            (frame_region::get_region_for_local): Likewise.
            * region.h (class frame_region): Likewise.
            * sm-signal.cc (signal_unsafe_call::describe_state_change):
            Likewise.
            (update_model_for_signal_handler): Likewise.
            (signal_delivery_edge_info_t::update_model): Likewise.
            (register_signal_handler::impl_transition): Likewise.
            * state-purge.cc (class gimple_op_visitor): Likewise.
            (state_purge_map::state_purge_map): Likewise.
            (state_purge_map::get_or_create_data_for_decl): Likewise.
            (state_purge_per_ssa_name::state_purge_per_ssa_name): Likewise.
            (state_purge_per_ssa_name::add_to_worklist): Likewise.
            (state_purge_per_ssa_name::process_point): Likewise.
            (state_purge_per_decl::add_to_worklist): Likewise.
            (state_purge_annotator::print_needed): Likewise.
            * state-purge.h
            (state_purge_map::get_or_create_data_for_decl): Likewise.
            (class state_purge_per_tree): Likewise.
            (class state_purge_per_ssa_name): Likewise.
            (class state_purge_per_decl): Likewise.
            * supergraph.cc (supergraph::dump_dot_to_pp): Likewise.
            * supergraph.h
            (supergraph::get_node_for_function_entry): Likewise.
            (supergraph::get_node_for_function_exit): Likewise.

    gcc/ChangeLog:
            PR analyzer/114159
            * function.cc (function_name): Make param const.
            * function.h (function_name): Likewise.

    gcc/testsuite/ChangeLog:
            PR analyzer/114159
            * c-c++-common/analyzer/call-summaries-pr114159.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/114159] [13 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[13/14 Regression] ICE: in  |[13 Regression] ICE: in
                   |call_info, at               |call_info, at
                   |analyzer/call-info.cc:143   |analyzer/call-info.cc:143
                   |with -fanalyzer             |with -fanalyzer
                   |-fanalyzer-call-summaries   |-fanalyzer-call-summaries
                   |--param=analyzer-max-svalue |--param=analyzer-max-svalue
                   |-depth=0                    |-depth=0

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed on trunk for GCC 14 by the above patch.

Keeping open to track backporting the fix to GCC 13.

[Bug analyzer/114159] [13 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug analyzer/114159] [13 Regression] ICE: in call_info, at analyzer/call-info.cc:143 with -fanalyzer -fanalyzer-call-summaries --param=analyzer-max-svalue-depth=0

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114159

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|13.3                        |13.4

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 13.3 is being released, retargeting bugs to GCC 13.4.